sync: auto-sync from HOWARD-HOME at 2026-07-15 07:08:08

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-15 07:08:08

clients/cascades-tucson/session-logs/2026-07/2026-07-14-recovered-wiki-plan-review-hipaa-gaps.md

@@ -0,0 +1,65 @@
+# [RECOVERED] Cascades wiki + remaining-work-plan review — HIPAA gap findings
+
+> Recovered from transcript a4519133-a1e5-467c-b784-f387223734a3
+> (2026-07-13 22:16 .. 2026-07-14 10:14 local) after machine reboot. Reviewed by Claude.
+
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+
+## Session Summary
+
+Went over the Cascades of Tucson customer wiki and `docs/REMAINING-WORK-PLAN.md` end-to-end to
+validate the HIPAA-alignment effort. Found the plan stale (several tasks done but not marked;
+wiki inconsistencies on ticket statuses) and identified compliance gaps:
+
+- **Juan Andrade offboarding overdue** — access still active though his last day was two days
+  prior; flagged as the top-priority risk.
+- **No break-glass accounts** — must exist before the final CA allow-list flip.
+- **Named Location too loose** — non-caregiver devices on the building network can pass;
+  tighten the workstream.
+- **No object-access audit logging** on the file server (SS164.312(b) gap) — no forensic trail.
+- **BAA inventory incomplete** — several potential business associates unaccounted for.
+
+Wiki (`wiki/clients/cascades-tucson.md`), the caretaker-phones-only list, and the remaining
+work plan were updated during the session. Also investigated an a.mcferren sign-in issue
+(AADSTS900561) — resolved; user signed in successfully after several failed attempts; a
+customer-facing explanation was prepared. Checked CS-SERVER in GuruRMM (agent
+c39f1de7-d5b6-45ae-b132-e06977ab1713, last seen 2026-07-14T05:28Z); a `.edr-csserver.ps1`
+scratch script was created during the EDR check.
+
+## Key Decisions
+
+- Offboard Juan Andrade immediately (top priority).
+- Create break-glass accounts BEFORE the final allow-list flip.
+- Accelerate Named-Location tightening.
+- Refresh REMAINING-WORK-PLAN.md to match the actual state before continuing execution.
+
+## Problems Encountered
+
+- Stale work plan / wiki inconsistencies required manual verification of each ticket
+  (#32193, #32194, #32230, #32254, #32319, #32342, #32370).
+- a.mcferren AADSTS900561 initially looked like a client-side error; resolved on retry.
+
+## Configuration Changes
+
+- [modified] `wiki/clients/cascades-tucson.md`
+- [modified] `clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md`
+- [modified] `clients/cascades-tucson/docs/cloud/caretaker-phones-only-list.md`
+- [created] `C:\claudetools\.edr-csserver.ps1` (scratch — can be deleted)
+
+## Pending / Incomplete Tasks
+
+- Complete Juan Andrade offboarding (revoke all access, update records).
+- Create break-glass accounts.
+- Implement file-server object-access audit logging (SS164.312(b)).
+- Complete the BAA inventory.
+- Tighten the Named Location policy to exclude non-caregiver devices.
+- Finish the work-plan refresh if not fully committed before the reboot.
+
+## Reference Information
+
+- Tickets: #32193, #32194, #32230, #32254, #32319, #32342, #32370.
+- CS-SERVER RMM agent: c39f1de7-d5b6-45ae-b132-e06977ab1713.
+- Related commit: 1fbc0e1.