Technology Plan · FY 2026–2027
Cascades of Tucson Technology Plan
A living action document: for each area of the facility's technology, what has
been done and what is planned, with an owner, cost, and target for every action. Prepared with
Az Computer Guru. Reviewed and updated at least annually.
Plan ownerCascades of Tucson
Prepared withAz Computer Guru
Plan periodFY 2026–2027
Adopted by / dateat adoption
Next annual reviewadoption + 12 months
The eight areas
01
Hardware
Done
- Full managed network deployed: UniFi with 77 access points and 12 managed switches; business firewall with dual internet connections and automatic failover.
- Server storage verified healthy; enterprise SSDs purchased for a planned upgrade.
- Windows Pro upgrades completed on nearly all workstations for domain readiness.
To do
| Action | Owner | Cost | Target |
|---|
| Install the purchased enterprise SSDs (scheduled window) | ACG | purchased | 30–60 days |
| Replace workstations marked for replacement (list below, 5 + spare) | ACG | ~$700–950 ea | 60–90 days |
| Scope and quote a server refresh project | ACG + Cascades | formal quote | 90 days |
| Bring remaining switch ports up to full gigabit speed | ACG | labor | 90 days |
Workstations marked for replacement
| Machine | User / role | Plan |
|---|
| DESKTOP-TRCIEJA | Lupe Sanchez | Replace (end of life) |
| ASSISTMAN-PC | Meredith Kuhn | Replace (2015-era processor, cannot run Windows 11) |
| MDIRECTOR-PC | Shelby Trozzi (MC Director) | Replace (insufficient memory) |
| MEMRECEPT-PC | Memory Care front desk | Replace (oldest machine in the fleet) |
| Spare unit | New hire | Deploy spare |
| CHEF-PC | Culinary | Replace |
02
Software
Done
- Microsoft 365 Business Premium across the organization (45 seats enabled).
- ALIS clinical record connected to company sign-in (single sign-on live).
- Domain migration underway: about half of staff PCs on the company domain with department structure and drive mapping built.
To do
| Action | Owner | Cost | Target |
|---|
| Right-size Microsoft 365 licensing: move users off the legacy license; full Office licenses only where needed, lighter licenses for everyone else | ACG | reduces monthly cost | 30 days |
| Complete staff domain migration + department drives | ACG | labor | 60–90 days |
| Final Windows Pro upgrade (1 deferred device) | ACG | ~$99 | next window |
| Retire the per-PC Synology sync client as machines migrate | ACG | labor | with migration |
03
Security (sensitive data / HIPAA)
Done
- Multi-factor sign-in for all staff; identity-based conditional access live.
- Caregiver accounts restricted to the building network (credentials unusable off-site), live since July 1, 2026.
- Auto-lock and auto-sign-out policy on shared care devices.
- Segmented network: voice isolated, per-room isolation, resident devices separated.
- Email authentication (SPF, DKIM, DMARC) enforced.
To do
| Action | Owner | Cost | Target |
|---|
| Create emergency break-glass admin accounts with hardware security keys | ACG | ~$110 keys | 30 days |
| Enforce the caregiver device allow-list (final enforcement phase) | ACG | labor | 30–60 days |
| Limit trusted-network sign-in to approved devices (next enforcement phase) | ACG | labor | 30–60 days |
| Enable file-access audit logging with 90-day / 6-year retention | ACG | ~$50–120/mo | 60–90 days |
| Formalize a same-day offboarding checklist | Cascades HR + ACG | none | 30 days, standing |
| Package the dated security risk assessment | ACG | labor | 60 days |
04
Confidentiality
Done
- PHI access limited by role and security group; single sign-on to the clinical record.
- Shared care devices auto-lock; resident and voice traffic isolated on the network.
To do
| Action | Owner | Cost | Target |
|---|
| Complete the Business Associate Agreement inventory (every vendor touching PHI) | Cascades + ACG | none | 60 days |
| Move ALIS fully to single sign-on (retire the separate native login) | ACG | labor | 60 days |
| Enable encryption on the resident-data file share | ACG | labor | 60–90 days |
| Maintain a one-page contract / renewal / BAA tracker | Cascades + ACG | none | 90 days, standing |
05
Backup
Done
- The server is backed up. The Synology NAS syncs its data to the server, and the server is backed up online (off-site) with daily incrementals, verified running.
- Firewall and network configuration backed up.
To do
| Action | Owner | Cost | Target |
|---|
| Repurpose the Synology NAS as the onsite backup for the server (with off-site backup continuing) | ACG | labor | 60–90 days |
| Run and document a test restore | ACG | labor | 90 days |
| Confirm and document the retention policy | ACG | none | 60 days |
06
Assistive technology (persons served)
Done
- Helpany "Paul" resident-safety sensors: ceiling radar fall and motion detection with no camera and no microphone, rolling out floor by floor.
- Building-wide WiFi supporting resident and family connectivity.
To do
| Action | Owner | Cost | Target |
|---|
| Complete the Helpany rollout; move sensors to their own protected network segment | Helpany + ACG | vendor + labor | 90 days |
| Inventory all resident-facing technology (nurse-call / pendants, assistive listening, resident WiFi for telehealth) into this plan | Cascades + ACG | none | next review |
07
Disaster recovery & continuity
Done
- Documented, proven power-outage procedure: scripted clean shutdown of core systems and verified clean recovery (exercised June 2026).
- UPS battery backup installed on core equipment and all network switches; off-site backup running.
To do
| Action | Owner | Cost | Target |
|---|
| Write the formal disaster-recovery / business-continuity plan with recovery-time targets | ACG | labor | 90 days |
| Documented restore test (with area 5) | ACG | labor | 90 days |
| Server redundancy (pairs with the server refresh project) | ACG + Cascades | project quote | FY project |
08
Virus & threat protection
Done
- Managed endpoint detection & response (EDR) on every managed device (about 35), including the main server (completed July 2026).
- Microsoft Defender and Exchange Online Protection on email; managed monitoring and patching on all devices.
- Legacy agents from the previous IT provider removed from the server.
To do
| Action | Owner | Cost | Target |
|---|
| Remove remaining legacy agents: DESKTOP-TRCIEJA (retires with its replacement) and DESKTOP-F94M8UT (powered off; completes on power-on); finish console cleanup | ACG | labor | 30–60 days |
| Standing coverage audit: every device reporting into managed security | ACG | none | quarterly |
Supplementary areas
+
Communication technology
Done: voice system consolidated onto an isolated voice network (37 devices); WiFi optimized building-wide; email authentication enforced.
To do: dedicated 5 GHz network for phones and Helpany sensors (improves call reliability); replace the Bistro phone; voice quality-of-service; then the supervised move to next-generation WiFi (WPA3 / 6 GHz). Owner: ACG + Vertical + Helpany; 90 days.
+
Services purchased / contracted
Managed IT (ACG, prepaid block), Microsoft 365, ALIS (Medtelligent), hosted voice (Vertical), dual-WAN internet (Cox), online backup, firewall & network (Netgate / UniFi), managed security, resident safety sensors (Helpany), plus line-of-business software.
To do: the renewal / BAA tracker (area 4) becomes the single register for all vendors.
+
Use of AI
To do: adopt an AI acceptable-use policy for staff (30 days); evaluate Microsoft 365 Copilot under HIPAA guardrails; build the cross-system KPI dashboard (ALIS, QuickBooks, Bill.com, Relias, CRM, TELS, Focus HR) as the sanctioned analytics path: Phase 1 scheduled exports to SharePoint and Power BI, Phase 2 automated data feeds.