# HIPAA Compliance Review — 2026-04-22 User Account Rollout

**Reviewed by:** Howard Enos (Computer Guru)
**Scope:** Decisions captured in `docs/cloud/user-account-rollout-plan.md` as of 2026-04-22
**Trigger:** Client request for a pre-execution compliance check before creating / disabling accounts
**Primary references:** 45 CFR Part 164 Subpart C (HIPAA Security Rule), NIST SP 800-66 Rev 2 (Feb 2024), HHS OCR guidance

---

## Findings classified ACTIVE ONGOING VIOLATION — present-tense gap

### A1. Synology role-based shared-login accounts with PHI access

**Rule:** 45 CFR §164.312(a)(2)(i) Unique User Identification (Required).

**Current state:** The Synology NAS `cascadesds` (192.168.0.120) hosts 7 role-based shared-credential local accounts that multiple humans sign into. Several of these accounts have access to shares containing PHI (`homes`, `Management`, `pacs`). Per `docs/migration/synology-permission-inventory.md` these accounts are:

- `Accounting`
- `Dining Manager`
- `Front Desk`
- `mcnurse`
- `Memcare Receptionist`
- `memcarenurse`
- `Nurse Tower`

**Gap:** These are NOT scheduled for remediation until Phase 4 (Synology retirement + CS-SERVER file-share cutover), which will be weeks away at best. **Every day until Phase 4, these shared credentials are an active Required-spec violation if any of them access PHI shares.** The `pacs` share (likely medical imaging) and `Management` (clinical admin docs) are the highest-risk.

**Options:**
1. **Accelerate disable.** Immediately disable shared logins on Synology + force users onto their personal AD-synced accounts. Risk: breaks known workflows, disrupts front-desk / nursing stations that rely on shared logins today.
2. **Documented risk-acceptance in Risk Analysis.** Capture the exception explicitly: "7 Synology shared-login accounts remain operational until Phase 4 cutover, target [date]. Compensating controls: physical access restricted to Cascades building, shift-based sign-in sheets on each shared workstation, monthly SMB access-log review by Howard." Meredith signs the residual-risk acknowledgment.
3. **Hybrid.** Disable the highest-sensitivity shared accounts immediately (`mcnurse`, `memcarenurse`, `Nurse Tower` if they touch `pacs`), accept risk on the less-sensitive ones (`Accounting`, `Front Desk`).

**Decision required:** Which option does Meredith prefer? Option 2 is most common but the residual-risk paperwork has to be real, not just assumed.

**Detection:** Monthly sample of Synology SMB access logs for those accounts, mapped against shift schedules.

**Target resolution:** Phase 4 (Synology retirement) OR explicit immediate-disable event. Whichever comes first.

---

## Findings classified CRITICAL — must fix before rollout

### C1. Shared agency logins would violate §164.312(a)(2)(i) — Unique User Identification

Original plan: create `reliable1@cascadestucson.com` and `reliable2@cascadestucson.com` as shared accounts for rotating Reliable Agency caregivers.

**Rule:** §164.312(a)(2)(i) Unique User Identification is a **Required** implementation spec (not Addressable). HHS has explicitly answered this in public FAQ: covered entities may not assign the same log-on ID to multiple employees. There is no compensating-control carve-out because Required specs don't permit alternatives. NIST SP 800-66 Rev 2 maps this to SP 800-53 IA-2 (Identification and Authentication) and AC-2 (Account Management), which likewise require individual accounts.

**Decision 2026-04-22:** Drop `reliable1` / `reliable2`. Require Reliable Agency to supply individual caregiver names before any shift where PHI access is needed. Per-person accounts only. If the agency won't commit, agency staff work under direct supervision of a Cascades-employed caregiver who is signed in — no independent PHI access.

**Docs updated:** `user-account-rollout-plan.md` §6 and Wave 1; `cascades-staff-working-list-2026-04-22.md`; `cascades-staff-editor-2026-04-22.html`; `p2-staff-candidates.md`; `caregiver-m365-p2-rollout.md`; `cascades-staff-followup-2026-04-22.md`.

---

### C2. Britney Thompson mailbox must be placed on Litigation Hold before disable + mailbox conversion

**Rule:** §164.308(a)(3)(ii)(C) Termination Procedures + §164.316(b)(2)(i) 6-year documentation retention.

**Issue:** Business Standard doesn't include unlimited archive/hold. Converting a licensed mailbox to shared can trim content based on default retention settings, potentially purging PHI subject to state medical-records retention (AZ = 7 years post-last-encounter) or subpoena.

