AOR ONE™ CARE AUTHORITY™
This page describes the actual security and governance posture of AOR ONE™ CARE AUTHORITY™, including what is implemented today and what remains pending before production use with real data.
AOR Medical Solutions does not claim HIPAA certification, SOC 2, HITRUST or ISO certification for this platform. No such certification is asserted, implied or evidenced here. Organizations must perform their own security and compliance review before production use.
Multi-tenant isolation (RLS)
Enforced at the database layer on operational tables.
13 operational roles
Defined in the data model and enforced server-side.
Append-only audit trail
Actor, role, module, entity and timestamp recorded.
Document access logging
Views and downloads recorded per document.
Controlled account creation
No public self-service registration.
Transport encryption (TLS)
Provided by the hosting platform.
Session expiration & secure sign-out
Configurable inactivity policy per organization.
Multi-factor authentication
Supported by the identity provider; not globally enforced.
Re-authentication for sensitive actions
Not implemented today.
Brute-force / rate limiting
Provided by the identity provider; not independently validated.
Independent penetration test
Not performed.
Executed BAA
Required before any PHI is introduced.
Third-party certification (SOC 2 / HITRUST / ISO)
None held or claimed.
Tenant model
Every operational record belongs to an organization. The organization is the primary boundary for data access.
Ownership
AOR Medical Solutions operates the platform. Each customer organization governs its own users, roles and records.
13 operational roles
Super Admin, Organization Admin, Clinical Director, Provider, Nurse, Care Coordinator, Authorization Specialist, Compliance Officer, Legal Reviewer, DME Coordinator, Executive Viewer, Auditor and Patient/Caregiver.
Least privilege
Roles are stored in a dedicated table, never on the user profile, and are evaluated server-side by a security-definer function.
No client-side elevation
Role assignment is not accepted from client-submitted parameters. Users cannot grant themselves a role.
Database-layer enforcement
Row Level Security policies scope records to the caller's organization. Isolation is not implemented in the frontend.
Verification
Policies exist on operational tables and are re-checked whenever schema changes are applied. Independent penetration testing has not been performed.
Append-only audit log
Access and state-changing actions record actor, role, module, entity and timestamp.
Document access logging
Document views and downloads are recorded separately.
Retention
Audit retention is configurable per organization, with an automated retention job.
Controlled access
Public self-service account creation is disabled. Accounts are created by AOR Super Admin or an authorized organization administrator, or through a reviewed access request.
Password recovery
Recovery is email-based and returns a uniform response so accounts cannot be enumerated.
Session handling
Sessions expire and sign-out clears cached protected data.
Multi-factor authentication
MFA is supported by the underlying identity provider and can be enforced per organization policy. It is NOT globally enforced today and must be configured and validated before production use with real data.
Transport encryption
All traffic is served over TLS by the hosting platform.
Storage
Documents are stored in a private bucket with access mediated by policy; direct public URLs are not issued.
PHI redaction
An AI-assisted redaction step can mask identifiers in transcribed documents. Output requires human verification.
Demonstration data
The demonstration environment contains synthetic data only.
Labelled output
AI-generated content is identified as such in the interface.
Mandatory human review
No AI output is submitted, transmitted or acted upon without approval by an authorized user.
Boundaries
AI does not make coverage determinations, does not provide legal advice and does not substitute clinical judgment.
Status transparency
Every integration is published with its real status: active, configured, available, planned or not enabled in demo.
No frontend credentials
Provider credentials are never present in browser code.
Synthetic only
All patient and operational data shown is synthetic. Real clinical data must not be loaded.
Persistent notice
The demonstration banner remains visible across the platform.
Before real data
Execute a BAA, enforce MFA, define responsibilities, complete a risk assessment, validate isolation, configure retention and authorize production use in writing.
Cut-over control
An administrative cut-over process exists to separate demonstration records from production records.
Reporting channel
Security findings can be reported through the responsible disclosure page. Do not include PHI, patient records, credentials or confidential information in a report.
No stated SLA
AOR Medical Solutions does not publish an investigation or response time commitment at this stage.
Nothing below is presented as active unless it is. No credentials are held in the frontend, and no external transmission of sensitive information occurs without human approval.
Email (notify.aormedicalsolutions.com)
Transactional and authentication email sending from a verified sending domain.
AI Copilot (managed AI gateway)
Drafting, summarization and OCR assistance under mandatory human review.
Document storage & vault
Private, access-logged document storage inside the platform.
Analytics & operational metrics
Internal KPI snapshots and historical trend computation.
EHR / FHIR
Clinical system exchange with covered entities.
Payer portals
Direct submission and status retrieval from plan portals.
Fax gateway
Outbound fax delivery for payer submissions.
SMS notifications
Outbound SMS for coordination reminders.
DME supplier tracking
Supplier order-status exchange.
Shipping carriers
Carrier tracking for delivery confirmation.
AOR HealIQ™ interoperability
Referencing wound intelligence from AOR HealIQ™ inside CARE AUTHORITY case files.
External document management systems
Bidirectional exchange with third-party DMS.
This platform supports care coordination and administrative decision-making. It does not replace the independent clinical judgment of a qualified healthcare professional.
This platform provides documentation and compliance support and does not constitute legal advice.
AI-generated content may contain errors and must be reviewed by authorized personnel before use.
All patient and operational information displayed in the demonstration environment is synthetic.