HIPAA Security Rule risk analysis scaffold (Bucket 1b)¶
Last 1 Enterprises LLC / LastVet
Status: Scaffold for Ryan review (2026-08-26). Not an attestation of HIPAA compliance or a completed Security Rule risk analysis.
Bucket: 1b only. Depends on Bucket 1a HIPAA_ARCHITECTURE.md (PR #36; TODOs may be open).
Methodology alignment: HHS OCR Security Risk Assessment (SRA) Tool structure; threat sources per NIST SP 800-30 Rev. 1 §2.2.
Rule: Cite existing docs. Do not invent controls or incidents. Unclear items use TODO (Ryan) or [Depends on 1a §4 TODO N: …].
Primary sources
| Source | Role |
|---|---|
HIPAA_ARCHITECTURE.md |
Asset inventory (§1), data flows (§2), network (§3), Ryan TODO list (§4) |
../security/POSTURE.md |
Threat model (§3), controls index, gap register |
../../last.vet-api/docs/security/SECURITY_POSTURE_DATABASE_ACCESS.md |
RLS, consent-table gap, migration policy |
../../last.vet-api/docs/security/SECURITY_POSTURE_TOKEN_CUSTODY.md |
VA OAuth device custody |
../../last.vet-api/docs/security/SECURITY_POSTURE_IMAGING_STORAGE.md |
Legacy AWS imaging; KMS load-bearing controls |
../security/IMAGING_ENVELOPE_ENCRYPTION.md |
R940 MinIO envelope (current path) |
../deployment/R940_ENVIRONMENT_TOPOLOGY.md |
Staging/prod hard walls |
../architecture/R940_PLATFORM_ARCHITECTURE.md |
Tenant map, VLAN target, backups |
ePHI admission note: As of companion docs, no real veteran PHI has been admitted; this analysis inventories future-state ePHI exposure on documented systems. Re-run likelihood/impact when case #00015000 approves production VA access.
1. Purpose and scope¶
1.1 Purpose¶
Document a repeatable risk analysis scaffold mapping LastVet assets and data flows to threats, vulnerabilities, existing controls, and treatment decisions required by the HIPAA Security Rule (45 CFR §164.308(a)(1)(ii)(A)).
1.2 Scope¶
| In scope | Out of scope |
|---|---|
LastVet R940 production/staging lane (lastvet-* VMs) |
Angel, Meridian, Sovereign tenant security (except where shared infra crosses boundaries) |
| Endpoints and SaaS that may handle LastVet ePHI or credentials | Product legal copy (last.vet-web policies) |
| Legacy AWS rollback net (synthetic / residual data) | Completed attestation to OCR or customers |
Organizational policies (see Bucket 1c HIPAA_POLICIES/) |
Penetration test finding detail (see API repo) |
1.3 Asset inventory reference¶
Authoritative inventory: HIPAA_ARCHITECTURE.md §1. This document references assets by Asset ID (derived from §1 table order). ePHI flags marked TODO in 1a carry placeholder vulnerability notes until Ryan closes §4 TODOs.
