Summary

  • ARIN's record for AS36669 assigns SONIC-MSM-DATACENTER to American Esoteric Laboratories at 1701 Century Center Cove in Memphis, Tennessee. The autonomous system is live, but its registry name is not evidence that AEL sells colocation, owns a purpose-built data centre or operates every network advertised through it.
  • RIPE's routing view showed three IPv4 /24 announcements, 768 addresses, complete visibility among 325 reporting IPv4 peers and three observed adjacent networks on 12 July 2026. It showed no IPv6 announcement. Active routing establishes a real enterprise edge, not usable server capacity, electrical redundancy or disaster recovery.
  • The three routes cross company and location boundaries. 216.30.32.0/24 is registered to AEL in Memphis; 198.186.6.0/23 is registered to Sonic Healthcare USA in Austin and is split between two origin networks; and 204.152.105.0/24 is registered to Clinical Pathology Laboratories in Austin. The common origin ASN therefore appears to serve a wider Sonic group network, but public records do not locate any particular route in a particular building.
  • Most observed paths to all three routes ran immediately through Level 3's AS3356, while some views of the AEL and Sonic Healthcare USA routes ran through AT&T's AS7018 and Verizon-related AS701 also appeared as an observed neighbour. Different carrier names do not prove separate fibre entrances, separate metropolitan ducts, independent routers or customer failover.
  • AEL is a medical laboratory network, not a publicly documented colocation vendor. Its digital dependencies can affect electronic test orders, result delivery, critical-value notifications, courier coordination and laboratory operations. Public evidence does not state generator runtime, fuel contracts, battery autonomy, cooling redundancy, fire compartmentation, recovery-point objectives or a tested alternate site. The defensible rating is therefore active network, unverified physical resilience.

The data-centre claim is a network label, not a product sheet

The strongest reason to take this entity seriously is also the easiest fact to overread. The ARIN autonomous-system registration gives AS36669 the name SONIC-MSM-DATACENTER, assigns it to American Esoteric Laboratories and lists the Memphis address used by AEL's core laboratory. The record was created on 28 June 2011. It was last updated in March 2012, while its technical and abuse contact uses a sonichealthcareusa.com address. That is solid evidence of an assigned network identity and a group-level technical contact. It does not disclose a building topology.

There is no public catalogue of cabinets, cages, cross-connects, remote hands, metered power or leased servers under this entity's name. AEL's visible business is clinical and esoteric testing. Sonic Healthcare's United States division map identifies AEL as its Mid-South laboratory division and places the main operation at 1701 Century Center Cove. The Sonic Reference Laboratory location directory repeats the same address for American Esoteric Laboratories. A third-party integration partner, CareCloud, describes a Memphis core laboratory, other testing locations and electronic ordering and result reporting. None markets data-centre capacity.

The word DATACENTER in an AS name is still useful. It tells buyers and network operators how the registrant chose to describe the network when it sought the number. In combination with live routes, it points to an enterprise computing estate important enough to warrant an autonomous routing policy. But names in internet registries can survive restructurings, site moves and changes of function. This one has not been updated since 2012, according to ARIN. It cannot answer whether the equipment sits in an AEL-owned room, a Sonic Healthcare USA site, a wholesale colocation suite, a carrier facility or several locations.

That distinction changes the right question. It is not whether AS36669 exists; it plainly does. It is whether the systems reached through it have the electrical, thermal, physical and carrier design needed for the healthcare services that depend on them. Public routing records can answer reachability and origin. They cannot reveal generator loading, chilled-water reserve, fuel replenishment, battery condition, a common fibre duct or whether a recovery site has enough compute and database capacity to accept production load.

The honest starting position is therefore restrained: AEL operates a visible network named as a data centre, but marketed or registry-described capacity remains unquantified. Anyone assessing it should demand site-specific evidence before translating the name into a resilience claim.

