The Clinics After the Crash

Eli created our clinic protocol at 4:11 this morning after he watched workers struggle with the portal. Marisol's privacy team reviewed it at 5:02, and the employee trust approved funding at 5:37. The community lab holds the signed operating copy and change log. Its vulnerability is human practice. A written rule cannot prevent every volunteer from glimpsing a screen, so we use physical barriers, role limits, and immediate reporting for mistakes.

Eli walks the staff through the process.

The clinic collects appointment initials and an employee-chosen contact method. It does not copy employee numbers into the schedule. A worker verifies identity directly with the vendor, downloads to a device they control, and decides whether to leave with the file or place it in encrypted storage held by their own counsel. Volunteers may guide the screen but cannot open completed records unless the worker asks.

"People will ask us to check whether the export is complete," one technologist says.

"Use the category checklist," Eli replies. "Confirm that sections exist. Do not read names, diagnoses, immigration notes, or dependent details. If the file looks wrong, route the person to privacy counsel."

He has converted a broad promise into work another person can follow. Months ago, executives discussed his prototype hours as observation. Today lawyers wait for his operating rule before they open the doors.

The first worker arrives at 8:14 with her adult son and a phone too old to run the vendor's verification app. She works in costume laundry and speaks enough English to tell us she wants her premium history. She does not want an interpreter from Wondervale.

We connect her to the clinic's independent language line. Eli gives her a loaned tablet in privacy mode. The device stores nothing after the session, and she saves the export to an encrypted drive she watches him unwrap.

The portal asks for a disability accommodation history as an identity question.

She pulls her hand away.

"Why do they need that?" her son asks.

They should not.

The vendor's help page says a user may select a different verification method. The link is below a collapsed menu that the screen reader does not announce. Eli documents the barrier and helps her choose a payroll-date question instead. The clinic log records the inaccessible step and time, not her answer or condition.

By nine, every chair is full.

Some workers fear that requesting a file will expose an expired visa or a family member's immigration status. Others have disability records they never disclosed to supervisors. A seasonal employee asks whether a rejected accommodation request will appear beside his future rehiring profile.

Marisol's lawyers cannot promise the files contain no harmful data. They can explain who currently holds each category, which disclosure rules apply, and how a worker can limit counsel's use. Nobody tells a frightened person that privacy concerns are irrational because the crisis is urgent.

One man leaves before logging in.

His choice does not become a failure count.

Mira returns from the courtyard with coffee and a request from Wondervale's benefits team. They want aggregate numbers by department so they can predict claim gaps.

"I told them we would provide only clinic-wide completion totals," she says. "They asked whether you would reconsider."

"I won't. Department totals could identify small teams."

"Then that is the answer."

She puts the coffee beside me and starts assembling more screens. She can make resources appear, but she does not speak again for the process.

At 10:22, the portal begins rejecting repeated device addresses. Shared library computers and clinic tablets look like suspicious activity because dozens of workers use the same connection.

The vendor recommends personal devices.

Eli asks Marisol to demand an accessible exception. He supplies the error codes, session times, and clinic network ranges without employee identities. The vendor's security team creates a temporary assisted-access classification at 11:03 and whitelists six clinic networks. The vendor retains the change ticket; the court monitor receives a mirrored copy. Its vulnerability is location. Network approval shows traffic came from a clinic, not that every person there consented or completed a download.

The fix restores access and creates another risk. A whitelisted network is valuable to anyone trying to impersonate a worker.

Eli adds one-use privacy screens around verification stations, assigns a security volunteer to watch devices rather than people, and requires every loaned tablet to reset between sessions. Local technologists inspect the reset logs. The logs can prove a reset command ran; they cannot prove data never remained in hardware memory.

At noon, complete exports reach fifty-six percent.

The other clinics report different obstacles. North Service workers need paid release time because supervisors scheduled them through every appointment slot. A library clinic lacks a private room for video identity checks. The disability center has accessible equipment but too few encrypted drives. We move staff and supplies without moving anyone's data.

Mira offers the Access Council's event vans for transport. I accept after the lab documents fuel, drivers, and accessibility as a market-rate emergency service. The vans carry people and sealed blank drives. They never carry downloaded records unattended.

At two, Rina sends the category checklist a warning. Several exports contain zero-byte premium tables even though the portal marks them complete. We update the clinic script: a green completion badge proves the vendor generated a package, not that each category contains usable data.

Eli adds file-size and section checks that run locally on the worker's device. The tool counts expected headings and flags empty tables. It does not transmit content. He publishes the source code for outside review and asks two local technologists to inspect it before use.

One reviewer finds that the tool writes a temporary filename containing the employee's initials. Eli removes the field, issues version 1.1, and records which twelve devices ran the earlier build. Counsel contacts those workers privately and helps delete the temporary names.

He does not hide the mistake to protect his first day as a leader.

At 3:30, the clinics pass seventy percent. Portal capacity rises after the court monitor requires the vendor to separate export traffic from ordinary account pages. The vendor says the change may slow claim-status updates. Rina and the benefits team monitor both services so recovery does not create a new care failure.

The studio grows warmer as winter coats collect under chairs. Children do homework beside parents waiting for verification codes. Technologists eat sandwiches over closed laptops. Every completed export leaves with a person instead of disappearing into a company repository.

At five, Eli asks me to review the closing plan.

"We can stay open overnight," he says. "The volunteers are willing."

"Willing is not the same as rested."

We divide the remaining queue into evening and morning appointments, pay a second shift, and keep counsel on call. Urgency does not earn free labor from the people repairing it.

At 6:42, the verified completion count reaches eighty percent.

The count comes from voluntary clinic confirmations, employee-trust reports, and vendor totals reconciled by the court monitor. The monitor holds the aggregate worksheet. Its vulnerability is duplication: workers may report through more than one channel, and some complete files may contain empty categories. We publish the range and method with the number.

Rina asks for permission to examine a small set of files from workers who have already retained counsel. Nine agree through separate forms. The lawyers remove names, addresses, dependent details, and treatment information before Rina sees the premium tables.

She calls me ten minutes later.

"The totals do not reconcile with payroll," she says.

I cross the studio to the counsel room. Rina has aligned employee-paid deductions, Wondervale contributions, and vendor premium receipts by anonymous record ID. Seven files reconcile. Two contain monthly premiums with no matching payroll deduction.

"Could they be retirees or dependents?" I ask.

"The category says employee. The status field says active. We need source enrollment records before we decide what that means."

Eli searches the redacted tables for employment start dates. Both entries list departments, but neither contains a hire date.

More consented files arrive from the clinic network. Counsel strips identifying fields. The same pattern appears again, then again.

The benefits administrator paid premiums for people Wondervale never employed.