+
+
+
+
Az Computer Guru
+
Managed IT & Security · Tucson · Since 2001
+
+ Prepared for Cascades of Tucson
+ Attn: Business Office
+ Drafted July 15, 2026
+
+
+
+
+
Technology Plan · FY 2026–2027
+
Cascades of Tucson Technology Plan
+
A living action document: for each area of the facility's technology, what has
+ been done and what is planned, with an owner, cost, and target for every action. Prepared with
+ Az Computer Guru. Reviewed and updated at least annually.
+
+
+
+
Plan ownerCascades of Tucson
+
Prepared withAz Computer Guru
+
Plan periodFY 2026–2027
+
Adopted by / dateat adoption
+
Next annual reviewadoption + 12 months
+
+
+
The eight areas
+
+
+ 01
Hardware
+ Done
+
+ - Full managed network deployed: UniFi with 77 access points and 12 managed switches; business firewall with dual internet connections and automatic failover.
+ - Server storage verified healthy; enterprise SSDs purchased for a planned upgrade.
+ - Windows Pro upgrades completed on nearly all workstations for domain readiness.
+
+ To do
+
+ | Action | Owner | Cost | Target |
|---|
+ | Install the purchased enterprise SSDs (scheduled window) | ACG | purchased | 30–60 days |
+ | Replace workstations marked for replacement (list below, 5 + spare) | ACG | ~$700–950 ea | 60–90 days |
+ | Scope and quote a server refresh project | ACG + Cascades | formal quote | 90 days |
+ | Bring remaining switch ports up to full gigabit speed | ACG | labor | 90 days |
+
+ Workstations marked for replacement
+
+ | Machine | User / role | Plan |
|---|
+ | DESKTOP-TRCIEJA | Lupe Sanchez | Replace (end of life) |
+ | ASSISTMAN-PC | Meredith Kuhn | Replace (2015-era processor, cannot run Windows 11) |
+ | MDIRECTOR-PC | Shelby Trozzi (MC Director) | Replace (insufficient memory) |
+ | MEMRECEPT-PC | Memory Care front desk | Replace (oldest machine in the fleet) |
+ | Spare unit | New hire | Deploy spare |
+ | CHEF-PC | Culinary | Replace |
+
+
+
+
+ 02
Software
+ Done
+
+ - Microsoft 365 Business Premium across the organization (45 seats enabled).
+ - ALIS clinical record connected to company sign-in (single sign-on live).
+ - Domain migration underway: about half of staff PCs on the company domain with department structure and drive mapping built.
+
+ To do
+
+ | Action | Owner | Cost | Target |
|---|
+ | Right-size Microsoft 365 licensing: move users off the legacy license; full Office licenses only where needed, lighter licenses for everyone else | ACG | reduces monthly cost | 30 days |
+ | Complete staff domain migration + department drives | ACG | labor | 60–90 days |
+ | Final Windows Pro upgrade (1 deferred device) | ACG | ~$99 | next window |
+ | Retire the per-PC Synology sync client as machines migrate | ACG | labor | with migration |
+
+
+
+
+ 03
Security (sensitive data / HIPAA)
+ Done
+
+ - Multi-factor sign-in for all staff; identity-based conditional access live.
+ - Caregiver accounts restricted to the building network (credentials unusable off-site), live since July 1, 2026.
+ - Auto-lock and auto-sign-out policy on shared care devices.
+ - Segmented network: voice isolated, per-room isolation, resident devices separated.
+ - Email authentication (SPF, DKIM, DMARC) enforced.
+
+ To do
+
+ | Action | Owner | Cost | Target |
|---|
+ | Create emergency break-glass admin accounts with hardware security keys | ACG | ~$110 keys | 30 days |
+ | Enforce the caregiver device allow-list (final enforcement phase) | ACG | labor | 30–60 days |
+ | Limit trusted-network sign-in to approved devices (next enforcement phase) | ACG | labor | 30–60 days |
+ | Enable file-access audit logging with 90-day / 6-year retention | ACG | ~$50–120/mo | 60–90 days |
+ | Formalize a same-day offboarding checklist | Cascades HR + ACG | none | 30 days, standing |
+ | Package the dated security risk assessment | ACG | labor | 60 days |
+
+
+
+
+ 04
Confidentiality
+ Done
+
+ - PHI access limited by role and security group; single sign-on to the clinical record.
+ - Shared care devices auto-lock; resident and voice traffic isolated on the network.