AEL is the registrant, while Sonic owns the wider operating context

The ownership history is clear enough to establish context without collapsing separate companies into one. Sonic Healthcare's 2007 annual report says Sonic acquired 100 per cent of American Esoteric Laboratories on 8 January 2007. At acquisition, AEL had forecast annual revenue of about US$100 million and forecast annual earnings before interest, tax, depreciation and amortisation of about US$19 million. Sonic's corporate history says AEL's Texas operations were merged into Clinical Pathology Laboratories and that Sonic Healthcare USA was established to direct and control the group's United States operations.

The relationship remains current. Sonic Healthcare's 2025 annual report lists American Esoteric Laboratories, Clinical Pathology Laboratories and Sonic Healthcare USA as United States subsidiaries with 100 per cent beneficial ownership. The report also lists a 74.6 per cent interest in the BMHSI/AEL Microbiology Laboratory partnership. Those disclosures establish corporate ownership. They do not assign responsibility for each router, prefix, server room or recovery site.

That qualification matters because three different registrants appear in the address estate now originated by AS36669. AEL is the legal registrant for one route. Sonic Healthcare USA is the registrant for another allocation. Clinical Pathology Laboratories is the registrant for the third. A shared parent and a shared technical team could rationally use one ASN to carry several businesses. Equally, each prefix could terminate at a different site under a common routing policy. The public records do not state which arrangement applies.

The entity boundary should remain precise. AS36669 is registered to American Esoteric Laboratories, and that is the subject under review. Sonic Healthcare's ownership and the presence of sister-company resources explain why the route set extends beyond the AEL address. They do not turn every Sonic laboratory, building or service into an AEL asset. Nor does a shared origin number prove that AEL owns the equipment serving the Austin-registered ranges.

This is more than legal tidiness. In an outage, the party that owns a server may differ from the party that owns the address block, contracts with the carrier, manages the border router, operates the laboratory application or has authority to invoke disaster recovery. A useful resilience account identifies those handoffs. Public information here identifies the companies but not the operational assignment between them.

Three live prefixes show an enterprise network spread across organisational lines

At the 12 July observation point, RIPE's announced-prefixes response listed 198.186.6.0/24, 216.30.32.0/24 and 204.152.105.0/24. Each contains 256 IPv4 addresses, making 768 announced addresses in total. RIPE's routing-status response reported that the ASN was visible to all 325 reporting IPv4 peers and had three observed neighbours. These are strong signs of an operating network. They are not dormant registrations.

The AEL-specific block is 216.30.32.0/24. Its ARIN registration names American Esoteric Laboratories, repeats the 1701 Century Center Cove address and records an active allocation made in September 2011. RIPE's prefix status showed AS36669 as origin, with 324 of 325 peers seeing the route. A less-specific 216.30.0.0/17 was also visible from Verizon Business's AS2828. The AEL /24 is therefore a more-specific route inside a carrier allocation. Continued reachability depends on the more-specific announcement remaining accepted and propagated.

The Sonic Healthcare USA resource is larger. The ARIN record covering 198.186.6.0/23 names the allocation SONIC-HEALTHCARE-USA-DATA-CENTERS, registers it to Sonic Healthcare USA at an Austin address and covers 512 addresses from 198.186.6.0 to 198.186.7.255. Yet the /23 is not currently announced as one route. RIPE's status for the allocation showed two more-specifics: 198.186.6.0/24 from AS36669 and 198.186.7.0/24 from AS29875, the ASN registered as CPLSW-AS to Clinical Pathology Laboratories.

That split is revealing but not locational. It shows that the allocation is divided between two routing authorities within the wider Sonic environment. It could reflect separate sites, separate applications, a migration boundary or an administrative choice. It does not establish two active data centres. Nor does it establish that either half can take over the other's workload. Prefix diversity and compute failover are different things.

