Managed Services and Security Engineering for ProSomnus

Challenge.

ProSomnus is a medical device company whose digital platform includes the Oxymetrx Patient App and Provider Portal. The platform sits in software-of-medical-device territory, where FDA expectations and cybersecurity controls layer on top of normal cloud operations. The internal team is small and concentrated on the device and the apps.

That left thin coverage for 24x7 cloud operations, formal cybersecurity policy, periodic penetration testing, and regulatory submission engineering. The audit and submission cadence kept rising as the platform evolved. The downside on any HIPAA or FDA finding, or on a security incident, was disproportionately high relative to the engineering capacity ProSomnus could realistically dedicate to prevention.

Solution.

BUILDSTR established a multi-stream relationship under one MSA, with four engagement types running over multiple years. A Managed Services SOW covered 24x7 monitoring, patching, incident response, and continuous operations of the AWS environment, with periodic engineering uplifts. A cybersecurity risk assessment of the Oxymetrx Patient App and Provider Portal was delivered against FDA and HIPAA expectations, paired with a drafted cybersecurity policy and procedure.

A penetration testing engagement was co-delivered with NuVista, producing a vulnerability and penetration test report against the Patient App and Provider Portal. A 510(k) Submission Assistance SOW added engineering and documentation support for the FDA regulatory submission. Tactical engineering landed in flight as needed. Most recently, a major-version Amazon RDS for MySQL upgrade was scheduled across the production database fleet using AWS Blue/Green Deployments, ahead of an end-of-support milestone.

Results.

• Managed Services SOW renewed with no gap in coverage, sustaining a multi-year continuous-operations relationship.

• Risk assessment, cybersecurity policy and procedure, and penetration test report delivered as a coordinated package, giving FDA and HIPAA reviewers the artifacts they expect.

• 510(k) submission engineering support active, on the path to FDA filing.

• Major-version RDS MySQL upgrade scheduled via Blue/Green Deployments ahead of the end-of-support milestone.

• Internal team freed to focus on the device and the apps rather than the platform underneath.