sync: auto-sync from HOWARD-HOME at 2026-04-22 17:39:56

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-04-22 17:39:56

clients/cascades-tucson/docs/cloud/caregiver-m365-p2-rollout.md

@@ -107,7 +107,7 @@ All UPNs above use the `@cascadestucson.com` suffix (standard).
 - **Patricia Sandoval-Beck** — **Resolved 2026-04-22 (CSV inline note from Meredith):** hyphen is correct. SamAccountName may still need to be `Patricia.SandovalBeck` if ALIS/MDM reject hyphens — test during Wave 3.
 - **Ederick Yuzon** — **Still pending:** spelling asked in 2026-04-22 email.
 - **Maia Baker** — **Resolved 2026-04-22 (CSV inline note):** part-time, still employed.
-- **Reliable Agency shared logins (x2)** — **Resolved 2026-04-22 (John's reply): usernames `reliable1@` and `reliable2@` confirmed.** Shared-login accounts, not per-person. Create in Wave 1 alongside Alma/Kyla.
+- **Reliable Agency caregivers** — **Final decision 2026-04-22 (post-HIPAA review): NO shared logins.** Originally planned `reliable1@` / `reliable2@`; dropped because shared log-on IDs for PHI access violate 45 CFR §164.312(a)(2)(i) (Required spec, no compensating-control exception). Per-person accounts only, created when Reliable Agency supplies individual names. Rationale in `docs/security/hipaa-review-2026-04-22.md`.
 
 ## Licensing plan (when ready — NOT now)
 
@@ -171,7 +171,8 @@ Group-policy impact: the `CSC - Folder Redirection (LE)` work done for Life Enri
 - [x] ~~Confirm Christine Nyanzunda is one person, not two~~ (resolved 2026-04-22 — one person, one account)
 - [x] ~~HR spelling confirmation on Paty Doran, Polett Pinazavala, Patricia Sandoval-Beck, Maia Baker~~ (all resolved 2026-04-22)
 - [ ] **Ederick Yuzon first-name spelling** — asked in 2026-04-22 email, still outstanding
-- [x] ~~Reliable Agency shared-login short usernames~~ (resolved 2026-04-22: reliable1/reliable2 confirmed)
+- [x] ~~Reliable Agency shared-login short usernames~~ (SUPERSEDED 2026-04-22 by HIPAA review — no shared logins, per-person only)
+- [ ] **Reliable Agency contract review** — confirm staffing contract says caregivers work under Cascades direct clinical control (workforce) vs. agency-supervised (BA). Get individual caregiver names before any PHI access.
 - [ ] Will caregivers use ALIS on the shared phones (need ALIS accounts + Entra SSO) or only email?
 - [ ] Does Cascades want to purchase 39 additional Business Premium licenses up-front, or roll out in waves (e.g., MedTechs first, then CCGs, then Caregivers)?
 - [ ] Confirm pfSense WAN IP(s) are static enough to rely on in a CA Named Location policy