I see many problems here and my first thought is that a re-iteration of the business requirement analysis should be the next step. The schema itself is over simplified for the role and has some other serious flaws to, such as clear text passwords etc.

😎