| Asset ID | Asset name (1a §1) | ePHI (1a) | Notes |
|---|---|---|---|
| A-PHY-01 | Dell PowerEdge R940 (pve-r940) |
TODO | Hypervisor; all LastVet VMs |
| A-PHY-02 | iDRAC (R940 OOB) | N | Management plane |
| A-PHY-03 | WD My Cloud (interim backup NAS) | TODO | [Depends on 1a §4 TODO 2: NAS model, rsync datasets, ePHI in dumps] |
| A-PHY-04 | Dell R730xd (planned backup NAS) | TODO | [Depends on 1a §4 TODO 2] |
| A-PHY-05 | APC UPS / batteries | N | Supporting |
| A-LV-01 | lastvet-api (VMID 107) |
Y | API processes PHI |
| A-LV-02 | lastvet-db (VMID 108) |
Y | Postgres 18; RLS on 4 clinical tables |
| A-LV-03 | lastvet-imaging (VMID 109) |
Y | MinIO + envelope |
| A-LV-04 | lastvet-edge (VMID 110) |
TODO | [Depends on 1a §4 TODO 1: request logging of PHI] |
| A-LV-05 | observability (VMID 111) |
TODO | [Depends on 1a §4 TODO 1: Loki audit-tier PHI identifiers] |
| A-OTH-01 | agent-01 |
TODO | [Depends on 1a §4 TODO 1] |
| A-OTH-02 | inference-01 |
N (policy) | No PHI persisted by policy |
| A-OTH-03 | meridian-eval |
N | Synthetic fixtures |
| A-OTH-04 | meridian-rag |
N | Separate tenant |
| A-OTH-05 | sovereign-app |
N | Not LastVet |
| A-OTH-06 | sovereign-mem |
N | Not LastVet |
| A-OTH-07 | angel-local |
TODO | [Depends on 1a §4 TODO 1] |
| A-OTH-08 | n8n-r940 |
TODO | [Depends on 1a §4 TODO 1] |
| A-OTH-09 | sovereign-db-last1id |
TODO | [Depends on 1a §4 TODO 1: identity PII linked to health products] |
| A-OTH-10 | auth-last1id |
TODO | [Depends on 1a §4 TODO 1] |
| A-EP-01 | Ryan Mac | TODO | [Depends on 1a §4 TODO 1] |
| A-EP-02 | iOS TestFlight / App Store clients | Y | VA token in Keychain |
| A-EP-03 | Provider browsers | Y | Consent-gated |
| A-EP-04 | Robert device | TODO | [Depends on 1a §4 TODO 1] |
| A-NET-01 | Netgear Orbi RBR860 | N | NAT / interim ingress |
| A-NET-02 | Netgear JGS524Ev2 switch | N | Flat LAN |
| A-NET-03 | SonicWall 3000-series | N if unused | [Depends on 1a §4 TODO 3] |
| A-NET-04 | Netgate 5200 (target) | N | [Depends on 1a §4 TODO 3] |
| A-NET-05 | Intel X710-T (R940 NIC) | N | Uplink |
| A-NET-06 | Cloudflare DNS | N (API path) | Grey-cloud API hostnames |
| A-NET-07 | Cloudflare Tunnel (cloudflared) |
TODO | [Depends on 1a §4 TODO 3] |
| A-NET-08 | Tailscale mesh | TODO | Admin path to PHI VMs |
| A-NET-09 | Cox static IP | N | Transit |
| A-SaaS-01 | AWS account 525382240840 |
Y if residual | [Depends on 1a §4 TODO 4] |
| A-SaaS-02 | AWS S3 imaging (legacy) | TODO | [Depends on 1a §4 TODO 4–5] |
| A-SaaS-03 | Backblaze B2 (planned) | Y when PHI backups | BAA planned |
| A-SaaS-04 | Bitwarden Secrets Manager | N | Secrets only |
| A-SaaS-05 | UptimeRobot | N | Synthetic checks |
| A-SaaS-06 | GitHub | TODO | [Depends on 1a §4 TODO 7] |
| A-SaaS-07 | Neon (Angel prod) | TODO | Angel-only |
| A-SaaS-08 | SendGrid / RealSend | TODO | [Depends on 1a §4 TODO 7] |
2. Threat identification (NIST SP 800-30 threat sources)¶
Threats are grouped by source type. Each threat has a stable ID for pairing and register rows.
