HIPAA testing for healthcare software
We test your software against the technical safeguards of the HIPAA Security Rule: who can open which patient record, what gets logged, how people sign in, how data moves. Your auditor gets evidence, not a promise.
Book a 30-minute call
Six places patient data leaks in real products
Each check maps to a safeguard in 45 CFR 164.312, so the result reads the way an auditor asks the question.
Access control
Every role against every record and action. Can a view-only user edit? Can a staff member open any patient by changing the URL? Can one clinic reach another clinic's patients?
evidence: role-by-action matrix with pass or failAudit controls
When someone deletes a record or blocks a family's access, does the log say who, what and when? We look for actions that leave no trace.
evidence: action list with the log entry beside itIntegrity
Two people editing or merging the same record at the same time. We check that data is not silently changed or corrupted.
evidence: concurrency test resultsAuthentication and sessions
Can two-factor sign-in be switched off with only a password? Can one-time codes be guessed without limit? Does a reset end the other sessions? Do error screens reveal which accounts exist?
evidence: attempt logs, reproduction stepsTransmission security
HTTPS everywhere, HSTS and CSP headers, redirects that do not loop or drop to HTTP, and what travels in URLs and emails.
evidence: header captures, redirect tracesDisposal and third parties
Does deleted mean deleted? How long do file links stay valid? Which outside services receive patient emails, images or documents? Can search engines find a staging copy?
evidence: link-expiry timings, outbound call listWhat this finds: a North American clinic platform
A clinic and patient-app platform, 90+ feature areas, re-run as automated regression suites with Flows. One anonymised engagement, not a client named on this page.
| Class of finding | What it looked like | HIPAA Security Rule |
|---|---|---|
| Access control | Staff could open any patient record by URL. View-only roles could edit. One clinic could reach another's patients. A fax sync put one practice's documents in another practice's inbox. | 164.312(a) |
| Audit controls | No record of who deleted a guardian's data or blocked a family's app access. | 164.312(b) |
| Authentication | Two-factor sign-in could be turned off with only a stolen password. One-time codes could be guessed without limit. Lockouts reset in a new browser. Reset and SMS screens revealed which accounts exist. A reset did not end other sessions. | 164.312(d) |
| Integrity and transmission | Concurrent record merges could corrupt data. Missing HSTS and CSP headers, and an HTTP to HTTPS redirect loop. | 164.312(c), (e) |
| Disposal and third parties | Trashed faxes could not be deleted. Image links stayed valid for 1 hour instead of 5 minutes. Patient emails went to an external photo service. The staging patient app could be indexed by search engines. | related |
On a separate product, a clinic module inside a dental-education platform ran 174 isolation and patient-flow cases before release, and all of them passed.
Evidence an auditor can read
A test evidence pack
What was tested, on which version and when, with the raw results attached.
Findings tied to the safeguard
Each finding has steps to reproduce, a severity and the 164.312 safeguard it relates to.
A retest after your fix
We check the fix holds and close the finding. Retests are billed at the same hourly rate as other testing time.
A one-page summary
What passed, what failed, what is still open, in words your compliance lead can read.
| ID | Finding | Safeguard | Severity | Status |
|---|---|---|---|---|
| H-007 | View-only role can change a patient's contact details | 164.312(a) | High | Retested, closed |
| H-012 | Deleting a guardian record leaves no log entry | 164.312(b) | Medium | Fix in progress |
| H-019 | One-time code accepts unlimited attempts | 164.312(d) | High | Retested, closed |
Our tools run the checks, our engineers read the results
Paper first
NDA, data processing agreement and a BAA are signed before anyone gets access. For a medical SaaS we built a suite that reads its own login codes: 189 test cases and 13 bugs in a patient portal.
Synthetic data, not PHI
We test with made-up patients, in the environment you name. We do not need real patient records.
Our own tools
Flows re-runs the role and flow checks on every release. The AI Security Toolkit scans web and API. BugBoard keeps every finding, with a retest history.
Rates
EUR 20-45 per hour, engagements from one month. The first month is a trial: if you are not happy, the first two weeks are complimentary. After that the notice period is 30 days.
What we do for HIPAA, and what we do not
We can
- Test your web, API and mobile software against the Security Rule's technical safeguards.
- Automate the role and permission matrix so it runs on every release.
- Test with synthetic data and report each finding against the safeguard it touches.
- Retest your fixes and hand your auditor the evidence.
We cannot
- Certify you. HIPAA has no certification, so nobody can honestly offer one.
- Write your risk analysis, policies or training, or give legal advice.
- Test your network, hosting or physical safeguards. Our scope is web, API and mobile software.
- Tell you whether your organisation is a covered entity or a business associate.
Common questions
Is there a HIPAA certification?
No, and nobody can be: there is no HIPAA certification. We test your software against the Security Rule's technical safeguards and give your auditor the evidence. We hold ISO 27001:2022 for how we handle your data.
Do you sign a BAA?
Yes. We sign a business associate agreement, along with an NDA and a data processing agreement, before we touch your system.
Do you need real patient data?
No. We test with synthetic patients and test accounts, one per role. Real patient data adds risk, and the tests do not need it.
Do you cover PHIPA and GDPR too?
The software behaviour overlaps a lot: access, consent, audit trails, retention. We test what your product does and report against the regulation you name. What each law requires of you is a question for your counsel.
Can you automate the role-permission matrix?
Yes. We turn each role and action into an automated check in Flows, so the matrix runs on every release and a permission that quietly widens shows up as a failed run.
How long does a first pass take?
It depends on how many roles and feature areas you have. After a 30-minute call we send a written scope, and the first month is a trial, so you see real findings before you commit. Tell us what you need to evidence.
Related: healthcare software testing, security testing, AI Security Toolkit.
Tell us what your auditor will ask for
Thirty minutes: your product, your roles, the evidence you need and by when. We reply with a written scope.