Roles and tenant boundaries
I compare what patients, practitioners, support staff and administrators can reach, looking for any path that reads or changes records from another account or customer organisation.
Healthtech
Pentesting for healthtech web applications, APIs and mobile apps.
The pentest follows patient records through every role and customer organisation that can reach them, and each finding has evidence your engineers can reproduce.
- Starting point
- Web, API & mobile pentest
- Focused on the product’s actual permissions.
- Typical engagement
- 8–12 consultant days
- A fixed fee is provided after scoping.
- Who does the work
- The named tester
- No hand-off after the scoping call.
Assessment focus
What the test covers.
A healthtech product often shows the same patient record to several roles, and to more than one customer organisation.
I map each role to the actions it is allowed to take, then test those actions with direct requests to the API and through complete workflows such as invitations and exports.
Clinical and operational workflows
I run workflows such as referrals and consent changes end to end, looking for a step that skips a permission check.
APIs, mobile and integrations
I test object-level authorisation and session handling on web, API and mobile clients, and how far the product trusts its identity provider and connected services.
Sensitive files and records
I follow attachments and exported reports from upload to sharing, looking for predictable file references and links that never expire.
Feedback after three healthtech engagements.
“I've worked with Perspican to identify the security gaps in three different applications storing medical data. Giuseppe was able to identify hard to exploit security issues that went undiscovered in the previous 3 pentests performed by 2 different providers.
He understands deeply secure software engineering best practices, and I was really impressed by his ability to identify the issue in the codebase and precisely suggest the solutions to the problem.
I'd recommend his services to any business that handles sensitive data”
An example
A practitioner leaves a clinic and can still open its patients’ files.
A practitioner works for two clinics on the same platform. One clinic removes them, while their account stays active for the other.
- Set up the roles
I create test accounts in both clinics, with one practitioner who belongs to each of them.
- Remove the membership
The first clinic removes the practitioner. I then send every request they could make before, through the app and directly to the API.
- Report the path
A file endpoint still returns the first clinic’s attachments. The finding names the endpoint and the records exposed, with the steps to reproduce it.
Deliverable
A report your engineering team can work from.
Each finding names the role and the records involved, with the steps to reproduce it. I walk your team through the report, and agreed retests are recorded against the original findings. The report can also serve as technical evidence for the NHS DSPT, a DTAC assessment or a HIPAA risk analysis, while compliance decisions stay with the assessor.
Reproducible evidence
Numbered steps from a stated account state, with the requests and responses that show the behaviour.
Product impact
The records or actions exposed and the tenants involved, with a severity rationale based on what was observed.
Remediation and retest
A fix, and the retest status once it ships. Similar code paths worth checking are listed too.
Common questions
Questions about healthtech testing.
Do you need access to real patient records?
No. The test runs on test accounts with synthetic records, ideally in a staging environment that matches production. If part of the test has to run in production, we agree in writing which accounts and records it may touch.
Are integrations with an EHR or identity provider in scope?
The product’s side of them is. I test how far the product trusts the tokens and webhooks it receives from connected services. The third-party systems themselves stay out of scope unless their owner authorises the test in writing.
Can the report support NHS DSPT, DTAC or HIPAA?
Yes, as technical evidence of what was tested and found. The compliance decision stays with the assessor.
How long does a healthtech pentest take?
Usually 8 to 12 consultant days, depending on how many roles and apps are in scope. The fixed fee and the dates are set after scoping.
Other services
Validation and ongoing support.
Finding validation
Findings from scanners, AI tools or earlier assessments, checked one by one in your code. You learn which are real and how to fix them.
Product security support
Short reviews between pentests: a sensitive change before release, or a fix that needs retesting.
When a verified fix requires production code, remediation engineering is available as a scoped add-on.
Start with the roles that can reach patient data.
Send the product and its user roles, with the date you would like the test to start.
Prefer to write directly? [email protected]