# Follow-up email — staff list loose ends (SENT)

**To:** Meredith Kuhn, John Trozzi, Ashley Jensen
**From:** Howard Enos — Computer Guru
**Date:** 2026-04-22
**Status:** SENT

---

1. **Britney Thompson** — phone Y/N + outside sign-in Y/N
2. **Alma R Montt** — title / role. I see she is in Life Enrichment, is she an admin, manager, or something else?
3. **Polett Pinazavala** — MedTech - Memory Care (Tue-Sat) Desktop+phone, ALIS, NO outside access
4. **Ederick Yuzon** — first-name spelling
5. **Reliable Agency caregiver #1** — what sort name would you like them to have? reliable.agency.caregiver1 is long. Can do reliable1 and 2
6. **Reliable Agency caregiver #2**

I will send a full list for you all to look over.

---

*This is the copy of the email Howard sent to Meredith / John / Ashley on 2026-04-22. Full working list (the referenced follow-up) is `cascades-staff-working-list-2026-04-22.md`.*

## Reply from John (2026-04-22)

> "I deleted all those people britney is gone poletge is gone i dont know why it keeps not saving things, Alma is d+p and alis /offsite, she is mc life enrichment"
>
> (separate email) "Reliable i would like just like that"

### Resolution of each item

- **#1 Britney Thompson — DEPARTED.** No longer an employee. Her existing AD account (`britney.thompson`) and M365 license (Business Standard + Exchange Online Essentials per `docs/cloud/m365.md`) need to be disabled and harvested.
- **#2 Alma R Montt — ANSWERED.** D+P, ALIS=Y, Outside sign-in=Y. Title = "Memory Care Life Enrichment" (LE staff assigned to Memory Care residents — department stays Life Enrichment, title reflects the MC focus).
- **#3 Polett Pinazavala — DEPARTED.** No longer an employee. Was not in AD/M365 yet — just remove from the roster. No license to harvest, no account to disable.
- **#4 Ederick Yuzon — STILL PENDING.** John didn't address the spelling; assume he'll send a separate reply or we ping him again.
- **#5 / #6 Agency — SUPERSEDED 2026-04-22 by HIPAA review.** Although John approved `reliable1` / `reliable2`, post-review the shared-login approach was dropped: HHS has explicitly stated shared log-on IDs for PHI access violate §164.312(a)(2)(i) (Required spec, no compensating-control exception). Replaced with: Reliable Agency must supply individual names; per-person accounts only. No shared credentials. Full rationale in `docs/security/hipaa-review-2026-04-22.md`.

### John's note about "keeps not saving things"

John's comment suggests he tried editing the HTML questionnaire and saw edits disappear. The v2 editor uses localStorage + Export JSON — if he closed the browser without exporting (or edited in InPrivate mode), edits don't persist. Worth a follow-up at some point to make sure that's not blocking him from other inputs. Not urgent since we got the answers by email anyway.