Data security
All relevant Resmed employees sign a confidentiality agreement.
Resmed provides specific training to all relevant employees on security and customer data management. This includes e-learning and privacy champion programs.
Resmed protects customer personal data using encryption controls. These controls apply to customer personal data at rest and in transit. Encryption policies help ensure the implemented controls remain adequate.
Resmed implements backups to ensure the availability of customer personal data. Backup operations are monitored, secured and documented. Additionally, Resmed implements and tests a disaster recovery plan and a business continuity plan. Although Resmed provides backups, they are not intended to serve as a permanent medical record archive or storage system. According to the Terms of Use, you are responsible for downloading, backing up or otherwise retaining any data created using Resmed HI Services, and for storing that data separately on your own systems. To download reports to your computer, see Manage reports.
If you need help to recover Orion data, contact Resmed customer support: airviewsupport@resmed.com
Resmed uses firewalls, anti-malware and anti-virus solutions to defend against security threats. Resmed also performs vulnerability scans, penetration testing and system patching.
When a user or organization no longer needs Orion access, remove the user's access through your organization's process. After you confirm the user can no longer sign in, contact Resmed customer support (airviewsupport@resmed.com) to request their account closure and data deletion. A secure disposal process ensures the secure deletion of customer personal data.
Only authorized stakeholders can access Resmed HI Services system components. Resmed applies the principles of least privilege, need-to-know and segregation of duties. The system also includes authorization at the application and database levels to ensure data from one organization can never be viewed or altered by any other organization.
Resmed uses traceability tools to review logs and detect malicious activity.
Resmed follows a change management procedure to ensure each new release passes a security check before it goes live.
Resmed has a security incident response plan that is tested regularly. A security incident and event management tool is designed to report unauthorized accesses and raise an alert if a forbidden action occurs.
To learn how Resmed protects the security of information of our customers and their patients, our commercial partners and our global team, visit: https://www.resmed.com/security/.
Security events and logs
Orion records user actions and remotely applied PAP therapy setting changes in the Notes and timeline.
If the system is temporarily unavailable, you will see a notification after you sign in.
While Resmed applies strong security measures for data transfer, management and storage, customers should understand that it is impossible to guarantee an absolute level of security for data transmitted over the internet.
Resmed strives to continuously improve its security posture. Resmed updates Orion's processes and risk assessments to meet evolving internet threats. Each year, Orion is audited both internally and externally.
Resmed hardens the host server by disabling or removing unnecessary services, software and logins.
Data is required to operate legally and effectively in modern healthcare. Resmed is professionally and ethically compelled to adhere to high standards of regulatory compliance, data security and patient privacy.
Our Trust center provides comprehensive information on our standards and commitments and can be a useful resource to help you and your patients understand how data is treated by Resmed. To find out more, visit https://www.resmed.com/en-us/privacy/ or https://www.resmed.com/en-us/security/
End of support and end of life
If Orion reaches end of life, Resmed will notify users and provide next steps.