2.1 Environmental threats¶
| Threat ID | Threat description | Example scenarios (LastVet context) |
|---|---|---|
| T-ENV-01 | Power loss / UPS exhaustion | APC failure during outage; unclean VM shutdown on R940 |
| T-ENV-02 | Hardware failure (disk, RAM, NIC) | ZFS pool degradation on lastvet-db or imaging dataset |
| T-ENV-03 | Fire / flood / building damage | On-prem R940 and NAS physical custody (operator site) |
| T-ENV-04 | Environmental control failure | TODO (Ryan): datacenter HVAC if colo move proceeds [Depends on 1a §4 TODO 8] |
2.2 Human — accidental threats¶
| Threat ID | Threat description | Example scenarios |
|---|---|---|
| T-HA-01 | Misconfiguration (network, firewall, DNS) | Orbi port-forward too broad; grey-cloud mis-set to proxied |
| T-HA-02 | Accidental data disclosure | Operator pastes PHI into GitHub issue, log snippet, or email |
| T-HA-03 | Failed or partial backup/restore | WD My Cloud rsync incomplete; untested R730xd restore |
| T-HA-04 | Deployment error (schema, secrets, env) | Wrong BWS project injected; staging secret on prod unit |
| T-HA-05 | Lost or unencrypted portable media | Mac backup or screenshot with veteran data |
| T-HA-06 | Application logic defect | Missing applyRequestDbContext on new query path (2026-07-21 class) |
2.3 Human — deliberate threats¶
| Threat ID | Threat description | Example scenarios |
|---|---|---|
| T-HD-01 | External network intrusion | Internet-facing Caddy/API exploit; credential stuffing on provider portal |
| T-HD-02 | Malicious insider (workforce) | Admin with Tailscale SSH exfiltrates Postgres dump |
| T-HD-03 | Malicious insider (provider) | Provider exceeds consent scope; scrapes consented records |
| T-HD-04 | Social engineering | Phishing veteran or operator for OTP / BWS access |
| T-HD-05 | Ransomware / destructive malware | Flat LAN lateral movement from compromised workstation |
| T-HD-06 | Supply-chain compromise | Compromised npm dependency in API build pipeline |
| T-HD-07 | Stolen credentials | Leaked MIGRATION_DATABASE_URL or BWS token from agent-01 |
2.4 Structural / systemic threats¶
| Threat ID | Threat description | Example scenarios |
|---|---|---|
| T-ST-01 | Single point of failure (compute) | All LastVet VMs on one R940 host |
| T-ST-02 | Flat LAN / missing segmentation | Non-LastVet VM reaches lastvet-db L2 [POSTURE.md §4 gap] |
| T-ST-03 | Incomplete database enforcement | Consent tables without RLS [SECURITY_POSTURE_DATABASE_ACCESS.md §3] |
| T-ST-04 | Designed bypass abuse | app.bypass_rls flag set outside approved provider-read paths |
| T-ST-05 | Legacy dual-path confusion | Residual AWS S3/RDS or client still on presigned path [Depends on 1a §4 TODO 4–5] |
| T-ST-06 | Log retention / integrity gap | Loki single VM; no offsite immutable audit archive [POSTURE.md §5] |
| T-ST-07 | Third-party dependency without BAA | SaaS processing ePHI identifiers without agreement [Depends on 1a §4 TODO 7] |
| T-ST-08 | Token custody model change | Web veteran client ships with weaker browser storage vs iOS Keychain |
3. Vulnerability identification (per asset)¶
Vulnerabilities describe conditions that could allow a threat to materialize. Vuln IDs pair to assets in §1.
| Vuln ID | Asset ID | Vulnerability description | Source / 1a dependency |
|---|---|---|---|
| V-A-LV-01-01 | A-LV-01 | Application bug bypassing consent checks before PHI read | POSTURE.md §7; pentest history |
| V-A-LV-01-02 | A-LV-01 | In-memory DEK exposure during envelope encrypt/decrypt | IMAGING_ENVELOPE_ENCRYPTION.md |
