Technology Plan · FY 2026–2027
Cascades of Tucson Technology Plan
A living action document: for each area of the facility's technology, what has
been done and what is planned, with an owner, cost, target, and completion date for every action. Prepared with
Az Computer Guru. Reviewed and updated at least annually.
Plan ownerCascades of Tucson — Administrator (Ashley Jensen)
Prepared withAz Computer Guru
Plan periodFY 2026–2027
Adopted by / dateat adoption
Next annual reviewadoption + 12 months
Standard referenceCARF Technology and System Plan, Aging Services Standards Manual (Section 1, "CARF Plans") — manual edition confirmed at adoption
Basis of this plan
This plan is based on the needs of the people Cascades serves and the people who serve them.
Persons served: resident safety (Helpany fall/motion sensors with no camera and no microphone), reliable building-wide
WiFi for residents and families, and protection of resident health records. Personnel: dependable workstations, one
sign-on to the clinical record, and secure access that follows staff roles. Other stakeholders: families (connectivity
and privacy), regulators (HIPAA safeguards), and vendors (managed under Business Associate Agreements).
Technology priorities align with Cascades' strategic goals: resident safety first (safety sensors, proven power-outage
recovery), regulatory standing (HIPAA safeguards, CARF conformance, auditable records), and efficient operations (modern
workstations, single sign-on, and a sanctioned analytics path for leadership).
The eight areas
01
Hardware
Done
- Full managed network deployed: UniFi with 77 access points and 12 managed switches; business firewall with dual internet connections and automatic failover.
- Server storage verified healthy; enterprise SSDs purchased for a planned upgrade.
- Windows Pro upgrades completed on nearly all workstations for domain readiness.
To do
| Action | Owner | Cost | Target | Completed |
|---|
| Install the purchased enterprise SSDs (scheduled window) | ACG | purchased | 30–60 days | |
| Replace workstations marked for replacement (list below, 5 + spare) | ACG | ~$700–950 ea | 60–90 days | |
| Scope and quote a server refresh project | ACG + Cascades | formal quote | 90 days | |
| Bring remaining switch ports up to full gigabit speed | ACG | labor | 90 days | |
Workstations marked for replacement
| Machine | User / role | Plan |
|---|
| DESKTOP-TRCIEJA | Lupe Sanchez | Replace (end of life) |
| ASSISTMAN-PC | Meredith Kuhn | Replace (2015-era processor, cannot run Windows 11) |
| MDIRECTOR-PC | Shelby Trozzi (MC Director) | Replace (insufficient memory) |
| MEMRECEPT-PC | Memory Care front desk | Replace (oldest machine in the fleet) |
| Spare unit | New hire | Deploy spare |
| CHEF-PC | Culinary | Replace |
02
Software
Done
- Microsoft 365 Business Premium across the organization (45 seats enabled).
- ALIS clinical record connected to company sign-in (single sign-on live).
- Domain migration underway: about half of staff PCs on the company domain with department structure and drive mapping built.
To do
| Action | Owner | Cost | Target | Completed |
|---|
| Move office staff off the suspended legacy Microsoft 365 license onto supported licenses; full Office only where needed, lighter licenses elsewhere | ACG | new licensing, ~$375–575/mo | 30 days | |
| Complete staff domain migration + department drives | ACG | labor | 60–90 days | |
| Final Windows Pro upgrade (1 deferred device) | ACG | ~$99 | next window | |
| Retire the per-PC Synology sync client as machines migrate | ACG | labor | with migration | |
03
Security (sensitive data / HIPAA)
Done
- Multi-factor sign-in for all staff; identity-based conditional access live.
- Caregiver accounts restricted to the building network (credentials unusable off-site), live since July 1, 2026.
- Auto-lock and auto-sign-out policy on shared care devices.
- Segmented network: voice isolated, per-room isolation, resident devices separated.
- Email authentication (SPF, DKIM, DMARC) enforced.
To do
| Action | Owner | Cost | Target | Completed |
|---|
| Create emergency break-glass admin accounts with hardware security keys | ACG | ~$110 keys | 30 days | |
| Enforce the caregiver device allow-list (final enforcement phase) | ACG | labor | 30–60 days | |
| Limit trusted-network sign-in to approved devices (next enforcement phase) | ACG | labor | 30–60 days | |
| Enable file-access audit logging with 90-day / 6-year retention | ACG | ~$50–120/mo | 60–90 days | |
| Formalize a same-day offboarding checklist | Cascades HR + ACG | none | 30 days, standing | |
| Package the dated security risk assessment | ACG | labor | 60 days | |
04
Confidentiality
Done
- PHI access limited by role and security group; single sign-on to the clinical record.
