HIPAA-ready security testing for a patient platform that cannot go offline

The platform serves clinicians in real time, which rules out the usual security testing shortcuts. Nothing can be taken down for a maintenance window, nothing can write to a patient record, and nothing can move protected health information into a testing tool.

• No safe window to test in

  Traffic never drops below a floor that matters. A scan that saturates an endpoint at 3am is still a clinician waiting for a chart. Previous vendors either ran too gently to find anything or too hard to be allowed back.

• Testing tools became a compliance problem of their own

  Any tool that captured request bodies captured PHI, which pulled the security scanner itself into HIPAA scope, complete with a BAA, retention rules and its own audit trail.

• Audit documentation consumed the security team

  HIPAA Security Rule evidence, SOC 2 Type II and customer security questionnaires drew on the same underlying testing, but each wanted it in a different shape. Producing all three was weeks of formatting.

• FHIR APIs were largely untested

  Standards-based healthcare APIs expose broad query surfaces by design. Authorisation on those queries is application logic, and application logic was the part no scanner was checking.

Scan profiles were built around the clinical constraints rather than against them: strict rate limits, non-destructive exploitation only, and PHI redaction before anything leaves the target environment.

1. 1

   Clinical-safe scan profile

   Always on

   Concurrency capped per endpoint, exponential backoff on any latency increase, and an automatic stop if error rates cross a threshold. Destructive test classes are disabled outright rather than merely discouraged.

2. 2

   PHI redaction at capture

   Every finding

   Request and response evidence is redacted in the target environment before it is stored, so proof of an authorisation flaw records the identifier that was substituted and the status code returned, never the record that came back.

3. 3

   FHIR and HL7 authorisation testing

   Nightly

   Every FHIR resource type was tested for horizontal and vertical authorisation bypass: patient identifiers swapped across sessions, compartment boundaries probed, and search parameters used to widen queries past the caller's consent scope.

4. 4

   Mobile client and API parity checks

   Per release

   The iOS and Android clients were tested against the same APIs to find endpoints the mobile app used but the web ACL model never covered, a common source of unauthenticated read paths.

5. 5

   Control mapping to HIPAA and SOC 2

   Continuous

   Findings carry both a HIPAA Security Rule reference and a SOC 2 criterion, so the same body of evidence answers the auditor, the customer questionnaire and the internal risk register without being reshaped by hand.

Twelve months of continuous testing, spanning two SOC 2 audit periods and one enterprise customer security review.

0

Minutes of scan-induced downtimeAcross 12 months of continuous testing

200+

Vulnerabilities found and closed31 of them authorisation flaws on FHIR resources

100%

Mapped HIPAA controls evidencedThe technical safeguards in audit scope, mapped finding by finding

3 weeks

Audit preparation time savedPer audit cycle, previously spent on documentation

0

PHI records in testing evidenceRedaction applied before storage, verified by sampling

11 days

Median critical remediationConstrained by clinical release windows, not by triage

• Availability constraints are a scan profile, not a blocker

  The reason healthcare platforms go untested is rarely policy. It is the absence of a testing mode that respects a latency budget. Making that budget explicit turned a hard no into a standing yes.

• Redaction is what keeps the scanner out of scope

  Proving an authorisation bypass does not require keeping the data it returned. Redacting at capture removed the tool from HIPAA scope entirely, which removed the longest conversation in the procurement.

• Standards-based APIs need logic testing most

  FHIR does authorisation correctly at the protocol level and leaves the policy to the implementer. Every one of the 31 authorisation findings was in that gap, and none of them had a CVE.

• Map to frameworks once, report to all of them

  The same finding answered a HIPAA safeguard, a SOC 2 criterion and a customer questionnaire. The saving was not in the testing, it was in never reformatting the evidence again.