+
+ To do
+
+ | Action | Owner | Cost | Target |
|---|
+ | Complete the Business Associate Agreement inventory (every vendor touching PHI) | Cascades + ACG | none | 60 days |
+ | Move ALIS fully to single sign-on (retire the separate native login) | ACG | labor | 60 days |
+ | Enable encryption on the resident-data file share | ACG | labor | 60–90 days |
+ | Maintain a one-page contract / renewal / BAA tracker | Cascades + ACG | none | 90 days, standing |
+
+
+
+
+ 05
Backup
+ Done
+
+ - The server is backed up. The Synology NAS syncs its data to the server, and the server is backed up online (off-site) with daily incrementals, verified running.
+ - Firewall and network configuration backed up.
+
+ To do
+
+ | Action | Owner | Cost | Target |
|---|
+ | Repurpose the Synology NAS as the onsite backup for the server (with off-site backup continuing) | ACG | labor | 60–90 days |
+ | Run and document a test restore | ACG | labor | 90 days |
+ | Confirm and document the retention policy | ACG | none | 60 days |
+
+
+
+
+ 06
Assistive technology (persons served)
+ Done
+
+ - Helpany "Paul" resident-safety sensors: ceiling radar fall and motion detection with no camera and no microphone, rolling out floor by floor.
+ - Building-wide WiFi supporting resident and family connectivity.
+
+ To do
+
+ | Action | Owner | Cost | Target |
|---|
+ | Complete the Helpany rollout; move sensors to their own protected network segment | Helpany + ACG | vendor + labor | 90 days |
+ | Inventory all resident-facing technology (nurse-call / pendants, assistive listening, resident WiFi for telehealth) into this plan | Cascades + ACG | none | next review |
+
+
+
+
+ 07
Disaster recovery & continuity
+ Done
+
+ - Documented, proven power-outage procedure: scripted clean shutdown of core systems and verified clean recovery (exercised June 2026).
+ - UPS battery backup installed on core equipment and all network switches; off-site backup running.
+
+ To do
+
+ | Action | Owner | Cost | Target |
|---|
+ | Write the formal disaster-recovery / business-continuity plan with recovery-time targets | ACG | labor | 90 days |
+ | Documented restore test (with area 5) | ACG | labor | 90 days |
+ | Server redundancy (pairs with the server refresh project) | ACG + Cascades | project quote | FY project |
+
+
+
+
+ 08
Virus & threat protection
+ Done
+
+ - Managed endpoint detection & response (EDR) on every managed device (about 35), including the main server (completed July 2026).
+ - Microsoft Defender and Exchange Online Protection on email; managed monitoring and patching on all devices.
+ - Legacy agents from the previous IT provider removed from the server.
+
+ To do
+
+ | Action | Owner | Cost | Target |
|---|
+ | Remove remaining legacy agents: DESKTOP-TRCIEJA (retires with its replacement) and DESKTOP-F94M8UT (powered off; completes on power-on); finish console cleanup | ACG | labor | 30–60 days |
+ | Standing coverage audit: every device reporting into managed security | ACG | none | quarterly |
+
+
+
+
Supplementary areas
+
+
+ +
Communication technology
+ Done: voice system consolidated onto an isolated voice network (37 devices); WiFi optimized building-wide; email authentication enforced.
+ To do: dedicated 5 GHz network for phones and Helpany sensors (improves call reliability); replace the Bistro phone; voice quality-of-service; then the supervised move to next-generation WiFi (WPA3 / 6 GHz). Owner: ACG + Vertical + Helpany; 90 days.
+
+
+
+ +
Services purchased / contracted
+ Managed IT (ACG, prepaid block), Microsoft 365, ALIS (Medtelligent), hosted voice (Vertical), dual-WAN internet (Cox), online backup, firewall & network (Netgate / UniFi), managed security, resident safety sensors (Helpany), plus line-of-business software.
+ To do: the renewal / BAA tracker (area 4) becomes the single register for all vendors.
+
+
+
+ +
Use of AI
+ To do: adopt an AI acceptable-use policy for staff (30 days); evaluate Microsoft 365 Copilot under HIPAA guardrails; build the cross-system KPI dashboard (ALIS, QuickBooks, Bill.com, Relias, CRM, TELS, Focus HR) as the sanctioned analytics path: Phase 1 scheduled exports to SharePoint and Power BI, Phase 2 automated data feeds.
+
+
+
+
+