Patient portal assessment
Multi-role testing across patient, proxy and clinician accounts, with cross-access attempted between them.
Industries · Healthcare
Security testing that cannot interrupt patient care
Patient portals, scheduling systems, clinical APIs, payer integrations: all of it holds data that carries a lifetime of consequence if it leaks, and much of it runs on systems that cannot be taken offline for a test.
AIPTx tests inside a scope you define, with destructive actions off by default and a request rate you control.
01
Industry overview
Healthcare has the hardest security operating constraint of any sector: the systems cannot stop.
A retailer can take a checkout offline for twenty minutes. A hospital cannot take the electronic health record offline at all, and the practical consequence is that a great deal of clinical infrastructure is tested rarely, patched slowly, and assessed with extreme caution when it is assessed at all.
Around that core sits a fast-moving perimeter that behaves nothing like it.
Patient portals, telehealth platforms, appointment booking, prescription refill, payer eligibility APIs, and a growing tier of digital health services built by teams that ship weekly. Two organisations, one network.
The data at the centre is also uniquely durable. A payment card is reissued in days. A diagnosis, a genetic marker or a mental health record is permanent, which is why healthcare records retain value long after other stolen data has expired.
02
Security challenges
- R01
Availability outranks everything
Any testing approach that carries a plausible risk of disruption will be refused, correctly. This is the constraint every other decision follows from.
- R02
Legacy clinical systems that cannot be changed
Software validated for clinical use, sometimes running on operating systems past support, where modification may require revalidation. The vulnerability is understood and the fix is not straightforward.
- R03
A patient portal is a full application
Authentication, record access, document handling, messaging, payments, proxy access for a parent or carer. Every access-control pattern that causes trouble elsewhere exists here, over data with the highest sensitivity.
- R04
Proxy and delegated access
Parents accessing a child's record, carers accessing a dependant's, clinicians accessing by care relationship rather than by static role. This is an authorisation model far more complex than most applications carry, and complexity is where authorisation fails.
- R05
Integration surface
Payer eligibility checks, laboratory results, pharmacy systems, referral networks, health information exchanges. Data crosses organisational boundaries constantly, and each crossing is a trust relationship.
- R06
Flat internal networks
Many clinical environments were built for reliability and reachability rather than segmentation. A foothold on a workstation reaches further than it should.
- R07
Small teams, large estates
Health system security teams are typically small relative to the surface they own, and the surface grows with every acquired practice and every new digital service.
03
How AIPTx helps
- Stage 1
Safety is the configuration, not a promise
Destructive actions are disabled by default. The agent will not delete data, run denial-of-service payloads or exhaust resources. Every run is bound by a request rate you set, and out-of-scope paths are declared and respected. Exploitation demonstrates access (retrieving one record, reading a token) rather than causing damage.
For clinical environments, the practical pattern is to test the patient-facing and integration tiers directly, run perimeter-limited checks against clinical infrastructure, and use a pre-production copy where one exists.
- Stage 2
Authorisation tested across real roles
Web Application SecurityConfigure patient, proxy, clinician, scheduler and administrator, and the agent cross-tests them. A proxy account reaching a record outside its delegation, or a clinician role reaching a patient outside their care relationship, is only detectable when a tool holds both sessions and compares what each can reach.
- Stage 3
Sensitive data detection in responses
Findings include sensitive values returned where they should not be (identifiers, tokens, personal data), plus PII detection and verbose error monitoring. An endpoint that behaves correctly but returns more than it should is a disclosure, and it is easy to miss when only status codes are checked.
- Stage 4
HIPAA control mapping
Findings map to HIPAA alongside SOC 2, ISO 27001, GDPR, NIST and CIS, with control assessment and gap analysis in the reports. For organisations that also handle payment, PCI DSS mapping is included.
- Stage 5
Internal assessment without external exposure
The AIPTx agent deploys via Docker with outbound connectivity only, covering internal ranges: port and service detection, version detection, CVE matching, TLS posture and default credentials. On a flat clinical network this is usually the first honest inventory the team has had.
- Stage 6
Evidence a small team can act on
Every confirmed finding carries the exact request, the response proving it worked, and a reproducible curl command, plus remediation guidance with vulnerable and secure code examples. Where a team is small, the cost of triage is the binding constraint, and evidence is what removes it.
04Features & Solutions
Relevant features and solutions
Multi-role authenticated testing: patient, proxy, clinician, administrator
Bearer, basic, cookie, custom header and OAuth2/OIDC, with scripted login support and sessions maintained across the run.
Access control coverage: IDOR, horizontal and vertical privilege escalation, cross-role comparison
The class that matters most for record access.
API testing: REST via OpenAPI or Swagger, GraphQL with introspection, gRPC with proto files
Imported from a spec where one exists and discovered from live traffic and client bundles where it does not, which is how an integration endpoint nobody has documented since the vendor built it gets tested at all.
API SecuritySensitive data and PII detection in responses, including verbose error monitoring
Records leak most often in passing: an identifier in an error page, a patient quoted back in a stack trace, a field returned to a role that should never have been able to request it.
Internal network assessment via Docker agent across IP ranges and CIDR blocks
Deployed inside the network with outbound connectivity only, so no inbound rule is opened for it. Port, service and version detection, CVE matching, TLS posture and default credentials across the ranges you declare.
Session security: fixation with regeneration verification, timeout validation, and JWT checks covering algorithm_none, weak secrets, expired tokens and missing claims
A session that survives a logout on a shared clinical workstation is an access control problem long before it is a session problem, and it is the one a busy ward reproduces daily.