| V-A-LV-02-01 | A-LV-02 | 13 veteran-scoped tables lack RLS (incl. consent_grants, part2_consents) |
SECURITY_POSTURE_DATABASE_ACCESS.md §3 |
| V-A-LV-02-02 | A-LV-02 | Deliberate RLS policy bypass via app.bypass_rls |
SECURITY_POSTURE_DATABASE_ACCESS.md §4 |
| V-A-LV-02-03 | A-LV-02 | Owner pool / boot DDL path if mis-wired to requests | SECURITY_POSTURE_DATABASE_ACCESS.md §5 (gated prod) |
| V-A-LV-03-01 | A-LV-03 | MinIO credential compromise yields object access | Envelope adds key separation; ZFS encryption |
| V-A-LV-04-01 | A-LV-04 | TLS termination misconfiguration (weak cipher, cert expiry) | POSTURE.md §6 |
| V-A-LV-04-02 | A-LV-04 | Access logs capture URL paths or identifiers with PHI | [Depends on 1a §4 TODO 1] |
| V-A-LV-05-01 | A-LV-05 | Central logs aggregate PHI identifiers; insufficient retention controls | POSTURE.md §5; [Depends on 1a §4 TODO 1] |
| V-A-PHY-01-01 | A-PHY-01 | All tenants share one hypervisor; no hardware redundancy | R940_PLATFORM_ARCHITECTURE.md |
| V-A-PHY-03-01 | A-PHY-03 | Backup dumps may contain ePHI at rest on interim NAS | [Depends on 1a §4 TODO 2] |
| V-A-NET-02-01 | A-NET-02 | Flat LAN: no VLAN isolation between prod/staging/other products | HIPAA_ARCHITECTURE.md §3.1 |
| V-A-NET-01-01 | A-NET-01 | Consumer router as production ingress | Muster / COX ingress notes |
| V-A-NET-08-01 | A-NET-08 | Tailscale ACLs may allow broad admin access to PHI VMs | TODO (Ryan): document Tailscale ACL policy |
| V-A-EP-02-01 | A-EP-02 | Compromised veteran device reads Keychain VA token | SECURITY_POSTURE_TOKEN_CUSTODY.md |
| V-A-EP-03-01 | A-EP-03 | Provider session hijack on shared workstation | TODO (Ryan): session timeout / MFA policy |
| V-A-SaaS-01-01 | A-SaaS-01 | Residual PHI-class data in legacy AWS | [Depends on 1a §4 TODO 4] |
| V-A-SaaS-06-01 | A-SaaS-06 | Secrets or PHI in repo artifacts | [Depends on 1a §4 TODO 7] |
| V-A-SaaS-08-01 | A-SaaS-08 | Transactional email templates include ePHI in body | [Depends on 1a §4 TODO 7] |
| V-A-OTH-08-01 | A-OTH-08 | Automation workflow stores LastVet payload | [Depends on 1a §4 TODO 1] |
TODO (Ryan): Add vulnerability rows for every asset once §1 ePHI columns are finalized. Extend to Meridian/Angel only if cross-tenant boundary fails.
4. Threat–vulnerability pairing matrix¶
Legend: ● = credible pairing (include in risk register); ○ = pairing conditional on 1a TODO; — = not credible / out of scope.
| Threat ↓ / Vuln → | V-A-LV-01-01 | V-A-LV-02-01 | V-A-LV-02-02 | V-A-NET-02-01 | V-A-PHY-01-01 | V-A-PHY-03-01 | V-A-LV-05-01 | V-A-EP-02-01 | V-A-SaaS-01-01 | V-A-NET-08-01 |
|---|---|---|---|---|---|---|---|---|---|---|
| T-HD-01 External intrusion | ● | ● | ○ | ● | — | — | ○ | — | ○ | ○ |
| T-HD-02 Malicious insider | ● | ● | ● | ● | ● | ● | ● | — | ○ | ● |
| T-HA-06 App logic defect | ● | ● | ○ | — | — | — | — | — | — | — |
| T-HD-05 Ransomware | ○ | ○ | — | ● | ● | ● | ○ | — | — | ● |
| T-ENV-01 Power loss | — | ○ | — | — | ● | ○ | ● | — | — | — |
| T-ENV-02 Hardware failure | — | ● | — | — | ● | ● | ● | — | ○ | — |
| T-ST-01 Single host SPOF | — | — | — | — | ● | ○ | ● | — | — | — |
| T-ST-03 Consent table gap | — | ● | — | — | — | — | — | — | — | — |
| T-HD-04 Social engineering | ○ | ○ | — | — | — | — | — | ● | — | ● |
| T-ST-07 SaaS without BAA | — | — | — | — | — | — | ○ | — | — | — |
TODO (Ryan): Expand matrix to all Vuln IDs × relevant Threat IDs when vulnerability catalog is complete.
