Person or Entity Authentication¶
Last 1 Enterprises LLC / LastVet Safeguard category: Technical HIPAA Security Rule citation: 45 CFR §164.312(d) Status: Scaffold (Bucket 1c). Not approved for enforcement until Ryan review.
Document metadata¶
| Field | Value |
|---|---|
| Policy owner | TODO (Ryan) |
| Version | 0.1-scaffold |
| Effective date | TODO (Ryan) |
| Review cadence | Annual (TODO: Ryan confirm) |
| Approver | TODO (Ryan) |
| Last reviewed | 2026-08-26 (scaffold only) |
1. Purpose¶
Verify persons or entities seeking access to ePHI.
2. Scope¶
Veteran app, provider portal, operator admin interfaces, API integrations.
3. Policy statements¶
- Veterans shall authenticate via established LastVet / last1.id / Sign in with Apple flows as implemented.
- Providers shall authenticate before accessing consent-gated records.
- Machine-to-machine access shall use scoped credentials (BWS-injected secrets, no shared passwords in repo).
- TODO (Ryan): MFA requirements for operator and provider accounts.
4. Roles and responsibilities¶
| Role | Responsibility |
|---|---|
| Security Officer (Ryan) | TODO (Ryan): assign formal Security Rule responsible person per §164.308(a)(2) |
| Workforce members | TODO (Ryan): acknowledge policy when hired / annually |
| Contractors / BAs | TODO (Ryan): flow-down via BAA and agreements |
5. LastVet-specific context (from existing docs)¶
VA OAuth on device for VA API access (token not on server). Provider portal uses last1.id OIDC (auth.last1.id). BWS for runtime secrets.
6. Related documents¶
../HIPAA_ARCHITECTURE.md— asset inventory and data flows (Bucket 1a)../HIPAA_RISK_ANALYSIS.md— risk register (Bucket 1b)../../security/POSTURE.md— canonical security posture../../../last.vet-api/docs/security/SECURITY_POSTURE_TOKEN_CUSTODY.md
7. Ryan TODO (substantive content deferred)¶
- MFA policy for Tailscale and BWS.
- Provider identity proofing alignment with onboarding.
- Service account rotation schedule.