Security Statement

1. Our approach

DME Hubs selects administrative, technical, and organizational safeguards according to the sensitivity of the information, the purpose of the system, and applicable contractual and legal requirements. Security is an ongoing process, so we review risks and update safeguards as our services, technology, and threat environment evolve.

Our security work is organized around risk management, access control, data protection, secure operations, service resilience, incident response, and oversight of service providers.

2. Access control

We restrict administrative access to authorized personnel with a business need. Access is assigned through named accounts, limited according to role, and reviewed as responsibilities change. Authentication and account-management controls are selected according to the sensitivity and function of each system.

3. Data protection

Public connections to DME Hubs services are designed to use encrypted transport. We apply storage, configuration, and handling protections based on the type of information and the system in which it is processed. We also seek to limit collection and access to information that is reasonably necessary for the relevant business or service purpose.

4. Secure operations

DME Hubs uses operational monitoring and system logging for security and reliability purposes. We maintain processes for software updates, configuration and change management, access review, and investigation of suspected vulnerabilities or misuse. Controls vary by system and are reviewed as the platform changes.

5. Resilience and incident response

We maintain backup and recovery measures for systems in scope and procedures for evaluating and responding to suspected security incidents. If an incident affects customer information, our response and communications will follow the applicable facts, law, and contractual obligations.

6. Service providers

DME Hubs uses service providers to support hosting, communications, security, and business operations. We evaluate providers in light of the service they perform, the information they may access, and applicable contractual requirements. We seek to limit provider access to what is needed for the service.

7. Healthcare data and customer responsibilities

DME Hubs provides technology to DME/HME suppliers and healthcare organizations. Customer use of the DME Hubs platform, including any processing of PHI, is governed by the applicable written agreements and allocated security responsibilities. Required legal and contractual terms must be in place before a customer uses the platform for regulated information.

Customers remain responsible for their own legal obligations and for managing their users, permissions, devices, workflows, and appropriate use of the platform. This statement supplements, but does not replace, the DME Hubs Privacy Policy or any customer agreement.

8. Assurance and certifications

DME Hubs and HIPAA

DME Hubs maintains a HIPAA compliance program for the platform and operates administrative, technical, and organizational safeguards designed to meet the obligations applicable to DME Hubs when it acts as a business associate. HIPAA compliance is an ongoing, shared responsibility and depends on applicable written agreements, appropriate customer configuration and use, workforce practices, and continued risk management.

HIPAA is a federal legal framework, not a product-certification program. The U.S. Department of Health and Human Services does not certify or endorse private HIPAA certifications. Customer use of the platform for PHI remains subject to the requirements described in Healthcare data and customer responsibilities above.

Hosting infrastructure

DME Hubs hosts its production infrastructure in the United States with a cloud service provider whose in-scope U.S. infrastructure and data-center services maintain ISO/IEC 27001:2022 certification for information security management, with ISO/IEC 27017 and ISO/IEC 27018 cloud-security and cloud-privacy controls in the provider's published compliance scope. The provider also reports a HIPAA Type 1 attestation for applicable U.S. services.

These certifications and attestations apply to the cloud service provider and the services within its audited scope. They do not certify the DME Hubs application or replace DME Hubs' own safeguards, agreements, risk management, or customer responsibilities.

This statement is a general description of our security and compliance approach, not an independent audit, warranty, or contractual commitment. No safeguard or information system can eliminate every security risk.

9. Report a security concern

To report a suspected vulnerability or security concern involving DME Hubs, email legal@dmehubs.com with the subject “Security report.” Include the affected page or service, a clear description of the issue, steps to reproduce it, the potential impact, and a safe way to contact you.

Do not include PHI, patient records, passwords, credentials, or data belonging to another person. Do not disrupt services, access information without authorization, or take actions that could harm DME Hubs, its customers, or other users. We will review reports and respond as appropriate.