Skip to content
Healthcare apps · security review

A security review for healthcare web apps, without a fake HIPAA badge.

If the app shows patient or member data to logged-in users, the review is $2,400, or $1,200 to start, delivered in writing 48 hours after access. I will not sell you a HIPAA certificate. I also will not host the EHR.

Clinics and health-tech startups often have a portal that was bolted on after the marketing site. The question is simple and serious: can one user open another person's record by changing an id?

See the security review Ask a question

$2,400 for one app, $1,200 to start. Written report in 48 hours after access.

The review is for this

A portal, not a brochure

Patients, members, or staff sign in. A header scan of the homepage does not touch that.

Shared ids in the URL

Appointment ids, document ids, message ids. If the API trusts the id alone, the review will say so.

A buyer asked for a letter

A clinic group or a partner wants to know a person looked. They do not want a logo that says compliant.

Scope

  1. Part 1

    Access control

    Who can read and change a record, and what happens when the id is not theirs.

  2. Part 2

    Session and reset

    How a user gets in, how they get locked out, and how staff accounts differ.

  3. Part 3

    The report

    Written findings and fixes. No exploit how-to. No claim that you are HIPAA compliant because I looked.

Who this fits

One web application that handles patient, member, or clinic-staff access. Marketing sites for a practice belong on the hosting plan instead.

What this is not

Grade your security headers

Questions

Will this make us HIPAA compliant?

No. Compliance is a program: vendors, policies, access, and the software. This is an authorized look at one web app's auth and API.

What does it cost?

$2,400, or $1,200 to start. The written report is 48 hours after access, for one application.

Can you review the public clinic website instead?

If it is a brochure, you do not need this review. Hosting and care starts at $99 a month, and the free headers check will show the obvious gaps.

Also for this service

Michael Heredia

How would you like to talk?

Pick whatever is easiest. I read and answer every message myself.

Message me now Your note is already written; just hit send.
WhatsApp Text Email

+1 830-968-1575 · info@michaelheredia.com