Who it protects
CurrentHIPAA
Institutions and the data they hold
SHIELD
The person the data belongs to
LastVet standard
HIPAA is the floor.
SHIELD is the standard.
HIPAA was written in 1996 to protect institutions handling health data. It set the legal minimum. It was not written for sovereignty.
SHIELD was built for the people the data belongs to. It adds stronger veteran-controlled workflows where we have implemented them today.
S · H · I · E · L · D
The standard
What SHIELD stands for
SHIELD is LastVet's data standard for veteran-controlled health information. It exceeds HIPAA in every dimension, and every architectural decision is checked against it before it ships.
- Sovereign
- You own your data. You are the root authority on your record. No institution, provider, or partner can access your information without your explicit consent.
- Holistic
- Your record includes your complete health and life picture: medical history, social determinants, housing, employment, behavioral signals, peer connections, and self-reported data. Not just clinical notes.
- Integrated
- Your data connects across systems (VA, Community Care Network, out-of-network providers, and community organizations) on your terms, not the institution's.
- Encrypted
- All data is encrypted at rest and in transit. Every access is authenticated. Every session is auditable. Security is the default, not a policy.
- Live
- Your record updates in real time. Every check-in, every provider interaction, every engagement signal. Your record is alive because your story does not stop between appointments.
- Distributed
- Your data moves with you across a permissioned network. It does not live behind one institution's wall. It follows you, secured by your Last1 ID, governed by your consent.
HIPAA vs SHIELD
LastVet is designed to meet HIPAA requirements and add stronger veteran-controlled workflows. The rows below describe current LastVet capabilities.
CurrentRoadmapBadges show what is shipped now versus what is still in build-out.
Capabilities are built and verified in production against the VA sandbox. VA production data access is in review, not yet approved.
Who controls the data
CurrentHIPAA
Healthcare providers and covered entities
SHIELD
The Veteran
Who profits from the data
CurrentHIPAA
Permits sale of de-identified data. Institutions monetize routinely.
SHIELD
No one. No advertising, ever. No data sale. No model training on identified data. Veterans are never charged.
Consent model
CurrentHIPAA
Broad authorization at intake, often buried in paperwork
SHIELD
Granular, per-category, per-recipient, plain-language
Revocation
CurrentHIPAA
Written request, processed at the institution's pace
SHIELD
Immediate. Same screen. No grace period.
Who gets told
CurrentHIPAA
Disclosures permitted for treatment, payment, and operations, often without the patient's awareness
SHIELD
No automatic notification, ever. The veteran chooses if and when their care team is told.
Audit access
CurrentHIPAA
Patient must request audit logs in writing
SHIELD
Veteran can view logged access events in the app
Data portability
CurrentHIPAA
"Right to access" - institution decides format and timeline
SHIELD
Veteran can export a portable record summary today. Structured data export is in build-out.
Substance use records
CurrentHIPAA
Standard PHI protections
SHIELD
SUD records are dual-gated behind a separate, explicit consent flow, handled above standard PHI requirements
Provider write access
CurrentHIPAA
Each institution maintains its own siloed record
SHIELD
Providers can add coordination notes when the veteran grants write access. Their clinical charting stays in their own EHR.
Data sharing transparency
CurrentHIPAA
Disclosure required, but often opaque
SHIELD
Veteran sees who has access, what they accessed, and when
Cross-institution coordination
RoadmapHIPAA
Fax, paper, manual records requests
SHIELD
A veteran-controlled record workspace that supports connected care coordination
Encryption
CurrentHIPAA
Required for institutional systems
SHIELD
Encrypted at rest and in transit, with row-level security enforced at the database itself, on HIPAA-eligible infrastructure under a signed BAA
Designed for
CurrentHIPAA
Compliance and liability protection
SHIELD
Veteran sovereignty and healthier outcomes
Why It Matters
1. HIPAA was a floor, not a ceiling.
HIPAA was written in 1996, before smartphones, before patient portals, before the modern reality that healthcare data moves through dozens of systems before it reaches the person it belongs to. It set the legal minimum for protecting health information at institutions. It was never designed to give patients sovereignty. We are building to HIPAA requirements and adding stronger veteran controls where the floor is not enough.
2. Veterans deserve better than the floor.
Veterans navigate one of the most fragmented care ecosystems in the country - the VA, DoD, community providers, mental health services, peer support networks, family practitioners. Every transition creates a gap. Every gap loses information. HIPAA compliance does not solve this. Veteran sovereignty does. When the veteran owns the record, the gaps close.
3. SHIELD is how we keep our promises.
Sovereign. Holistic. Integrated. Encrypted. Live. Distributed. Every architectural decision in LastVet is checked against SHIELD before it ships. If a feature doesn't make the system more sovereign, more holistic, more integrated, more encrypted, more live, or more distributed - it doesn't get built. SHIELD is not marketing. It is how we work.
LastVet is built on SHIELD. Your data, your rules.