8.1 KiB
8.1 KiB
Cascades of Tucson Technology Plan
A living action document: for each area, what has been done and what is planned. Prepared with Az Computer Guru. Reviewed and updated at least annually.
| Governance | |
|---|---|
| Plan owner | Cascades of Tucson |
| Prepared with | Az Computer Guru (Mike Swanson, Howard Enos) |
| Plan period | FY 2026–2027 |
| Adopted by / date | [at adoption] |
| Next annual review | [adoption + 12 months] |
1. Hardware
Done
- Full managed network deployed: UniFi with 77 access points and 12 managed switches; business firewall with dual internet connections and automatic failover.
- Server storage verified healthy; enterprise SSDs purchased for a planned upgrade.
- Windows Pro upgrades completed on nearly all workstations for domain readiness.
To do
| Action | Owner | Cost | Target |
|---|---|---|---|
| Install the purchased enterprise SSDs (scheduled window) | ACG | already purchased | 30–60 days |
| Replace workstations marked for replacement (list below, 5 + spare) | ACG | ~$700–950 ea | 60–90 days |
| Scope and quote a server refresh project | ACG + Cascades | formal quote | 90 days |
| Bring remaining switch ports up to full gigabit speed | ACG | labor | 90 days |
Workstations marked for replacement
| Machine | User / role | Plan |
|---|---|---|
| DESKTOP-TRCIEJA | Lupe Sanchez | Replace (end of life) |
| ASSISTMAN-PC | Meredith Kuhn | Replace (2015-era processor, cannot run Windows 11) |
| MDIRECTOR-PC | Shelby Trozzi (MC Director) | Replace (insufficient memory) |
| MEMRECEPT-PC | Memory Care front desk | Replace (oldest machine in the fleet) |
| Spare unit | New hire | Deploy spare |
| CHEF-PC | Culinary | Replace |
2. Software
Done
- Microsoft 365 Business Premium across the organization (45 seats enabled).
- ALIS clinical record connected to company sign-in (single sign-on live).
- Domain migration underway: about half of staff PCs on the company domain with department structure and drive mapping built.
To do
| Action | Owner | Cost | Target |
|---|---|---|---|
| Right-size Microsoft 365 licensing: move users off the legacy license; full Office licenses only where needed, lighter licenses for everyone else | ACG | reduces monthly cost | 30 days |
| Complete staff domain migration + department drives | ACG | labor | 60–90 days |
| Final Windows Pro upgrade (1 deferred device) | ACG | ~$99 | next window |
| Retire the per-PC Synology sync client as machines migrate | ACG | labor | with migration |
3. Security (sensitive data / HIPAA)
Done
- MFA for all staff; identity-based conditional access live.
- Caregiver accounts restricted to the building network (credentials unusable off-site), live since 2026-07-01.
- Auto-lock and auto-sign-out policy on shared care devices.
- Segmented network: voice isolated, per-room isolation, resident devices separated.
- Email authentication (SPF, DKIM, DMARC) enforced.
To do
| Action | Owner | Cost | Target |
|---|---|---|---|
| Create emergency break-glass admin accounts with hardware security keys | ACG | ~$110 keys | 30 days |
| Enforce the caregiver device allow-list (final enforcement phase) | ACG | labor | 30–60 days, after break-glass |
| Limit trusted-network sign-in to approved devices (next enforcement phase) | ACG | labor | 30–60 days |
| Enable file-access audit logging with 90-day/6-year retention | ACG | ~$50–120/mo + build | 60–90 days |
| Formalize a same-day offboarding checklist | Cascades HR + ACG | none | 30 days, then standing |
| Package the dated security risk assessment | ACG | labor | 60 days |
4. Confidentiality
Done
- PHI access limited by role and security group; single sign-on to the clinical record.
- Shared care devices auto-lock; resident and voice traffic isolated on the network.