5. Likelihood and impact rating framework¶
5.1 Likelihood (placeholder scale)¶
| Rating | Label | Definition (adapt for LastVet) | Ryan fill |
|---|---|---|---|
| 1 | Rare | TODO (Ryan): expected frequency given current controls | |
| 2 | Unlikely | ||
| 3 | Possible | ||
| 4 | Likely | ||
| 5 | Almost certain |
Scaffold default: Pre-admission of real PHI, treat external deliberate exploitation of production as Likelihood = TODO (Ryan); document rationale when case #00015000 approves.
5.2 Impact (placeholder scale)¶
| Rating | Label | ePHI impact definition | Ryan fill |
|---|---|---|---|
| 1 | Minimal | No ePHI exposure; operational inconvenience only | |
| 2 | Limited | Exposure affecting small number of records or synthetic-only | |
| 3 | Moderate | Multiple veterans; consent or clinical metadata affected | |
| 4 | Major | Large-scale PHI disclosure or integrity loss | |
| 5 | Severe | Widespread breach, Part 2/SUD exposure, or inability to restore |
5.3 Risk level (placeholder)¶
| Risk score (L × I) | Level | Action |
|---|---|---|
| 1–4 | Low | Accept or monitor; document rationale |
| 5–9 | Medium | Mitigate within reasonable timeframe |
| 10–15 | High | Priority mitigation before real PHI admission where applicable |
| 16–25 | Critical | Immediate treatment; escalate to Ryan / counsel |
TODO (Ryan): Assign L/I for each register row below. Do not treat scaffold scores as final.
6. Risk register (skeleton)¶
Each row links threat, vulnerability, assets, existing controls, and treatment placeholder.
| Risk ID | Asset(s) | Threat | Vulnerability | Existing controls (summary) | L | I | Level | Treatment | Owner | Status |
|---|---|---|---|---|---|---|---|---|---|---|
| R-001 | A-LV-02 | T-ST-03 | V-A-LV-02-01 | RLS on 4 clinical tables; app-layer consent checks; RLS batch 2 planned | TODO | TODO | TODO | Mitigate — RLS batch 2 before real PHI | TODO | Open |
| R-002 | A-LV-01, A-LV-02 | T-HA-06 | V-A-LV-01-01, V-A-LV-02-01 | Code review; provider-document RLS fix 2026-07-21; pentest | TODO | TODO | TODO | Mitigate — retest after batch 2 | TODO | Open |
| R-003 | A-LV-02 | T-HD-02 | V-A-LV-02-02 | rolbypassrls=false; bypass only via policy flag in one repo |
TODO | TODO | TODO | Mitigate — audit bypass callsites; TODO (Ryan): logging | TODO | Open |
| R-004 | A-NET-02, A-LV-* | T-ST-02, T-HD-05 | V-A-NET-02-01 | Tailscale for admin; Postgres TLS; target VLAN plan | TODO | TODO | TODO | Mitigate — VLAN segmentation (Bucket 3 build) | TODO | Open |
| R-005 | A-PHY-01 | T-ST-01, T-ENV-01 | V-A-PHY-01-01 | UPS; ZFS; backup rsync to NAS | TODO | TODO | TODO | Mitigate — R730xd + B2; TODO (Ryan): DR runbook | TODO | Open |
| R-006 | A-PHY-03, A-SaaS-03 | T-HA-03, T-ENV-02 | V-A-PHY-03-01 | Daily rsync; B2 planned with BAA | TODO | TODO | TODO | Mitigate — encrypt backups; test restore | TODO | Open |
| R-007 | A-LV-05 | T-HD-02, T-HA-02 | V-A-LV-05-01 | Loki audit tier 6yr retention; Promtail labels | TODO | TODO | TODO | Mitigate — offsite immutable archive; redact logs | TODO | Open |
| R-008 | A-LV-04 | T-HD-01 | V-A-LV-04-01 | TLS 1.3; PQ hybrid; LE certs | TODO | TODO | TODO | Mitigate — cert monitoring (UptimeRobot / internal) | TODO | Open |
| R-009 | A-LV-04 | T-HA-02 | V-A-LV-04-02 | [Depends on 1a §4 TODO 1] | TODO | TODO | TODO | Mitigate — log scrubbing policy | TODO | Blocked on 1a |
| R-010 | A-EP-02 | T-HD-04, T-HD-01 | V-A-EP-02-01 | VA token never on server; Keychain | TODO | TODO | TODO | Accept residual endpoint risk; Transfer N/A | TODO | Open |
