# Cascades of Tucson - Technology Plan Review > **[SUPERSEDED 2026-06-24]** This first-pass draft predates the 2026-06-24 wiki recompile and > contains stale facts (CS-SERVER "RAID critical" -> actually HEALTHY; 48.75 hrs/0 tickets -> > 48.25 hrs/6 tickets; no Helpany sensors). **Use instead:** > - Client deliverable: `cascades-technology-plan-2026-06-24.pdf` (+ `.html` source) - polished, current. > - Internal execution plan: `../REMAINING-WORK-PLAN.md` (canonical 7-workstream plan). > Kept for history only. > Prepared for the planning meeting requested by Ashley Jensen (week of 2026-06-23 / 2026-06-30). > Organized to Ashley's exact agenda: for each area we cover **Current state -> Gaps -> Action steps -> Timeline -> Priority**. > Prepared by ACG (Az Computer Guru). Source of truth: `wiki/clients/cascades-tucson.md` (compiled 2026-06-23) + live systems. > Contract: prepaid hour block @ $175/hr; **48.75 hrs remaining** (Syncro, live 2026-06-23). 0 open tickets. --- ## 0. Executive summary - established priorities The single theme across every area is **Cascades runs PHI on one 16-year-old server with no redundancy**, while the surrounding identity, network, and voice layers have been substantially modernized over the last 90 days. The top priorities, in order: | # | Priority | Area | Why it's #1-tier | |---|----------|------|------------------| | P1 | **Replace / de-risk CS-SERVER** | Hardware, DR | Single Dell R610 (~2009) DC holding all PHI; OS RAID-1 mirror DEGRADED 2026-06-15 (running on one aging spindle, zero redundancy). Data-loss + total-outage exposure. | | P2 | **Close HIPAA audit + access gaps** | Security | No audit logging on the PHI share; audit-retention infra approved but not built; caregiver device allow-list still report-only; ALIS BAA unverified. | | P3 | **Unify malware/EDR coverage** | Malware prevention | The PHI server is NOT under managed AV/EDR (Bitdefender); leftover previous-MSP Datto agents still installed. | | P4 | **Verify & formalize DR/continuity** | Disaster recovery | Cloud backup now running (gap closed 2026-06-15) - must confirm it is image/bare-metal + retention, then document a real DR/BC plan and test a restore. | | P5 | **Finish voice quality + M365 relicensing** | Communication, Software | Voice VLAN done; last fix (Poly 5GHz lock) is waiting on Vertical. 31 users still on a SUSPENDED M365 license - time-sensitive. | | P6 | **Establish an AI acceptable-use policy** | Use of AI | No governance today; HIPAA makes uncontrolled staff use of public AI a PHI-leak risk. Pairs with the KPI-dashboard analytics opportunity. | --- ## 1. Hardware & Software **Current state** - **CS-SERVER** - Dell PowerEdge R610 (~2009, 16+ yrs). Single Domain Controller doing everything: AD, DNS, DHCP, file server, Hyper-V host, print server. Windows Server 2019. - **Synology cascadesDS** NAS (DSM 7.2.1) - legacy file storage, transitioning to backup-only. - **pfSense** firewall (Netgate, dual-WAN) + full **UniFi** network: 77 U7-Pro access points, 12 managed switches. - **~29 managed workstations** (Syncro). Active domain migration to `cascades.local` + Microsoft Entra hybrid identity is well underway. - **Microsoft 365** - Business Premium across the org. **Gaps** - **[CRITICAL] CS-SERVER OS mirror is degraded** (one drive failed 2026-06-15) - C: (OS/AD) is running on a single aging 5400 RPM laptop spindle with no redundancy. This is also the root cause of "server is slow" reports. - **Single point of failure** - one elderly DC; if it dies, AD/file/print/DHCP all go down at once. - **EOL workstations** - Lupe Sanchez's PC (Gateway i3-2120, Win11-unsupported) flagged for replacement; Chef-PC needs a full reinstall. - **M365 relicensing** - 31 users still assigned to a **SUSPENDED** Business Standard license; 31 Business Premium seats sit free. Time-sensitive. - ~25 switch ports negotiating 100 Mbps instead of gigabit (cabling/NIC); 3 switches offline. **Action steps** 1. Interim: replace CS-SERVER OS drives with 2x 480 GB enterprise SSD (gated on verified backup first). 