- Shared care devices auto-lock; resident and voice traffic isolated on the network.
To do
| Action | Owner | Cost | Target | Completed |
|---|
| Complete the Business Associate Agreement inventory (every vendor touching PHI) | Cascades + ACG | none | 60 days | |
| Move ALIS fully to single sign-on (retire the separate native login) | ACG | labor | 60 days | |
| Enable encryption on the resident-data file share | ACG | labor | 60–90 days | |
| Maintain a one-page contract / renewal / BAA tracker | Cascades + ACG | none | 90 days, standing | |
05
Backup
Done
- The server is backed up. The Synology NAS syncs its data to the server, and the server is backed up online (off-site) with daily incrementals, verified running.
- Firewall and network configuration backed up.
To do
| Action | Owner | Cost | Target | Completed |
|---|
| Repurpose the Synology NAS as the onsite backup for the server (with off-site backup continuing) | ACG | labor | 60–90 days | |
| Run and document a test restore | ACG | labor | 90 days | |
| Confirm and document the retention policy | ACG | none | 60 days | |
06
Assistive technology (persons served)
Done
- Helpany "Paul" resident-safety sensors: ceiling radar fall and motion detection with no camera and no microphone, rolling out floor by floor.
- Building-wide WiFi supporting resident and family connectivity.
To do
| Action | Owner | Cost | Target | Completed |
|---|
| Complete the Helpany rollout; move sensors to their own protected network segment | Helpany + ACG | vendor + labor | 90 days | |
| Inventory all resident-facing technology (nurse-call / pendants, assistive listening, resident WiFi for telehealth) into this plan | Cascades + ACG | none | next review | |
07
Disaster recovery & continuity
Done
- Documented, proven power-outage procedure: scripted clean shutdown of core systems and verified clean recovery (exercised June 2026).
- UPS battery backup installed on core equipment and all network switches; off-site backup running.
To do
| Action | Owner | Cost | Target | Completed |
|---|
| Write the formal disaster-recovery / business-continuity plan with recovery-time targets | ACG | labor | 90 days | |
| Documented restore test (with area 5) | ACG | labor | 90 days | |
| Server redundancy (pairs with the server refresh project) | ACG + Cascades | project quote | FY project | |
08
Virus & threat protection
Done
- Managed endpoint detection & response (EDR) on every managed, enrolled device (35), including the main server (verified live July 2026).
- Microsoft Defender and Exchange Online Protection on email; managed monitoring and patching on all devices.
- Legacy agents from the previous IT provider removed from the server.
To do
| Action | Owner | Cost | Target | Completed |
|---|
| Remove remaining legacy agents: DESKTOP-TRCIEJA (retires with its replacement); finish console cleanup | ACG | labor | 30–60 days | |
| Standing coverage audit: every device reporting into managed security | ACG | none | quarterly | |
Supplementary areas
+
Communication technology
Done: voice system consolidated onto an isolated voice network (37 devices); WiFi optimized building-wide; email authentication enforced.
To do: dedicated 5 GHz network for phones and Helpany sensors (improves call reliability); replace the Bistro phone; voice quality-of-service; then the supervised move to next-generation WiFi (WPA3 / 6 GHz). Owner: ACG + Vertical + Helpany; 90 days.
+
Services purchased / contracted
Managed IT (ACG, prepaid block), Microsoft 365, ALIS (Medtelligent), hosted voice (Vertical), dual-WAN internet (Cox), online backup, firewall & network (Netgate / UniFi), managed security, resident safety sensors (Helpany), plus line-of-business software.
To do: the renewal / BAA tracker (area 4) becomes the single register for all vendors.
+
Use of AI
To do: adopt an AI acceptable-use policy for staff (30 days); evaluate Microsoft 365 Copilot under HIPAA guardrails; build the cross-system KPI dashboard (ALIS, QuickBooks, Bill.com, Relias, CRM, TELS, Focus HR) as the sanctioned analytics path: Phase 1 scheduled exports to SharePoint and Power BI, Phase 2 automated data feeds.