The third AS36669 route, 204.152.105.0/24, is a direct allocation registered to Clinical Pathology Laboratories at 9200 Wall Street in Austin. Its name, SWCAUSPUBNET, also points toward the Austin operation rather than Memphis. RIPE's routing history shows that AS29875 originated the prefix for years and AS36669 began appearing as origin in May 2026. By 12 July, the current status showed AS36669 as the origin at every reporting peer.

That recent change is a meaningful operational signal. It suggests active network consolidation or a routing migration, not an abandoned ASN. It cannot prove that servers moved. An origin change can be made while workloads remain in place, with transport carrying traffic to the same facility. Conversely, a physical move can occur without changing a public origin. The route tells the world which ASN is presenting reachability, not where the endpoint is powered.

The result is an enterprise network with real breadth but ambiguous geography. Three public routes now share one origin. Their registrations point to AEL in Memphis, Sonic Healthcare USA in Austin and Clinical Pathology Laboratories in Austin. The network is demonstrably useful across group operations. The evidence does not justify describing all 768 addresses as installed capacity in a Memphis facility.

Multiple upstream names are not proof of diverse fibre

RIPE's neighbour view identified AS3356, AS701 and AS7018 as networks immediately to the left of AS36669 in observed paths. RIPE identifies AS3356 as Level 3 Parent, AS701 as Verizon Business and AS7018 as AT&T Enterprises. An independent commercial view from IPinfo also lists Level 3 and Verizon as upstreams. On its face, this is better than a single visible carrier relationship.

The distribution of paths is uneven. In the RIPE collector view, the overwhelming majority of routes to the three prefixes arrived through AS3356. A smaller group reached the AEL and Sonic Healthcare USA /24s through AS7018. The recently migrated Clinical Pathology Laboratories prefix appeared through AS3356 in the observed routes. The neighbour count therefore should not be converted into a claim that every prefix has three equivalent paths.

BGP can show logical adjacency. It cannot show whether circuits enter a building on different sides, use independent local fibre providers, avoid a common manhole, terminate on separate routers or receive power from different distribution boards. Two national carrier contracts can share the same local access supplier. Two fibre pairs can occupy one conduit. Separate routers can sit in one rack under one cooling unit. A route that looks diverse at internet scale may converge within the last kilometre.

The reverse is also possible: a company can have physically diverse circuits while public collectors prefer one path and expose little of the backup. That is why the route view should be treated as a useful test target rather than a full topology. To prove physical carrier resilience, AEL would need current circuit identifiers, carrier letters, entrance drawings, demarcation photographs, optical-path diversity statements and a witnessed failover result. Those materials need not be published to the world, but they should be available under confidentiality to a serious customer or clinical partner.

The absence of a PeeringDB network record for AS36669 adds no evidence of exchange-point or facility presence. PeeringDB is voluntary, so absence is not evidence of no interconnection. It means there is no public, operator-maintained listing there to settle the facility or peering question. CAIDA's AS Rank record sees the ASN and reports three providers but no customers or peers. That is consistent with an enterprise edge buying connectivity, not a network selling transit.

The most defensible network description is therefore multihomed in public topology, with a strongly preferred or most widely propagated Level 3 path and additional observed carrier adjacency for some routes. Whether that design survives a common local cut remains unproved.

IPv4 reachability is established; IPv6 resilience is not

AS36669's current visibility is entirely IPv4. RIPE's routing status reported three IPv4 prefixes and no IPv6 prefixes. The same response showed complete IPv4 visibility and zero IPv6 visibility. IPinfo's AS record likewise reports no known IPv6 addresses for the network.

This does not mean AEL or Sonic lacks IPv6 in every environment. Private networks, provider-assigned space and cloud services may use it without appearing under AS36669. It does mean the entity has no publicly observable IPv6 origin under this ASN at the measured time. A customer cannot infer dual-stack service or an IPv6 recovery path from the autonomous-system record.

The limitation matters because protocol diversity is increasingly part of service continuity. If a service is available only over IPv4 on this edge, an IPv4 route fault, address-control problem or filtering error has no equivalent public path under IPv6. If a separate cloud front end offers dual-stack access, that may provide another route to a specific application, but it does not make the AS36669 estate dual-stack. Each service has to be tested at the hostname and application level.

