# Cascades of Tucson Technology Plan

> A living action document: for each area, what has been done and what is planned.
> Prepared with Az Computer Guru. Reviewed and updated at least annually.

| Governance | |
|---|---|
| Plan owner | Cascades of Tucson — Administrator (Ashley Jensen) |
| Prepared with | Az Computer Guru (Mike Swanson, Howard Enos) |
| Standard reference | CARF Technology and System Plan, Aging Services Standards Manual (Section 1, "CARF Plans") — *[manual edition confirmed at adoption]* |
| Plan period | FY 2026–2027 |
| Adopted by / date | *[at adoption]* |
| Next annual review | *[adoption + 12 months]* |

## Basis of this plan

This plan is based on the needs of the people Cascades serves and the people who serve
them. **Persons served:** resident safety (Helpany fall/motion sensors with no camera and
no microphone), reliable building-wide WiFi for residents and families, and protection of
resident health records. **Personnel:** dependable workstations, one sign-on to the
clinical record, and secure access that follows staff roles. **Other stakeholders:**
families (connectivity and privacy), regulators (HIPAA safeguards), and vendors (managed
under Business Associate Agreements).

Technology priorities align with Cascades' strategic goals: resident safety first (safety
sensors, proven power-outage recovery), regulatory standing (HIPAA safeguards, CARF
conformance, auditable records), and efficient operations (modern workstations, single
sign-on, and a sanctioned analytics path for leadership).

---

## 1. Hardware

**Done**
- Full managed network deployed: UniFi with 77 access points and 12 managed switches;
  business firewall with dual internet connections and automatic failover.
- Server storage verified healthy; enterprise SSDs purchased for a planned upgrade.
- Windows Pro upgrades completed on nearly all workstations for domain readiness.

**To do**
| Action | Owner | Cost | Target | Completed |
|---|---|---|---|---|
| Install the purchased enterprise SSDs (scheduled window) | ACG | already purchased | 30–60 days |
| Replace workstations marked for replacement (list below, 5 + spare) | ACG | ~$700–950 ea | 60–90 days |
| Scope and quote a server refresh project | ACG + Cascades | formal quote | 90 days |
| Bring remaining switch ports up to full gigabit speed | ACG | labor | 90 days |

**Workstations marked for replacement**
| Machine | User / role | Plan |
|---|---|---|
| DESKTOP-TRCIEJA | Lupe Sanchez | **Replace** (end of life) |
| ASSISTMAN-PC | Meredith Kuhn | **Replace** (2015-era processor, cannot run Windows 11) |
| MDIRECTOR-PC | Shelby Trozzi (MC Director) | **Replace** (insufficient memory) |
| MEMRECEPT-PC | Memory Care front desk | **Replace** (oldest machine in the fleet) |
| Spare unit | New hire | **Deploy spare** |
| CHEF-PC | Culinary | **Replace** |

## 2. Software

**Done**
- Microsoft 365 Business Premium across the organization (45 seats enabled).
- ALIS clinical record connected to company sign-in (single sign-on live).
- Domain migration underway: about half of staff PCs on the company domain with
  department structure and drive mapping built.

**To do**
| Action | Owner | Cost | Target | Completed |
|---|---|---|---|---|
| Move office staff off the suspended legacy Microsoft 365 license onto supported licenses; full Office only where needed, lighter licenses elsewhere | ACG | new licensing, ~$375–575/mo depending on mix | 30 days |
| Complete staff domain migration + department drives | ACG | labor | 60–90 days |
| Final Windows Pro upgrade (1 deferred device) | ACG | ~$99 | next window |
| Retire the per-PC Synology sync client as machines migrate | ACG | labor | with migration |
| Plan the move of department files and team collaboration to SharePoint and Teams (Microsoft 365) — role-based access, audit logging, and retention that strengthen HIPAA compliance | ACG + Cascades | included in Microsoft 365 licensing | 90 days, then phased |

## 3. Security (sensitive data / HIPAA)

**Done**
- MFA for all staff; identity-based conditional access live.
- Caregiver accounts restricted to the building network (credentials unusable off-site),
  live since 2026-07-01.
- Auto-lock and auto-sign-out policy on shared care devices.
- Segmented network: voice isolated, per-room isolation, resident devices separated.
- Email authentication (SPF, DKIM, DMARC) enforced.

**To do**
| Action | Owner | Cost | Target | Completed |
|---|---|---|---|---|
| Create emergency break-glass admin accounts with hardware security keys | ACG | ~$110 keys | 30 days |
| Enforce the caregiver device allow-list (final enforcement phase) | ACG | labor | 30–60 days, after break-glass |
| Limit trusted-network sign-in to approved devices (next enforcement phase) | ACG | labor | 30–60 days |
| Enable file-access audit logging with 90-day/6-year retention | ACG | ~$50–120/mo + build | 60–90 days |
| Formalize a same-day offboarding checklist | Cascades HR + ACG | none | 30 days, then standing |
| Package the dated security risk assessment | ACG | labor | 60 days |

## 4. Confidentiality

**Done**
- PHI access limited by role and security group; single sign-on to the clinical record.
- Shared care devices auto-lock; resident and voice traffic isolated on the network.

