——— Compliance
Security Risk Assessment.
Per 45 CFR 164.308(a)(1)(ii)(A) · Last Assessment: May 30, 2026
1. Scope
This Security Risk Assessment covers all electronic Protected Health Information (ePHI) created, received, maintained, or transmitted by Mino MD, including patient intake forms, prescription records, health metrics, provider-patient messaging, GLP-1 program data, and audit logs.
2. Administrative Safeguards (45 CFR 164.308)
Security Management Process
ImplementedRisk analysis performed, policies and procedures documented, sanctions policy for workforce violations.
Assigned Security Responsibility
ImplementedPrivacy Officer designated with authority over all security policies.
Workforce Security
ImplementedRole-based access control (patient, physician, admin). Workforce clearance procedures in place.
Information Access Management
ImplementedAccess authorized on need-to-know basis. All PHI queries scoped by userId. No admin access to raw PHI without audit trail.
Security Awareness Training
RequiredAnnual HIPAA training required for all workforce members. Training records maintained for 6 years.
Security Incident Procedures
ImplementedIncident response plan documented. 24-hour breach notification SLA. Audit log monitoring for anomalous access.
Contingency Plan
ImplementedNeon database backups with point-in-time recovery. Vercel edge deployments with automatic failover.
Evaluation
ScheduledAnnual security assessment. Next assessment: May 2027.
3. Physical Safeguards (45 CFR 164.310)
Facility Access Controls
DelegatedAll infrastructure hosted by Vercel (SOC 2 Type II) and Neon (SOC 2 Type II). Physical security managed by hosting providers.
Workstation Security
PolicyPhysician portal accessible only via authenticated sessions. Auto-logout after 30 minutes of inactivity.
Device & Media Controls
ImplementedNo PHI stored on local devices. All data resides in encrypted database. No removable media policy.
4. Technical Safeguards (45 CFR 164.312)
Access Control
ImplementedUnique user IDs via Better Auth. Role-based access (patient/physician). Emergency access procedure documented.
Audit Controls
ImplementedComprehensive audit_log table records all PHI access: userId, action, resource, resourceId, IP, user agent, timestamp. Audit logs retained 6+ years.
Integrity Controls
ImplementedDigital signatures on e-prescriptions. Database-level constraints. Parameterized queries prevent SQL injection.
Person Authentication
ImplementedEmail + password authentication with bcrypt hashing. Session tokens with automatic expiration. IP and user-agent tracking.
Transmission Security
ImplementedTLS 1.3 for all data in transit. HTTPS enforced on all endpoints. Secure cookie configuration (HttpOnly, SameSite, Secure).
5. Risk Summary
| Threat | Likelihood | Impact | Mitigation |
|---|---|---|---|
| Unauthorized PHI access | Low | High | RBAC, userId scoping, audit logging |
| Data breach via SQL injection | Very Low | Critical | Parameterized queries via Drizzle ORM |
| Session hijacking | Low | High | Secure cookies, session timeout, IP logging |
| Insider threat | Low | High | Audit trail, minimum necessary access |
| Data loss | Very Low | Critical | Neon automated backups, PITR |
| Phishing / credential theft | Medium | High | Password hashing, training, monitoring |
6. Remediation Plan
- Implement multi-factor authentication for physician accounts (Q3 2026)
- Add automated anomaly detection on audit logs (Q3 2026)
- Conduct penetration testing by third-party firm (Q4 2026)
- Deploy SOC 2 Type II certification process (Q1 2027)