2. Strategic: scope a **server replacement / DC modernization** - the real fix for the SPOF and the slowness. 3. Replace Lupe's workstation; reinstall Chef-PC (open tickets #32194, #32254). 4. Complete M365 relicensing (31 Standard -> Premium). 5. After WiFi stabilizes: correct the 100 Mbps switch ports and investigate the 3 offline switches. **Timeline** - SSD swap near-term (once backup verified); relicensing immediate; workstation swaps near-term; server-replacement a larger project to scope jointly. **Priority: HIGH (P1).** --- ## 2. Communication Technology **Current state** - **Email** - Microsoft 365 / Exchange Online. SPF, DKIM, and DMARC (`p=quarantine`) all published. Shared mailboxes `grievances@` and `Surveys@` created 2026-06-12. - **Voice** - Vertical hosted/cloud PBX. 37 devices (28 Poly WiFi handsets + 8 AudioCodes desk phones + the Vertical management desktop) **consolidated onto an isolated Voice VLAN 30 (completed 2026-06-19)** - HIPAA-segmented, phones marking DSCP EF for QoS. - **WiFi** - heavily optimized 2026-06-19: 5 GHz retransmits roughly halved, 2.4 GHz power rebalanced, ~587 concurrent clients across 77 APs. **Gaps** - **Residual dropped calls** - several Poly handsets cling to the saturated 2.4 GHz band despite strong 5 GHz signal. Fix is a phone-side 5 GHz-only lock - **request is with Vertical (Richard Turner), awaiting their push.** This is the last open voice item. - **Bistro phone missing** - one bad phone was pulled; a replacement is pending. - **Voice QoS** designed but not yet built (insurance for WAN failover / saturation). - **6 GHz WiFi band is dark** - the largest untapped clean wireless capacity; enabling it needs a WPA3 conversion on the main SSID (supervised change). - DMARC sits at `quarantine` (could progress to `reject`); DMARC reports route to an unmonitored mailbox. **Action steps** - chase the Vertical 5 GHz lock to closure; install/re-key the Bistro replacement; build voice QoS; plan the supervised 6 GHz / WPA3 change window. **Timeline** - voice closeout is days-out pending Vertical; QoS and 6 GHz are scheduled change windows. **Priority: MEDIUM-HIGH (P5).** --- ## 3. Security for Sensitive Data (HIPAA / PHI) **Current state** - HIPAA is the primary compliance driver. PHI lives on CS-SERVER and in **ALIS** (clinical EHR). A modern, identity-based access-control model is largely deployed: - **Microsoft Entra Conditional Access** splits staff into two postures - caregivers locked to the Cascades network + approved devices (credentials useless off-site); office/clinical staff get MFA off-site. - **ALIS single sign-on** is live (Entra is the second factor). - **Caregiver device-lockdown GPO** - auto screen-lock at 3 min, auto sign-out at 15 min (HIPAA 164.312(a) for shared PHI devices). - **Voice VLAN isolation**, per-room network L2 isolation, MFA for all users, DMARC enforcement. **Gaps (open HIPAA items)** - **No audit logging on the PHI file share** (164.312(b)); Object Access auditing disabled; no SMB encryption on the Homes share. - **Audit-retention infrastructure** (90-day + 6-year) approved 2026-04-29 but **not yet built**. - **Break-glass admin accounts** not created; FIDO2 keys unconfirmed. - **ALIS Business Associate Agreement (BAA)** with Medtelligent not yet verified. - Caregiver device **allow-list still in report-only** mode (cutover pending); ALIS-native 2FA should be disabled in favor of Entra SSO-only. - **Exposed credential** - a Synology sign-in credential was committed in plaintext to our vault history; rotate it. **Action steps** - enable file-share/object-access auditing + build the retention store; create break-glass accounts; obtain/verify the ALIS BAA; complete the caregiver allow-list cutover; rotate the exposed Synology credential. **Timeline** - auditing + retention is the headline near-term HIPAA workstream. **Priority: HIGH (P2).