Route-origin authorisation is another gap. RIPE's validator returned unknown for AS36669 with 198.186.6.0/24, for AS36669 with 216.30.32.0/24, and for AS36669 with 204.152.105.0/24. In each case it found no validating route-origin authorisation.

Unknown is not invalid. It does not suggest that the announcements are hijacked. It means the cryptographic system does not provide a positive statement that AS36669 is authorised to originate those exact prefixes. The distinction is set out in RFC 6811, which defines BGP prefix-origin validation. For an ASN combining resources registered to several group companies, valid authorisations would clarify intended origins and reduce ambiguity during future migrations.

Good routing operation also requires filters, session protection, prefix limits and rehearsed changes. RFC 7454 describes widely accepted BGP operational and security practices. Public collectors can show the outcome of route propagation, but not the configuration discipline behind it. A credible review would ask who maintains filters, who can make an emergency announcement, how changes are approved and whether all three routes can shift to a working alternate path without creating a loop, leak or prolonged withdrawal.

The public website now follows an AWS route, not AS36669

The most visible AEL services no longer provide a simple test of the named network. A public DNS response for www.ael.com points through a sonichealthcare.com name to an awsglobalaccelerator.com hostname and the two IPv4 addresses 13.248.133.166 and 76.223.5.243. www.sonichealthcareusa.com resolves through the same pattern. Neither address belongs to an AS36669 prefix.

AWS documentation explains that Global Accelerator provides static IP addresses anycast from the AWS edge network and can send traffic to endpoints in one or more AWS regions. The DNS observation therefore shows that the public web entry point is separated from AS36669. It does not disclose the location of the application endpoint behind the accelerator, and it does not prove that the site uses multiple regions.

This separation can be useful. A cloud edge can remain reachable if an on-premises route fails, and it can direct users to healthy endpoints. It also creates a more complex service chain. The website can be available while a laboratory application, order interface or result feed behind another path is unavailable. A green public homepage does not prove that clinical transactions are moving. Conversely, a failure at the public web edge need not mean that the core laboratory or private integrations have stopped.

The correct availability design therefore monitors business functions rather than one domain. Useful tests include submitting a synthetic order through each approved interface, receiving a non-production result, delivering a critical-value notification, confirming courier dispatch data, resolving relevant DNS records, reaching each AS36669 prefix from several access networks and verifying access to the alternate operating environment. The public evidence gives no results for such end-to-end exercises.

Cloud fronting also makes address counting a poor capacity measure. The two AWS addresses are entry points, not two servers. The 768 AS36669 addresses are routing units, not 768 hosts. A single address can front many services, while a large subnet can be mostly reserved. Installed compute, storage and network throughput require rack inventories, measured utilisation and dependency maps, none of which can be derived from DNS or BGP.

Memphis is an operating anchor, but not a proved fault domain

There is strong evidence that 1701 Century Center Cove is an important AEL location. The ARIN record uses it for the ASN and AEL's /24. Sonic's division map and the Sonic Reference Laboratory directory identify AEL there. AEL's public descriptions call Memphis its core laboratory. The address is therefore more than an arbitrary city label.

What remains unknown is the role of computing equipment at that address. A network registrant's address can be an office or laboratory contact address rather than the room in which border routers sit. A laboratory building may contain a server room without being the only production site. An enterprise can also terminate carrier circuits at a colocation facility and extend private connectivity to the laboratory. No public AEL document reviewed for this assessment states the physical location of AS36669's routers or the systems behind its prefixes.

The Austin registrations make a single-site assumption especially unsafe. The Sonic Healthcare USA /23 is registered at an Austin office. The Clinical Pathology Laboratories /24 is registered at 9200 Wall Street in Austin. Sonic's own location directory identifies Clinical Pathology Laboratories at that address. The common ASN may carry traffic for Memphis and Austin, or a central network team may advertise remotely registered resources from another site. BGP alone cannot choose between those designs.

