01
Check who can access patient information
Test user roles, data access and agreed functions in a representative version of your product, so your team can see where access controls need attention.
Healthtech penetration testing
Get clear answers about
your health software’s security.
Preparing for a release or a healthcare customer’s security review? We test application roles, API access and integrations against the agreed requirements, giving your team a clearer picture of the risks and what to address next.
Private, self-hosted AI assistance. Assessment material is not sent to third-party model providers for that assistance.
What your team gets
Testing focused on
your product and priorities.
Tell us what you’re releasing or what your customer has asked for. We’ll agree what to test, how your information is handled and what the report will cover.
02
The right test environment
Use the agreed data and environment. Representative synthetic data can support testing where it answers the assessment question.
03
A report your team can use
Get an executive summary, a summary of findings and detailed findings with descriptions, reproduction steps, remediation steps and references to help your team act.
UK + US buying context
The requirements behind
your customer’s review.
Start with the market your customer operates in. These guides help you identify the policy, assurance route and evidence request that apply to your product.
UK
Your UK buyer’s review.
Product testing, organisational assurance and API onboarding are different routes. Start with the exact NHS England requirement.
US
Your US buyer’s review.
Understand the buyer’s HIPAA context, PHI handling requirements and any applicable medical-device submission route.
Illustrative assessment
See what an assessment
could look like.
A defined technical assessment can support different customer reviews. The actual buyer determines the required scope, evidence and provider conditions.
This proposed engagement uses fictional data. No completed customer work, findings or approval outcomes are claimed.
Healthtech / representative workflow
Synthetic records
API roles
Care workflow
Illustrative scenario · Fictional data
A patient-data integration.
A release to prepare.
A proposed assessment of application roles, API access and exports, using synthetic records and a defined integration boundary.
Before we begin
A few questions
to get you started.
Will the report satisfy our customer’s requirements?
We confirm the requested scope, report format and provider conditions before proposing the assessment. Your customer’s reviewer decides whether the resulting evidence meets its request.
Does private inference mean HIPAA compliant or US hosted?
Private inference does not establish HIPAA compliance or US data residency. Where PHI is involved, the actual roles, contracts, locations and access conditions must be established before access.
Does one assessment cover every NHS assurance route?
DTAC, DSPT and NHS API onboarding are different routes. An API may specify provider credentials; we check the exact requirement and proposed delivery eligibility before booking.
Let’s talk through
your penetration test.
Tell us about your product, your deadline and the evidence your reviewer needs. We’ll agree the scope and handling arrangements before work starts.