Transmission Security¶
Last 1 Enterprises LLC / LastVet Safeguard category: Technical HIPAA Security Rule citation: 45 CFR §164.312(e)(1) Status: Scaffold (Bucket 1c). Not approved for enforcement until Ryan review.
Document metadata¶
| Field | Value |
|---|---|
| Policy owner | TODO (Ryan) |
| Version | 0.1-scaffold |
| Effective date | TODO (Ryan) |
| Review cadence | Annual (TODO: Ryan confirm) |
| Approver | TODO (Ryan) |
| Last reviewed | 2026-08-26 (scaffold only) |
1. Purpose¶
Guard against unauthorized access to ePHI transmitted over electronic communications networks.
2. Scope¶
Public API (Caddy), Postgres TLS, Tailscale, MinIO, veteran/provider clients.
3. Policy statements¶
- Integrity controls and encryption shall protect ePHI in transit where required.
- Public API endpoints shall use TLS 1.3 with valid certificates (Let's Encrypt via Caddy).
- Hybrid post-quantum key exchange (X25519MLKEM768) implemented per PQ_TLS_POSTURE.md.
- Postgres connections shall use
sslmode=require. East-west traffic uses Tailscale WireGuard. - API hostnames shall remain Cloudflare DNS-only (no proxy in PHI path).
4. Roles and responsibilities¶
| Role | Responsibility |
|---|---|
| Security Officer (Ryan) | TODO (Ryan): assign formal Security Rule responsible person per §164.308(a)(2) |
| Workforce members | TODO (Ryan): acknowledge policy when hired / annually |
| Contractors / BAs | TODO (Ryan): flow-down via BAA and agreements |
5. LastVet-specific context (from existing docs)¶
POSTURE.md §6 documents TLS and PQ posture. Cox static IP to Caddy; no CDN termination on api.last.vet.
6. Related documents¶
../HIPAA_ARCHITECTURE.md— asset inventory and data flows (Bucket 1a)../HIPAA_RISK_ANALYSIS.md— risk register (Bucket 1b)../../security/POSTURE.md— canonical security posture../../security/PQ_TLS_POSTURE.md../../architecture/COX_STATIC_IP_INGRESS.md
7. Ryan TODO (substantive content deferred)¶
- Verify MinIO TLS configuration in ops runbook.
- Certificate expiry monitoring ownership.
- Client-side certificate pinning if ever required for mobile.