| R-011 | A-SaaS-01 | T-ST-05 | V-A-SaaS-01-01 | AWS BAA; rollback net; no prod traffic POSTURE | TODO | TODO | TODO | Avoid — decommission residual PHI; Mitigate — verify empty | TODO | Open |
| R-012 | A-NET-08 | T-HD-02, T-HD-07 | V-A-NET-08-01 | Tailscale mesh; SSH keys | TODO | TODO | TODO | Mitigate — Tailscale ACLs; MFA | TODO | Open |
| R-013 | A-LV-03 | T-HD-01 | V-A-LV-03-01 | ZFS encryption; envelope DEK; BWS KEK | TODO | TODO | TODO | Mitigate — MinIO policy review | TODO | Open |
| R-014 | A-SaaS-08 | T-HA-02, T-ST-07 | V-A-SaaS-08-01 | [Depends on 1a §4 TODO 7] | TODO | TODO | TODO | Mitigate — template review; BAA if ePHI | TODO | Blocked on 1a |
| R-015 | A-NET-01 | T-HA-01, T-HD-01 | V-A-NET-01-01 | Port forward 80/443 only; Caddy | TODO | TODO | TODO | Mitigate — Netgate cutover [Depends on 1a §4 TODO 3] | TODO | Open |
| R-016 | A-OTH-08 | T-HA-02 | V-A-OTH-08-01 | [Depends on 1a §4 TODO 1] | TODO | TODO | TODO | Avoid — no LastVet PHI in n8n | TODO | Blocked on 1a |
| R-017 | A-EP-03 | T-HD-03 | V-A-EP-03-01 | Consent engine; provider verification | TODO | TODO | TODO | Mitigate — TODO (Ryan): provider session policy | TODO | Open |
| R-018 | A-LV-01 | T-ST-08 | — (future web client) | Web client parked until VA prod | TODO | TODO | TODO | Mitigate — PKCE design; reassess custody | TODO | Deferred |
TODO (Ryan): Add rows for Robert device, GitHub, Neon, angel-local, last1.id VMs once 1a ePHI flags close. Remove or downgrade rows when controls ship.
7. Existing controls mapping¶
Controls are documented today unless marked planned/designed. Map to risk register rows and Bucket 1c policies.
| Control domain | Control (cite) | Risks addressed | Gap / planned |
|---|---|---|---|
| Consent & authorization | Consent engine; active grant required (POSTURE.md §7) | R-017, R-002 | Consent tables lack RLS (R-001) |
| Database RLS | FORCE RLS on 4 clinical tables (SECURITY_POSTURE_DATABASE_ACCESS.md) | R-002 | 13 tables app-only (R-001) |
| Token custody | VA OAuth token on device only (SECURITY_POSTURE_TOKEN_CUSTODY.md) | R-010 | Web client T-ST-08 (R-018) |
| Encryption at rest | Postgres TLS; ZFS imaging; envelope encryption (POSTURE.md §5) | R-013, R-006 | Backup ePHI on NAS TBD (R-006) |
| Encryption in transit | TLS 1.3 Caddy; PQ hybrid; Tailscale WireGuard (POSTURE.md §6) | R-008, R-004 | MinIO TLS verify in ops runbook |
| Audit logging | consent_audit_log; Loki audit tier (POSTURE.md §5, §7) |
R-007, R-017 | Offsite immutable archive gap (R-007) |
| Secrets | BWS; no long-lived creds in GitHub (SECURITY_POSTURE_DATABASE_ACCESS.md §7) | R-012 | TODO (Ryan): BWS access reviews |
| Migration discipline | No prod auto-migrate; ensureCoreSchema gated (SECURITY_POSTURE_DATABASE_ACCESS.md §5–6) |
R-002 | — |
| Network ingress | Grey-cloud DNS; origin TLS (POSTURE.md §4, §6) | R-008, R-015 | Consumer Orbi interim (R-015) |
| Imaging | Envelope encryption v1 (IMAGING_ENVELOPE_ENCRYPTION.md) | R-013 | Legacy AWS path (R-011) |
| Workforce / physical | Operator-controlled R940; iDRAC OOB | R-005 | TODO (Ryan): facility policy (1c) |
| BAAs | AWS BAA executed; B2 BAA planned (SECURITY_POSTURE_IMAGING_STORAGE.md §3.4) | R-011, R-006 | WSGR / provider BAA in flight (Muster) |
8. Risk treatment decision framework¶
Per OCR SRA Tool, each risk receives a treatment decision. Use placeholder rationale until Ryan completes analysis.
