# [RECOVERED] Cascades wiki + remaining-work-plan review — HIPAA gap findings

> Recovered from transcript a4519133-a1e5-467c-b784-f387223734a3
> (2026-07-13 22:16 .. 2026-07-14 10:14 local) after machine reboot. Reviewed by Claude.

## User
- **User:** Howard Enos (howard)
- **Machine:** Howard-Home
- **Role:** tech

## Session Summary

Went over the Cascades of Tucson customer wiki and `docs/REMAINING-WORK-PLAN.md` end-to-end to
validate the HIPAA-alignment effort. Found the plan stale (several tasks done but not marked;
wiki inconsistencies on ticket statuses) and identified compliance gaps:

- **Juan Andrade offboarding overdue** — access still active though his last day was two days
  prior; flagged as the top-priority risk.
- **No break-glass accounts** — must exist before the final CA allow-list flip.
- **Named Location too loose** — non-caregiver devices on the building network can pass;
  tighten the workstream.
- **No object-access audit logging** on the file server (SS164.312(b) gap) — no forensic trail.
- **BAA inventory incomplete** — several potential business associates unaccounted for.

Wiki (`wiki/clients/cascades-tucson.md`), the caretaker-phones-only list, and the remaining
work plan were updated during the session. Also investigated an a.mcferren sign-in issue
(AADSTS900561) — resolved; user signed in successfully after several failed attempts; a
customer-facing explanation was prepared. Checked CS-SERVER in GuruRMM (agent
c39f1de7-d5b6-45ae-b132-e06977ab1713, last seen 2026-07-14T05:28Z); a `.edr-csserver.ps1`
scratch script was created during the EDR check.

## Key Decisions

- Offboard Juan Andrade immediately (top priority).
- Create break-glass accounts BEFORE the final allow-list flip.
- Accelerate Named-Location tightening.
- Refresh REMAINING-WORK-PLAN.md to match the actual state before continuing execution.

## Problems Encountered

- Stale work plan / wiki inconsistencies required manual verification of each ticket
  (#32193, #32194, #32230, #32254, #32319, #32342, #32370).
- a.mcferren AADSTS900561 initially looked like a client-side error; resolved on retry.

## Configuration Changes

- [modified] `wiki/clients/cascades-tucson.md`
- [modified] `clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md`
- [modified] `clients/cascades-tucson/docs/cloud/caretaker-phones-only-list.md`
- [created] `C:\claudetools\.edr-csserver.ps1` (scratch — can be deleted)

## Pending / Incomplete Tasks

- Complete Juan Andrade offboarding (revoke all access, update records).
- Create break-glass accounts.
- Implement file-server object-access audit logging (SS164.312(b)).
- Complete the BAA inventory.
- Tighten the Named Location policy to exclude non-caregiver devices.
- Finish the work-plan refresh if not fully committed before the reboot.

## Reference Information

- Tickets: #32193, #32194, #32230, #32254, #32319, #32342, #32370.
- CS-SERVER RMM agent: c39f1de7-d5b6-45ae-b132-e06977ab1713.
- Related commit: 1fbc0e1.