**To do**
| Action | Owner | Cost | Target | Completed |
|---|---|---|---|---|
| Complete the Business Associate Agreement inventory (every vendor touching PHI) | Cascades + ACG | none | 60 days |
| Move ALIS fully to single sign-on (retire the separate native login) | ACG | labor | 60 days |
| Enable encryption on the resident-data file share | ACG | labor | 60–90 days |
| Maintain a one-page contract / renewal / BAA tracker | Cascades + ACG | none | 90 days, then standing |

## 5. Backup

**Done**
- **The server is backed up.** The Synology NAS syncs its data to the server, and the
  server is backed up online (off-site) with daily incrementals, verified running.
- Firewall and network configuration backed up.

**To do**
| Action | Owner | Cost | Target | Completed |
|---|---|---|---|---|
| Repurpose the Synology NAS as the onsite backup for the server (with off-site backup continuing) | ACG | labor | 60–90 days |
| Run and document a test restore | ACG | labor | 90 days |
| Confirm and document the retention policy | ACG | none | 60 days |

## 6. Assistive technology (persons served)

**Done**
- Helpany "Paul" resident-safety sensors: ceiling radar fall and motion detection with
  **no camera and no microphone**, rolling out floor by floor.
- Building-wide WiFi supporting resident and family connectivity.

**To do**
| Action | Owner | Cost | Target | Completed |
|---|---|---|---|---|
| Complete the Helpany rollout; move sensors to their own protected network segment | Helpany + ACG | vendor-billed + labor | 90 days |
| Inventory all resident-facing technology (nurse-call/pendants, assistive listening, resident WiFi for telehealth) into this plan | Cascades + ACG | none | next review |

## 7. Disaster recovery & continuity

**Done**
- Documented, proven power-outage procedure: scripted clean shutdown of core systems and
  verified clean recovery (exercised June 2026).
- UPS battery backup installed on core equipment and all network switches; off-site backup running.

**To do**
| Action | Owner | Cost | Target | Completed |
|---|---|---|---|---|
| Write the formal disaster-recovery / business-continuity plan with recovery-time targets | ACG | labor | 90 days |
| Documented restore test (with area 5) | ACG | labor | 90 days |
| Server redundancy (pairs with the server refresh project) | ACG + Cascades | project quote | FY project |

## 8. Virus & threat protection

**Done**
- Managed endpoint detection & response (EDR) on every managed, enrolled device (35),
  **including the main server** (verified live July 2026).
- Microsoft Defender and Exchange Online Protection on email; managed monitoring and
  patching on all devices.
- Legacy agents from the previous IT provider removed from the server.

**To do**
| Action | Owner | Cost | Target | Completed |
|---|---|---|---|---|
| Remove remaining legacy agents: DESKTOP-TRCIEJA (retires with its replacement); finish console cleanup | ACG | labor | 30–60 days |
| Standing coverage audit: every device reporting into managed security | ACG | none | quarterly |

---

## Supplementary areas

### Communication technology
**Done:** voice system consolidated onto an isolated voice network (37 devices); WiFi
optimized building-wide; email authentication enforced.
**To do:** dedicated 5 GHz network for phones and Helpany sensors (improves call
reliability); replace the Bistro phone; voice quality-of-service; then the supervised
move to next-generation WiFi (WPA3 / 6 GHz). Owner: ACG + Vertical + Helpany; 90 days.

### Services purchased / contracted
Managed IT (ACG, prepaid block), Microsoft 365, ALIS (Medtelligent), hosted voice
(Vertical), dual-WAN internet (Cox), online backup, firewall & network (Netgate/UniFi),
managed security/EDR, resident safety sensors (Helpany), plus line-of-business software.
**To do:** the renewal/BAA tracker (area 4) becomes the single register for all vendors.

### Use of AI
**To do:** adopt an AI acceptable-use policy for staff (30 days); evaluate Microsoft 365
Copilot under HIPAA guardrails; build the cross-system KPI dashboard (ALIS, QuickBooks,
Bill.com, Relias, CRM, TELS, Focus HR) as the sanctioned analytics path: Phase 1
scheduled exports to SharePoint and Power BI, Phase 2 automated data feeds.

---

## Review & maintenance

Reviewed at least annually by Cascades leadership with ACG; updated as projects complete.

| Revision | Date | By |
|---|---|---|
| Initial draft | 2026-07-15 | ACG (prepared for Cascades adoption) |