| Treatment | When to use | Placeholder rationale section |
|---|---|---|
| Mitigate | Implement or strengthen controls to reduce L or I | TODO (Ryan): control reference, owner, target date, link to Muster/gate item |
| Accept | Residual risk within appetite after controls | TODO (Ryan): document acceptance authority (Ryan / board), review date |
| Transfer | Insurance or vendor assumes portion of risk | TODO (Ryan): Cyber policy Coverage H; AWS/B2 BAAs — counsel confirms |
| Avoid | Eliminate activity or asset | TODO (Ryan): e.g., no LastVet PHI in n8n; decommission AWS residual |
8.1 Treatment log template (per risk)¶
#### R-XXX treatment record
- **Decision:** Mitigate | Accept | Transfer | Avoid
- **Rationale:** TODO (Ryan)
- **Planned control / action:** TODO (Ryan)
- **Residual risk after treatment:** L= TODO I= TODO Level= TODO
- **Review date:** TODO (Ryan)
- **Approver:** TODO (Ryan)
9. Ryan TODO list (Bucket 1b)¶
- Reconcile with 1a: When
HIPAA_ARCHITECTURE.md§4 TODOs close, update Asset ID ePHI flags, vulnerability rows, and matrix cells marked ○ or "Blocked on 1a". - Assign L/I for all risk register rows (§6); recalculate levels after real PHI admission.
- Complete threat–vulnerability matrix for full vuln catalog (§4).
- Tailscale ACL documentation — closes V-A-NET-08-01 gap.
- Provider session / MFA policy — closes V-A-EP-03-01 and R-017 mitigation detail.
- Backup/DR test evidence — R-005, R-006 treatment rationale.
- AWS residual verification — R-011 [Depends on 1a §4 TODO 4].
- Egress / email template review — R-014 [Depends on 1a §4 TODO 7].
- WSGR packet: Excerpt §6–§8 + POSTURE.md for privacy team with provider agreement (align 1a §4 TODO 10).
- Annual cadence: Set evaluation schedule per §164.308(a)(8) (see 1c
08-evaluation.md).
10. Completeness (scaffold estimate)¶
| Section | Estimated completeness | Why |
|---|---|---|
| §1 Scope + asset reference | ~70% | Mirrors 1a inventory; ePHI TODOs propagate |
| §2 Threat catalog | ~65% | NIST categories populated; site-specific tuning needed |
| §3 Vulnerabilities | ~50% | Core LastVet gaps cited; not exhaustive per asset |
| §4 Pairing matrix | ~40% | Subset of pairings; expand after 1a |
| §5 L/I framework | ~30% | Scales defined; no ratings assigned |
| §6 Risk register | ~55% | 18 skeleton rows; blocked rows flagged |
| §7 Controls mapping | ~60% | Pulled from SECURITY_POSTURE_* + POSTURE |
| §8 Treatment framework | ~35% | Structure only; no filled rationale |
| Overall Bucket 1b scaffold | ~50% | Usable SRA skeleton; not submission-ready |
Dependency: When Ryan fills 1a §4 TODOs, re-run §3–§6 and update policies in Bucket 1c that reference [Depends on 1a §4 TODO N].
Next step: Ryan reviews PR for 1b; complete L/I and treatment rationale; align with WSGR privacy review.