** --- ## 4. Services Purchased or Contracted (vendor inventory) | Service | Vendor | Purpose | Note for review | |---------|--------|---------|-----------------| | Managed IT services | ACG | Support / projects | Prepaid block, 48.75 hrs remaining | | Microsoft 365 | Microsoft | Email, identity, Office | Relicensing 31 users (see Hardware/Software) | | ALIS | Medtelligent | Clinical EHR (PHI) | **BAA verification required** | | Hosted voice | Vertical | Phone system | 5 GHz lock pending with them | | Internet (dual-WAN) | Cox | Fiber primary + coax failover | WAN2 upload still to be measured | | Cloud backup | MSP360 / CloudBerry (-> ACG) | Off-site backup | Installed 2026-06-15 (see DR) | | Firewall / network | Netgate (pfSense) + UniFi | Perimeter + LAN/WiFi | Healthy, optimized | | Endpoint security | Bitdefender | AV/EDR | Partial coverage (see Malware) | | Line-of-business SaaS | QuickBooks, Bill.com, Relias (LMS), You've Got Leads (CRM), TELS / Direct Supply (facilities), Focus HR (HR/payroll), Helpany (caregiver app), POS | Operations | Catalogued for the KPI dashboard | **Gaps** - ALIS BAA; no central contract/renewal calendar; M365 license true-up. **Action** - build a one-page renewal/BAA tracker. **Priority: MEDIUM.** --- ## 5. Assistive Technology **Current state** - In ACG's current scope, the resident/clinical-facing technology is **ALIS** (clinical EHR) and **Helpany** (the caregiver app). A physical access-control vendor engagement is on record (ticket #32324, 2026-05-26). No dedicated resident accessibility / nurse-call / emergency-call system is currently documented under ACG management. **Gap / open question** - Ashley's agenda lists assistive technology "if any." We should **clarify scope with her**: does she mean resident-facing assistive/accessibility devices, nurse-call / emergency-response systems, or staff-facing clinical tooling? That determines whether this becomes an ACG workstream or stays vendor-owned. **Action step** - confirm definition + current vendors at the meeting; if any of it touches PHI or the network, fold it into the security and DR plans. **Priority: CLARIFY FIRST.** --- ## 6. Disaster Recovery & Continuity **Current state** - **Cloud backup is now running** - MSP360/CloudBerry to ACG's backup server, installed 2026-06-15, which **closed the longstanding "no backup" HIPAA gap**. Last full completed SUCCESS 2026-06-22 (0 errors). - Synology is being repurposed as a secondary/backup target. - pfSense config is backed up (vaulted + on-box); Netgate AutoConfigBackup to be enabled. - **Proven outage procedure** - the 2026-06-23 planned building power outage was handled with a clean, scripted self-shutdown of all core devices and verified-clean recovery (after an unclean 2026-06-17 outage taught the lesson). UPS + iDRAC auto-recovery + Synology auto-restart provide bring-up backstops. **Gaps** - **Verify the backup is image-based / bare-metal + system-state**, not just files, and that retention is set - before relying on it. - **No AD redundancy** - single DC = no failover for login/file/DNS. - **Degraded RAID** keeps data-loss risk live until the SSD swap. - **No formal written DR/BC plan** - no documented RTO/RPO, no tested restore. - UPS battery-side placement of all core gear not fully verified onsite. **Action steps** - confirm backup completeness + run a test restore; document a DR/BC plan with RTO/RPO; add a second (or cloud-hosted) DC for AD redundancy; finish the SSD swap; enable AutoConfigBackup; verify UPS coverage. **Timeline** - backup verification + test restore is the immediate item; DR/BC document and AD redundancy pair with the CS-SERVER replacement project. **Priority: HIGH (P4).