The right unit of resilience is a named fault domain: a building, utility service, generator plant, cooling loop, carrier entrance and operational team. If AEL relies on Memphis plus an Austin recovery site, the assessment should state which applications run at each, how data is replicated, what the network path is, how much load the alternate can accept and when that capacity was last demonstrated. If the routes all terminate in one shared facility, the assessment should say so and avoid counting company names as geographic diversity.

Public location evidence is therefore enough to prioritise Memphis and Austin for further verification, but not enough to declare either a live or standby data centre. The distinction should remain explicit in customer claims, architecture documents and continuity planning.

Power is the first unverified limit on usable capacity

Every server nameplate sits behind a longer electrical chain: utility service, switchgear, transfer equipment, uninterruptible power supply, distribution units and rack feeds. The usable load is the lowest safe capacity in that chain after redundancy and maintenance reserve are deducted. A room with 500 kilowatts of utility service does not offer 500 kilowatts of continuously usable computing load if cooling, UPS modules or generator capacity constrain it.

Memphis Light, Gas and Water says it delivers electricity across Memphis and Shelby County and describes itself as the country's largest three-service municipal utility on its annual-report page. That establishes the regional utility context, not AEL's circuit design. MLGW's Roadmap to Reliability says trees are a leading cause of outages after storms, that the utility is replacing transformers, poles, underground cable and substation breakers, and that outages had become twice as frequent and three times as long as in 2000 before the current reinvestment. A critical Memphis facility should design around those disclosed system conditions rather than assume uninterrupted grid supply.

No public AEL statement identifies two utility feeds, the substations serving them or whether they are truly independent. Two cables from one substation are not equivalent to independent utility paths. Neither is a second meter on the same feeder. Proof would require single-line diagrams, utility service letters, protection studies and a clear account of common upstream equipment.

Generator claims also need numbers. Runtime depends on actual load, tank volume, fuel quality, maintenance condition and replenishment access. A nominal 48-hour tank may deliver less if load rises or reserve cannot be used. Severe weather can obstruct fuel delivery just when the utility is down. The critical evidence is a full-load test, recent fuel analysis, maintenance history, contracted replenishment priority and a calculation that includes both computing and cooling loads.

Battery autonomy is shorter but equally important. The UPS must carry the load while generators start and transfer, and it must tolerate a failed start or a maintenance state. Battery health degrades with age and temperature. A capacity figure without the last discharge test, module redundancy and bypass arrangement says little about survival during a real event.

The absence of public electrical figures does not prove weak engineering. Healthcare laboratories routinely invest in backup power. It means external readers cannot price the risk. The minimum evidence needed to move beyond that uncertainty is site-specific: utility topology, UPS design, generator count and rating, tested runtime, fuel arrangements, maintenance windows, protected load list and evidence that an alternate site can carry the clinical priority set.

Cooling turns electrical reserve into real server capacity

Electrical continuity without heat removal only delays an outage. Servers convert almost all consumed electricity into heat, and the facility must continuously remove that heat. The US Department of Energy's data-centre cooling guidance notes that computing equipment operates around the clock and requires continuous cooling; it also describes the chain from room air conditioning through chilled and condenser water to cooling towers in facilities that use evaporative systems. Smaller enterprise rooms may use direct-expansion units, but the dependency is the same.

No public record states which design AEL uses. There is no disclosed rack density, air-flow arrangement, chiller or compressor count, redundant cooling capacity, temperature envelope or water dependency. Without those figures, installed electrical service cannot be translated into usable computing load. A server room may have spare rack space but no spare cooling. It may have a second cooling unit that is too small to carry the peak. It may meet normal demand and fail during the hottest day or while one unit is under maintenance.

