A patient record could be claimed with the wrong name and date of birth
For heads of QA and product at digital health companies.
A medical SaaS had a patient portal and a clinical staff app, both behind one-time codes. We tested registration, password reset and SMS login against 189 test cases traced in matrices, and reported 13 bugs, two of them high.
- Healthcare
- Patient portal + clinical staff app
- Compliance
- Clients
- Reputation
- Money
What was at risk
A patient record claimed with someone else's details
The claim form accepted a wrong name and date of birth. Unauthorised access to health data is the kind of event that raises a data-protection breach question, and a question from the regulator.
An identity step that never appeared
After the SMS code, the date-of-birth check was never shown, for any phone number. A clinic that finds out will ask what else was skipped.
Errors a screen reader does not announce
A failed login gave no alert to assistive technology (WCAG 4.1.3). Patients who rely on a screen reader get no signal, and buyers check for exactly this.
Releases waiting on broken test data
Staging clean-ups deleted every test account and the whole suite failed at once. Every re-setup is delay on a release, until tests create their own accounts.
Standards and rules in play
- ISO 14971The 189 test cases are traced in three matrices built for ISO 14971, the risk-management standard for medical devices: registration, password reset and SMS login.
- WCAG 2.1, incl. 4.1.3A compliance test file for password reset covers accessibility. The missing alert on a login error is a WCAG 4.1.3 failure.
- ISO 27001, GDPR, cookie securityThe same file lists these as its focus for the password-reset flow.
- Patient data in testsHealth-card numbers never appear in step names or assertion messages, and all patient data comes from protected variables.
Context: health data is special-category personal data under GDPR.
How we tested it
- Test level
- System testing: end to end through the user interface of two apps, the patient app and the clinical staff app.
- Test types
- Functional, security, accessibility and compatibility (three browsers), run as an automated regression suite.
- Test basis
- Requirements for three features, traced in matrices of 96, 46 and 47 test cases.
- TechniqueBoundary value analysisWhere it showed upPassword minimum and maximum length, one-time-code boundaries, phone formats and date-of-birth edge cases each have their own test files.
- TechniqueError guessingWhere it showed upAttack-style cases against registration, reset and login: SQL injection, cross-site scripting, CSRF, token reuse, account enumeration and brute force.
Terms as in the ISTQB CTFL 4.0.1 syllabus and glossary.
What we found, and what it costs
- FindingHighA patient record could be claimed with the wrong name and date of birthWhat it costs youSomeone other than the patient could reach health records: a data-protection breach and a regulator question, not a screen glitch.
- FindingHighThe date-of-birth check never appeared after the SMS codeWhat it costs youAn identity safeguard the specification expected was absent on a login path, and 12 planned test cases could not run behind it.
- FindingLowA failed login was not announced to screen readersWhat it costs youAn accessibility gap (WCAG 4.1.3) that buyers and complaints surface. Cheap to fix before they do.
Ten more bugs, among them a future date of birth accepted at registration, email addresses not normalised, and a code field that took non-numeric characters.
What changed
The 13 bugs were reported with severity ratings. The suite now creates its own accounts through five helper modules, so a staging clean-up no longer breaks it, and it reads its own email and SMS codes. About 44 tests are documented as deliberately not automated, such as code expiry timing, WAF rate limits and lockouts, each with its reason, and About 15 more are logged as application bugs. The written list answers what a green run does not prove.
Do your tests check who can open a patient record?
We test the checks that protect each record and say what we leave out. The first month is a trial.