**Decision:** Before disabling `britney.thompson`:
1. Place mailbox on Litigation Hold (verify Business Standard has Exchange Online Plan 2 features; if not, temporarily assign an EOA or E3 before harvest)
2. Designate a named custodian (recommended: Meredith Kuhn as Executive Director, or Lois Lane as Health Services Director)
3. Then disable sign-in, revoke tokens
4. Then convert to shared and harvest user license

Documentation of the termination action retained ≥6 years per §164.316(b)(2).

---

### C3. Microsoft M365 BAA not yet signed

**Rule:** §164.308(b)(1) Business Associate contracts.

**Issue:** `docs/cloud/m365.md` line 12 and `docs/security/hipaa.md` gap #13 note that no Microsoft HIPAA BAA has been signed. Every day Cascades uses M365 for PHI without a BAA is a continuing Security Rule violation. Every new account we provision expands that exposure.

**Decision:** Sign the Microsoft BAA **before Wave 1** — M365 Admin Center → Settings → Org Settings → Security & Privacy → HIPAA BAA. Free, 5 minutes.

Parallel: verify or secure an ALIS BAA (go-alis.com) before any new caregiver accesses ALIS.

---

### C4. No formal Risk Analysis on file (§164.308(a)(1)(ii)(A) — Required)

**Rule:** A formal risk analysis covering scope, threats, likelihood, impact, and control effectiveness is Required (not Addressable).

**Issue:** Cross-doc sweep confirmed no standalone risk analysis document exists. The existing `hipaa.md` gap list is a useful inventory but does not meet the Security Rule's definition.

**Decision:** Produce `docs/security/risk-analysis-2026-04.md` following the NIST 800-66 Rev 2 §3 framework before Wave 2. Reference it in every Addressable-spec decision.

---

## Findings classified HIGH — fix in Wave 1 or before

### H1. M365 audit log retention default (1 year) is insufficient

**Rule:** §164.312(b) Audit Controls + §164.316(b)(2) 6-year documentation retention. OCR enforcement posture treats audit logs as documentation subject to the 6-year clock.

**Decision:** Purchase Microsoft Purview Audit (Premium) add-on (10-year retention) OR configure a retention policy for 7 years via E5 Compliance OR monthly export to immutable Azure Blob. Decision documented in Security Rule Implementation Register (see M2 below).

---

### H2. No documented break-glass emergency access account (§164.312(a)(2)(ii) — Required)

**Decision:** Create `breakglass@cascadestucson.com` — cloud-only (not AD-synced), excluded from all CA policies, protected by FIDO2 security key + unique vaulted password in `clients/cascades-tucson/breakglass.sops.yaml`, sign-in alerted to Howard + Meredith, quarterly test sign-in. Must exist before disabling any other admin accounts.

---

### H3. `\\CS-SERVER\homes` SMB3 encryption not enabled; folder redirection routes PHI to that share

**Rule:** §164.312(a)(2)(iv) Encryption/Decryption + §164.312(e)(2)(ii) Transmission Encryption (both Addressable).

**Issue:** `CONTEXT.md` notes `EncryptData=false` on the homes share. Folder redirection GPO pushes Documents / Desktop / Downloads — including staff-generated PHI — to that share. In-transit encryption is off; at-rest encryption status on CS-SERVER's D: drive is not documented.

**Decision:** Before Alma / Kyla folder redirection goes live:
- `Set-SmbShare -Name homes -EncryptData $true` (immediate, free)
- Verify / enable BitLocker on CS-SERVER D: drive
- Document both decisions in Implementation Register

---

### H4. Drivers need Privacy Rule training + signed sanctions acknowledgment (workforce, not IT)

**Rule:** §164.530(b)(1) Privacy training for workforce; §164.530(e) sanctions apply to all workforce; §160.103 defines workforce inclusive of workers with no electronic system access.

**Issue:** Decision that drivers don't need IT access is correct; however, drivers encounter PHI on pickup sheets (rider names, appointment context).

**Decision (not an IT deliverable):** Flag to Meredith. Drivers need annual short-form Privacy training, signed confidentiality / sanctions acknowledgment, and documented pickup-sheet handling procedures. If dispatch uses personal phones for texts with rider names, those phones now trigger mobile-device safeguards (§164.312(a)(1) + (e)) — consider moving dispatch to a controlled channel.