Compliance evidence: control mapping and gap analysis for HIPAA, PCI DSS, SOC 2, ISO 27001, GDPR, NIST and CIS, exported as PDF, HTML, JSON, CSV or SARIF
The mapping lands in the same report as the technical detail and the retest history, so the evidence that testing happened and the evidence that something was fixed are one document rather than two exports.
Non-destructive controls: destructive actions off by default, configurable request rate, declared out-of-scope paths, verified scope
The conservative defaults are what make a first assessment schedulable against a live estate, rather than deferred to a maintenance window that never quite arrives.
05
Benefits
- Testing that clinical operations will approve
- Non-destructive defaults and rate limiting are the difference between a security programme that gets sign-off and one that stays theoretical.
- HIPAA evidence generated, not assembled
- Control mapping and gap analysis come out of the assessment rather than out of a spreadsheet exercise before an audit.
- The authorisation model actually gets tested
- Proxy access and care-relationship access are the two patterns most likely to fail and least likely to have been tested, because testing them requires holding multiple sessions.
- A small team gets leverage
- Validation removes triage. That matters more in healthcare than almost anywhere, because the team is small and the estate is not.
- Visibility on a flat network
- Agent-based internal assessment surfaces what a foothold would reach, which is the question segmentation projects are usually justified on.
- Coverage that keeps pace with digital health
- The patient-facing tier ships fast; testing can run on the same cadence rather than waiting for the annual cycle.
06
Use cases
Telehealth platform pre-launch
Full assessment of a new service before it carries clinical traffic.
Payer or laboratory integration review
Testing the API surface exposed to an external partner before the connection is enabled.
HIPAA audit preparation
A Deep assessment with control mapping and retest history attached to the evidence pack.
Internal network baseline
Agent-based assessment of a clinical network to establish what is actually running and what a foothold would reach.
Acquired practice onboarding
Assessing an acquired practice's systems before they are connected to the main estate.
FAQs
Is there any risk to clinical systems?
Destructive actions are disabled by default, the agent respects a request rate you configure, and out-of-scope paths are declared and honoured. Exploitation demonstrates access rather than causing damage. Most health systems test patient-facing and integration tiers directly and run perimeter-limited checks against clinical infrastructure.
Does it help with HIPAA?
Findings map to HIPAA controls with control assessment and gap analysis included in reports. That produces evidence of technical testing and remediation, which supports a HIPAA programme rather than constituting compliance with it. Compliance is broader than technical controls and no testing tool delivers it on its own.
Can you test our legacy clinical systems?
Network-layer assessment via the internal agent covers hosts and services regardless of application age: port and service detection, version detection, CVE matching, TLS posture and default credentials. Application-layer testing depends on what the system exposes over HTTP. Where a system cannot be modified, the value is usually in knowing precisely what the exposure is so that compensating controls can be placed accurately.
How do you test proxy and delegated access?
By configuring accounts with the relevant relationships and attempting cross-access between them. A proxy reaching a record outside its delegation is an authorisation failure that only appears when both sessions are held and compared.
How long does an assessment take?
It depends on the depth you choose. A Quick Scan runs in 15 to 30 minutes and is built for a pipeline gate, a Standard assessment runs in 1 to 4 hours and is the working depth for authenticated coverage, and a Deep assessment runs from 4 to 24 hours because chained exploitation is sequential and cannot be compressed. Request rate is configurable independently of depth, so a long run against a live estate can be made a slow one.
What about medical devices?
Network-connected devices appear in internal network assessment as hosts and services. Device firmware and embedded protocol testing is not a documented capability, and device software frequently sits under regulatory constraints that limit what any testing tool should touch.
The engine behind it
Test the portal, protect the ward
Scope-bound, non-destructive assessment with HIPAA control mapping and evidence on every finding.
Destructive actions off by default · Scope verified before any test runs
Security testing for other sectors
Same engine, different threat model, different auditor. Each page covers the systems, regulations and attack paths that sector actually lives with.
Financial Services
Payment flows, lending decisions, account servicing, open banking APIs — the logic that handles money is the logic attackers study hardest. It is also the logic no signature database describes.
ExploreGovernment
Benefits portals, licensing systems, tax filing, records access — services that must be open to everyone by design, running on estates that were often built decades apart and connected later.
ExploreManufacturing
Almost nobody breaks into a plant by attacking a controller. They arrive through a corporate account, a supplier portal, an ERP integration or an exposed remote access service, and then walk into a network that was designed for reliability, not for containment.
ExploreRetail
The vulnerabilities that cost retailers money are rarely exotic. A discount that stacks when it should not. A price accepted from the client. A gift card balance that survives a concurrent request. A loyalty account reachable from another customer's session.
ExploreSaaS
Every enterprise deal arrives with a questionnaire, a SOC 2 request and someone technical asking when you last tested. Meanwhile you ship on Tuesday and again on Thursday, and the last pentest describes a product that has since changed twice.
ExploreTelecom
A single authorisation flaw in a subscriber portal is not one exposed account. At operator scale it is a data set — and the same flaw in a provisioning API is an operational one.
ExploreEducation
A department stood up a project site in 2019. A research group runs its own server. A faculty subdomain points at infrastructure that was decommissioned two years ago. None of it went through central IT, and all of it is reachable.
ExploreLegal
Clients do not retain a firm because of its document management system. They retain it on the assumption that what they share stays privileged — and increasingly they audit that assumption before instructing.
Explore