Orion hosting
Orion is hosted by Amazon Web Services® (AWS), a third-party hosting provider located in the United States.
As a provider of connected medical devices, Resmed manages patient health data on behalf of its customers and subcontracts physical data hosting to AWS.
AWS was founded in 2006 and is an entity of the US group of Amazon®. Today, AWS is a leader in the cloud computing services market. It complies with applicable compliance laws, regulations and privacy programs. For more information, visit https://aws.amazon.com/compliance/programs/?nc1=h_ls.
AWS operates multiple data centers across the USA. Orion's primary system is hosted by AWS in Oregon and the backup system is hosted in Virginia.
Physical access to AWS data centers is limited to approved employees and third parties based on the principle of least privilege. Requests are reviewed and approved by authorized personnel and access is revoked after the requested time expires. Access is regularly reviewed and controlled. Physical access to AWS data centers is logged and monitored and that information is retained. Physical access points to server rooms are recorded by closed-circuit television cameras (CCTV). Images are retained in accordance with legal and compliance requirements. For the most up to date information, visit https://aws.amazon.com/compliance/data-center/controls/.
Orion enforces logical controls at the application and database levels to ensure that one organization's data can never be viewed or altered by any other organization. These controls include database foreign key constraints, views and specific application logic based on industry best practices for user authorization. A specialized security firm tests these controls through penetration testing at least once a year.
The following diagram shows how users, external systems and therapy machines connect to Orion and where Orion applies security controls such as HTTPS/TLS encryption, authentication, authorization, logging and encrypted storage.