To do
| Action | Owner | Cost | Target |
|---|---|---|---|
| Complete the Business Associate Agreement inventory (every vendor touching PHI) | Cascades + ACG | none | 60 days |
| Move ALIS fully to single sign-on (retire the separate native login) | ACG | labor | 60 days |
| Enable encryption on the resident-data file share | ACG | labor | 60–90 days |
| Maintain a one-page contract / renewal / BAA tracker | Cascades + ACG | none | 90 days, then standing |
5. Backup
Done
- The server is backed up. The Synology NAS syncs its data to the server, and the server is backed up online (off-site) with daily incrementals, verified running.
- Firewall and network configuration backed up.
To do
| Action | Owner | Cost | Target |
|---|---|---|---|
| Repurpose the Synology NAS as the onsite backup for the server (with off-site backup continuing) | ACG | labor | 60–90 days |
| Run and document a test restore | ACG | labor | 90 days |
| Confirm and document the retention policy | ACG | none | 60 days |
6. Assistive technology (persons served)
Done
- Helpany "Paul" resident-safety sensors: ceiling radar fall and motion detection with no camera and no microphone, rolling out floor by floor.
- Building-wide WiFi supporting resident and family connectivity.
To do
| Action | Owner | Cost | Target |
|---|---|---|---|
| Complete the Helpany rollout; move sensors to their own protected network segment | Helpany + ACG | vendor-billed + labor | 90 days |
| Inventory all resident-facing technology (nurse-call/pendants, assistive listening, resident WiFi for telehealth) into this plan | Cascades + ACG | none | next review |
7. Disaster recovery & continuity
Done
- Documented, proven power-outage procedure: scripted clean shutdown of core systems and verified clean recovery (exercised June 2026).
- UPS battery backup installed on core equipment and all network switches; off-site backup running.
To do
| Action | Owner | Cost | Target |
|---|---|---|---|
| Write the formal disaster-recovery / business-continuity plan with recovery-time targets | ACG | labor | 90 days |
| Documented restore test (with area 5) | ACG | labor | 90 days |
| Server redundancy (pairs with the server refresh project) | ACG + Cascades | project quote | FY project |
8. Virus & threat protection
Done
- Managed endpoint detection & response (EDR) on every managed device (about 35), including the main server (completed July 2026).
- Microsoft Defender and Exchange Online Protection on email; managed monitoring and patching on all devices.
- Legacy agents from the previous IT provider removed from the server.
To do
| Action | Owner | Cost | Target |
|---|---|---|---|
| Remove remaining legacy agents: DESKTOP-TRCIEJA (retires with its replacement) and DESKTOP-F94M8UT (powered off; completes on power-on); finish console cleanup | ACG | labor | 30–60 days |
| Standing coverage audit: every device reporting into managed security | ACG | none | quarterly |
Supplementary areas
Communication technology
Done: voice system consolidated onto an isolated voice network (37 devices); WiFi optimized building-wide; email authentication enforced. To do: dedicated 5 GHz network for phones and Helpany sensors (improves call reliability); replace the Bistro phone; voice quality-of-service; then the supervised move to next-generation WiFi (WPA3 / 6 GHz). Owner: ACG + Vertical + Helpany; 90 days.
Services purchased / contracted
Managed IT (ACG, prepaid block), Microsoft 365, ALIS (Medtelligent), hosted voice (Vertical), dual-WAN internet (Cox), online backup, firewall & network (Netgate/UniFi), managed security/EDR, resident safety sensors (Helpany), plus line-of-business software. To do: the renewal/BAA tracker (area 4) becomes the single register for all vendors.
Use of AI
To do: adopt an AI acceptable-use policy for staff (30 days); evaluate Microsoft 365 Copilot under HIPAA guardrails; build the cross-system KPI dashboard (ALIS, QuickBooks, Bill.com, Relias, CRM, TELS, Focus HR) as the sanctioned analytics path: Phase 1 scheduled exports to SharePoint and Power BI, Phase 2 automated data feeds.
Review & maintenance
Reviewed at least annually by Cascades leadership with ACG; updated as projects complete.
| Revision | Date | By |
|---|---|---|
| Initial draft | 2026-07-15 | ACG (prepared for Cascades adoption) |