---

## Findings classified MEDIUM — address before Wave 3 (caregiver bulk)

### M1. Automatic-logoff duration not codified for shared front-desk PCs and MSDM sign-out

**Rule:** §164.312(a)(2)(iii) Automatic Logoff (Addressable).

**Decision:**
- GPO `CSC - Shared Workstation`: screen lock at 10 min idle, sign-out at 30 min idle, disable Fast User Switching
- MSDM global sign-out timer: 15 min idle
- Both documented in Implementation Register as the Addressable-spec implementation

---

### M2. No Security Rule Implementation Register

**Rule:** §164.306(d)(3) Addressable spec decisions; §164.316(b)(1)-(2) documentation retention.

**Decision:** Create `docs/security/implementation-register.md` — one row per Addressable spec (encryption at rest, encryption in transit, automatic logoff, emergency access mode, integrity controls) with: decision, rationale tied to risk analysis, alternative measure if applicable, owner, next review date. This is the artifact OCR asks for in an audit.

---

### M3. Reliable Agency — Business Associate status not determined

**Decision:** Ask Meredith for the Reliable Agency staffing contract. Confirm direct-control language (workforce) vs. agency-directed (Business Associate). If no workforce-control language, either secure an addendum OR sign a BAA with Reliable. No individual agency-caregiver accounts created until this is sorted.

---

### M4. Christine Nyanzunda's single-account dual-role access scoping

**Rule:** §164.308(a)(4)(ii)(B) Access Authorization (Addressable — minimum necessary).

**Decision:** Single account retained (MC Admin + part-time MedTech). Document in Implementation Register that operational simplicity was weighed against strict minimum-necessary. Mitigation: rely on ALIS's internal role-based access controls to scope her view based on shift / context if supported.

---

## Findings classified GOOD — HIPAA-aligned decisions being kept

- **Building-only CA default + allow-list for outside sign-in** — defensible implementation of §164.312(a)(1) Access Control, stronger than baseline
- **Shared front-desk PCs with individual M365 accounts** — fully compliant (identity is per-person; hardware sharing is fine)
- **MSDM shared phones with per-user Entra sign-in** — satisfies unique-ID + automatic-logoff on the mobile tier
- **Drivers with no electronic PHI access** — correct minimum-necessary scoping on the IT side
- **Same-day account disable on termination** — meets termination-procedure timing
- **Business Premium tenant-wide recommendation** — provides the P1 + Defender + DLP + Intune baseline the rest of the design relies on
- **Decline to reinstate Sandra Fish admin** — correct; 2026-04-14 revocation stands

---

## Open questions unresolved at review time

| # | Question | Owner |
|---|---|---|
| 1 | Does Business Standard (current SKU for 23 users) include Exchange Online Plan 2 features needed for Litigation Hold? If not, what's the cheapest path to EOA on Britney's mailbox before harvest? | Howard (verify in M365 Admin Center) |
| 2 | Reliable Agency staffing contract — direct-control language or not? | Meredith |
| 3 | Audit retention path chosen (Purview Premium add-on vs. E5 Compliance vs. export to immutable storage)? | Meredith (budget) + Howard (design) |
| 4 | BitLocker state on CS-SERVER D: drive — enabled, encrypted-no-protectors, or off? | Howard (verify onsite or via SSH) |

---

## Source material cited

- [45 CFR §164.312 — Technical safeguards (eCFR)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312)
- [45 CFR §164.316 — Policies, procedures, documentation (eCFR)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.316)
- [45 CFR §164.308 — Administrative safeguards (eCFR)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308)
- [HHS FAQ — shared log-on IDs not permitted](https://www.hhs.gov/hipaa/for-professionals/faq/2018/does-the-security-rule-permit-a-covered-entity-to-assign-the-same-log-on-id-to-multiple-employees/index.html)
- [HHS FAQ — Addressable vs Required implementation specs](https://www.hhs.gov/hipaa/for-professionals/faq/2020/what-is-the-difference-between-addressable-and-required-implementation-specifications/index.html)
- [HHS — Business Associates guidance](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html)
- [NIST SP 800-66 Rev 2 — Implementing the HIPAA Security Rule (Feb 2024)](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-66r2.pdf)
- [Microsoft Learn — Entra HIPAA access control safeguards](https://learn.microsoft.com/en-us/entra/standards/hipaa-access-controls)
- [Microsoft Learn — Shared device mode overview](https://learn.microsoft.com/en-us/entra/identity-platform/msal-shared-devices)
