REVONWELL
Book a Consultation
A consultant presenting a solution map to hospital leaders

Security, Governance and Interoperability

What REVONWELL holds today, what we plan around, and how each commitment is agreed. Written for hospital IT, security and procurement teams.

Certifications and Assessments

This is REVONWELL's position today, in the company's own name.

FrameworkStatus todayWhat we can provide
HIPAAIndependently assessedAssessment summary available on request, including the assessor and date.
ISO 27001Not currently heldWe can complete your security questionnaire and describe our controls.
SOC 2 Type IINot currently heldWe can complete your security questionnaire and describe our controls.
GDPRNot independently assessedData processing terms are agreed in each contract where GDPR applies.

Interoperability Standards

Our integration work is designed around open standards, so systems can exchange information without being tied to one supplier. The Integration Hub prototype shows these message styles with sample data.

HL7 v2

Admissions, orders, results and other hospital messages between departmental systems.

HL7 FHIR

Modern APIs for patient apps, portals and exchange between organisations.

DICOM

Imaging, working alongside radiology and picture archiving systems.

Regional Health Exchanges

REVONWELL is not yet connected to or approved by these platforms. Members of our team have delivered projects on them at previous companies, and they bring that experience to your project. Connecting a live system requires onboarding with the responsible authority.

PlatformWhereResponsible authorityREVONWELL status
NABIDHDubaiDubai Health AuthorityTeam experience, not yet connected
MalaffiAbu DhabiDepartment of Health, Abu DhabiTeam experience, not yet connected
RiayatiNorthern EmiratesUAE Ministry of Health and PreventionTeam experience, not yet connected
NPHIESSaudi ArabiaCouncil of Health InsuranceTeam experience, not yet connected

What Your IT and Procurement Teams Can Evaluate

REVONWELL products are working prototypes today. These are the terms we propose when one becomes a project for your organisation.

Security

Our proposed baseline for a production deployment. We confirm each control in the contract and evidence it before go-live.

  • Named user accounts with role-based access and multi-factor authentication
  • Encryption of data in transit and at rest
  • Audit logs of who viewed or changed a patient record
  • Separate test and production environments, with no real patient data in test
  • Independent penetration test before go-live
  • Agreed patching schedule and written incident notification terms

Evaluate it through your security questionnaire, the penetration test summary and the audit log design.

Hosting

No production hosting exists yet for the prototypes, so hosting is designed with each customer.

  • Your own data centre, your own cloud tenancy, or a cloud region we agree together
  • Availability targets, backup frequency and recovery objectives written into the contract
  • A documented disaster recovery test before go-live
  • Monitoring and access arrangements agreed with your IT team

Evaluate it through the hosting design, the named cloud provider and region, and the recovery test results.

Data Residency

Patient data stays where your regulator requires. We confirm this with your legal team before design begins.

  • UAE: Federal Law No. 2 of 2019 generally restricts storing or transferring health data outside the country, with limited exceptions
  • Saudi Arabia: the Personal Data Protection Law and sector rules govern transfers abroad
  • United States: HIPAA applies to protected health information
  • European Union: GDPR applies to personal data, including transfers outside the EU
  • Any remote support access is agreed in advance, limited and logged

This is a general summary and not legal advice. Your counsel should confirm what applies to you.

Implementation

Seven stages, from discovery to support, each with named people and clear outputs.

  • Discovery and assessment of current systems and workflows
  • Architecture, integration design and interface list
  • Data migration rehearsals, with clinical sign-off of migrated records
  • Testing with clinicians and a clinical safety review
  • Training before go-live, then staffed support at go-live

Evaluate it through the project plan, the named team and the acceptance criteria for each stage.

Support

Support terms are written down before you sign, and they follow the scope of your deployment.

  • Support hours, severity levels, response targets and escalation path in a service level agreement
  • A named contact for your IT team
  • Knowledge transfer to your own staff
  • Release and maintenance schedule agreed in advance
  • An exit plan, including how your data is returned at the end of the contract

Ask us for a draft service level agreement for your scope.

Send Us Your Security Questionnaire.

Tell us what your review needs, and we will reply with what we can provide.

Please do not include patient information.