The Department of Energy's 2024 best-practices guide treats environmental conditions, air management, cooling and electrical systems as connected design choices. That connection is crucial here. A claimed redundant UPS does not create resilience if the control system, chilled-water pump or condenser is single-threaded. A generator does not help if the cooling plant is omitted from the protected load.

Evidence should include measured peak rack inlet temperatures, alarm thresholds, cooling-unit loading, maintenance states and a thermal response test after one cooling component is removed. For liquid-cooled or water-dependent systems, leak detection, water reserve and pump redundancy also matter. For air-cooled rooms, smoke control and the effect of door opening during repairs matter. The test should be conducted at realistic production load, not an empty-room design condition.

Capacity buyers often ask how many racks exist. The better question is how many racks can remain within temperature limits after one credible failure while the day's clinical workload is at peak. That number is usable capacity. Nothing public establishes it for AS36669's facilities.

Fire, water and severe weather can defeat both power and network diversity

Fire risk is not limited to flames touching servers. Smoke, suppression discharge and emergency power isolation can take a room offline. The NFPA 75 standard covers construction, fire detection and protection, utilities, records and recovery for information-technology equipment areas. Public AEL materials do not identify compliance, suppression type, fire compartments or whether network and recovery equipment share one protected zone.

Water can arrive from outside through flooding or from inside through cooling, plumbing or suppression systems. The National Weather Service's Memphis event record documents repeated heavy-rain, flash-flood, winter-weather, tornado and damaging-wind events across the region, including multiple recent events. That regional history makes weather a real planning input. It does not prove that 1701 Century Center Cove lies in a specific flood zone or suffered damage. Parcel-level flood elevation, drainage and equipment-floor placement need separate verification.

Wind and ice can cut utility lines and fibre at the same time. Flooding can restrict generator fuel deliveries. A building evacuation can make otherwise healthy equipment unavailable to technicians. A fire alarm can shut down air handling. These combined failures are why counting components in isolation produces false confidence.

Local permission also matters when capacity is added. The City of Memphis building and zoning portal says building, engineering, fire, electrical, mechanical and planning activity is handled through the Develop 901 system, with searchable permit and inspection records. Shelby County's construction submittal guidance states that mechanical, plumbing and electrical work requires licensed contractors and permits and that project valuation includes permanent systems and equipment. These requirements mean that adding generators, switchgear or substantial cooling is not merely a procurement decision.

No current permit package was found that publicly identifies a data-centre expansion for AEL at the Memphis address. That should not be read as proof that no lawful work occurred: records can be filed under owners, landlords, contractors or different descriptions, and older documents may not be indexed consistently. It means expansion claims should be matched to permit numbers, inspection completion and energisation evidence before they are treated as operating capacity.

Installed equipment is not the same as capacity available during failure

The public IPv4 count is exact: AS36669 announces three /24s. The compute count is not. There is no credible way to convert 768 addresses into servers, virtual machines, storage nodes or laboratory transactions. Network address translation, load balancing, reserved space and private addressing break any simple relationship.

Similarly, the word DATA-CENTERS in the Sonic Healthcare USA allocation name does not reveal square footage, power or geographic count. Plural wording can describe an intended estate rather than a certified set of independent facilities. The split /23 shows two current origins, but route origins are not availability zones.

Installed capacity is the equipment physically present: servers, storage, network ports, UPS modules and cooling units. Sellable or operational capacity is what remains after deducting resilience reserve, maintenance headroom, failed components, growth commitments and recovery obligations. If an alternate site is expected to absorb Memphis workloads, its spare compute, storage write capacity, database licences, carrier bandwidth and staff availability must remain uncommitted.

Healthcare demand also has peaks. A microbiology laboratory can face surges from outbreaks, hospital demand or weather-delayed specimen arrivals. Sonic's 2018 corporate responsibility report describes AEL's Memphis partnership with Baptist Memorial Healthcare and a centralised microbiology laboratory using automation and mass spectrometry. That account shows why computing and connectivity matter to clinical turnaround, but it supplies no data-centre capacity figures.