** --- ## 7. Malware Prevention & Virus Protection **Current state** - **Bitdefender GravityZone** (ACG's managed security platform) protects Cascades endpoints - **3 endpoints currently enrolled** in the tenant as of last audit. - **GuruRMM** (ACG's RMM) is deployed for monitoring/patching; **Microsoft Defender / Exchange Online Protection** cover email. **Gaps** - **[IMPORTANT] CS-SERVER - the PHI server - is NOT in Bitdefender** (no managed AV/EDR on the most sensitive box). - **Leftover previous-MSP agents** - Datto RMM (CentraStage) + Datto EDR (Infocyte/DattoAV) are still installed alongside our tools, causing agent sprawl and contributing to the server slowness. - Only ~3 of ~29 managed devices are confirmed in Bitdefender - **coverage is incomplete and needs a full audit**. **Action steps** 1. Enroll CS-SERVER and all remaining workstations into Bitdefender. 2. Remove the legacy Datto stack everywhere it remains. 3. Standardize on **Bitdefender (AV/EDR) + GuruRMM (management) + Defender/EOP (email)** and run a coverage audit so 100% of devices report in. **Timeline** - run the coverage audit before the meeting; remediation is near-term. **Priority: HIGH (P3).** *(Note: exact live endpoint counts to be confirmed via a Bitdefender coverage pull just before the meeting.)* --- ## 8. Use of AI **Current state** - There is **no production AI system deployed at Cascades today**. The nearest active item is the **KPI dashboard** Ashley requested (2026-06-17): a single dashboard pulling KPIs across ALIS, QuickBooks, Bill.com, Relias, the CRM, TELS, Focus HR, etc. Recommended path is Phase 1 scheduled exports -> SharePoint -> Power BI, Phase 2 API automation - an analytics/automation foundation that AI can later build on. It is parked pending Ashley's day-one KPIs. **Gaps / opportunities** - **No AI acceptable-use policy** - the key governance gap. In a HIPAA environment, uncontrolled staff use of public AI tools (ChatGPT, etc.) is a PHI-leak risk. A simple policy + guardrails should come first. - **Microsoft 365 Copilot** is a natural opportunity (the org already has M365), but needs HIPAA review before enabling on PHI-adjacent data. - **Vendor AI features** (e.g., any AI inside ALIS or other SaaS) should be reviewed against their BAAs. **Action steps** - (1) draft an AI acceptable-use policy for staff; (2) evaluate M365 Copilot with HIPAA guardrails; (3) progress the KPI dashboard as the sanctioned analytics path; (4) review vendor AI features against BAAs. **Timeline** - policy first (quick); Copilot + dashboard are scoped opportunities. **Priority: MEDIUM (P6) - governance before adoption.** --- ## Suggested meeting flow 1. Walk the **priorities table (Section 0)** - agree on the order. 2. Lead with **CS-SERVER replacement (P1)** + **DR verification (P4)** - they are the same conversation and the biggest risk-reducers. 3. **HIPAA security gaps (P2)** + **malware coverage (P3)** - the compliance block. 4. **Voice closeout + M365 relicensing (P5)** - quick wins / time-sensitive. 5. **AI policy + KPI dashboard (P6)** - forward-looking. 6. **Clarify "assistive technology" scope (Section 5)** with Ashley. 7. Agree timelines + which items draw against the prepaid block vs. a separate project quote (server replacement). --- ## Pre-meeting to-do for ACG (to make this airtight) - [ ] Live Bitdefender coverage pull (exact enrolled vs. unmanaged device counts). - [ ] Live Syncro hours confirmation (currently 48.75 hrs). - [ ] Confirm the cloud backup is image/bare-metal + retention (the DR linchpin). - [ ] Get a rough budget number for the CS-SERVER replacement to bring to the meeting.