A useful capacity statement would therefore separate normal utilisation, single-failure utilisation and recovery-site utilisation. It would give measured processor, memory, storage, database and network headroom; identify the protected clinical applications; and state the duration for which the alternate environment can operate. Public information supplies none of these measures. Any claim beyond “three live IPv4 routes” would be assumption.

The failure tree reaches clinicians, patients and specimen logistics

AEL's business makes the consequence of infrastructure failure different from an ordinary corporate website outage. The Sonic Reference Laboratory directory describes specialised testing across analytical chemistry, molecular testing, haematology, immunology and clinical chemistry. CareCloud's AEL integration description says AEL uses information systems to automate electronic test ordering and result reporting. A Tennessee public-sector proposal preserved by Johnson City Schools describes courier service, electronic or faxed stat results and time-sensitive specimen handling.

Those services create several distinct outage paths. If the internet edge fails, electronic orders may not arrive and results may not reach clinicians. If the laboratory information system fails while the network remains up, instruments can continue producing data that cannot be matched, validated or released normally. If a courier system fails, specimens may arrive late or lose viability. If identity or interface services fail, hospital systems may be unable to authenticate or exchange messages. If storage is impaired, historical results and pending work may become unavailable even while the public site responds.

Patients are affected indirectly but materially. A delayed routine result can postpone follow-up. A delayed critical result can postpone treatment. Laboratories can use phone, fax, paper requisitions and manual accessioning for some functions, but those alternatives have limited throughput and create reconciliation work. The duration for which manual operation remains safe is therefore part of capacity planning.

The network's multi-company reach may widen the impact. The presence of Sonic Healthcare USA and Clinical Pathology Laboratories resources under AS36669 suggests that a routing fault could affect more than one business surface, although the public record does not show which applications use each prefix. A shared edge creates efficiency and central control; it can also create correlated failure if configuration or carrier dependencies are shared.

This is why an outage account must identify the service, not only the prefix. A route withdrawal can be harmless if no production service uses that range. A single database failure can be severe while every route remains visible. Business-impact testing should connect each clinical function to its DNS, network, application, storage, identity, facility and staffing dependencies.

Recovery evidence has to show work moving, not lights staying on

US health-information rules make continuity more than an engineering preference. The Department of Health and Human Services' Security Rule summary says regulated organisations must establish plans for backing up electronic protected health information, restoring lost data and continuing critical business functions while operating in emergency mode. HHS's audit protocol asks for restore-test evidence, documented results, management review and corrective action.

Those expectations do not prove AEL's regulatory status for every system, nor do they reveal its compliance. They define the evidence quality that a healthcare infrastructure assessment should seek. A backup job marked successful is not enough. The organisation must demonstrate that data can be restored within a clinically tolerable period, that interfaces reconnect, that users can authenticate and that pending transactions reconcile correctly.

HHS's ransomware guidance also links backups, disaster recovery, emergency operation, application criticality and periodic testing. Those controls apply to physical incidents as well as malicious ones. A fire or flood can remove both production systems and online backups if they share a site. A carrier cut can isolate a healthy backup. A power failure can expose an untested generator-cooling dependency.

NIST's contingency-planning guidance recommends identifying recovery priorities and using alternate equipment, alternate operating methods or alternate locations according to business impact. For AEL, a meaningful exercise would begin with a declared loss of the primary site and continue until a complete clinical transaction has passed through the alternate environment. It would measure data loss, time to service, manual backlog, staff callout, carrier changes and return to normal operation.

Carrier failover should be tested separately from site failover. The network team should withdraw or disable each primary path under controlled conditions, confirm that all intended prefixes remain reachable, observe path convergence and verify application performance. A route test that leaves the same local duct, power board and border router in service does not prove facility independence. A site test that uses the same upstream control plane does not prove network independence.

Maintenance is another form of planned failure. Uptime Institute's explanation of its Tier system distinguishes redundant components from concurrent maintainability and fault tolerance. AEL makes no public Tier claim, and none should be inferred. The conceptual distinction is useful: owning a spare cooling unit is different from being able to isolate and service every component without interrupting computing. Evidence should show what happened during actual maintenance windows, not only what drawings predict.

Public information provides no customer-level recovery result for AS36669. That is the largest remaining gap. Current route visibility shows that normal operation works. It says nothing about the moment normal operation stops.

What would turn the claim into defensible capacity

The first requirement is a bounded statement of service. AEL should identify whether AS36669 supports corporate systems, laboratory applications, partner interfaces, public services or a combination. It should name the accountable operator for each prefix and state whether the network is offered to outside customers or exists solely for the Sonic group. Without that boundary, “data centre” invites assumptions the evidence cannot support.

The second requirement is a facility schedule. For each production and recovery location, it should identify the city, operator, ownership or lease boundary, protected applications, rack footprint and the fault domains shared with other locations. Sensitive floor plans need not be public. Customers can receive appropriately redacted diagrams and independent assurance reports.

The third is measured physical capacity. That means usable utility and generator power after reserve; UPS topology and battery autonomy; cooling capacity after the largest credible component failure; rack-level utilisation; storage performance; carrier port utilisation; and the spare compute and database capacity at the alternate site. Design ratings should be separated from commissioned and currently available capacity.

The fourth is diversity evidence. Carrier contracts should be matched to physical entrances and metropolitan routes. Utility feeds should be traced to substations. Recovery replication should avoid the same carrier, conduit and control dependency where feasible. Route-origin authorisations should be created and maintained for the intended prefixes, with migration plans for the resources registered to related companies.

The fifth is exercise history. A buyer should see the date, scope, load and result of generator tests, battery tests, cooling failover, carrier withdrawal, backup restoration, application recovery and full site transfer. Exceptions and corrective actions are more informative than a perfect score with no detail. The crucial measure is whether clinicians received accurate results and whether no specimen or order was lost during the test.

Finally, claims should be time-bounded. The AS36669 registration dates from 2011 and was last updated in 2012, while one route changed origin in 2026. Infrastructure changes faster than corporate names. Evidence older than the current electrical, cooling or network configuration should not be used to support present capacity.

Verdict: the network is real, the physical resilience remains unproved

AS36669 is not an empty shell. It is active, globally visible and currently originates three IPv4 routes. One route is registered directly to American Esoteric Laboratories in Memphis. The public topology shows more than one large carrier adjacent to the ASN, and the recent migration of a Clinical Pathology Laboratories prefix into AS36669 indicates continuing network administration. These facts support a real enterprise operating surface.

The evidence stops well before the headline implied by SONIC-MSM-DATACENTER. There is no public specification for power, cooling, fire protection, rack load, generator endurance, carrier entrances, maintenance reserve or site failover. No public material establishes that AEL sells third-party data-centre capacity. The address estate spans AEL, Sonic Healthcare USA and Clinical Pathology Laboratories, while the public AEL website now enters through AWS rather than AS36669. Network identity, company ownership, service delivery and facility operation are therefore related but distinct layers.

For healthcare partners, the prudent position is not to dismiss the network but to downgrade unverified resilience. Treat normal IPv4 reachability as demonstrated. Treat IPv6, route-origin validation, physical path diversity, dual utility supply, cooling redundancy and recovery-site capacity as unresolved until current site-specific evidence is produced. The most important proof is not another carrier logo or a larger address count. It is a witnessed failure exercise in which power, cooling or a carrier path is removed and clinically important work continues within a declared recovery objective.

Until that proof exists, SONIC-MSM-DATACENTER - AMERICAN ESOTERIC LABORATORIES should be described as an active healthcare-enterprise network with unquantified data-centre capacity and weak public evidence of physical resilience. That conclusion is less dramatic than the registry name, but it is the one the available facts support.