Healthcare Application Security Testing Finds a Gap in Patient-Record Authorisation
An assessment of application roles and APIs examined whether a valid login could be used to access records belonging to another patient.
Client: Healthcare Organisation
The challenge
The Application Recognised the User's Role. It Did Not Always Establish Their Right to the Record.
The organisation relied on authenticated application workflows to provide access to sensitive patient information. Conventional tests had covered login controls, session handling and common application vulnerabilities. The remaining concern was whether access to individual records was consistently restricted by the relationship between the requester and the patient.
- Different user roles accessed patient information through shared application services.
- API endpoints accepted record identifiers supplied by the requesting client.
- Authorisation tests concentrated on user roles rather than individual record ownership.
- Changes to patient-facing workflows increased the need for regression testing across access boundaries.
The solution
Test the Relationship Between the User, the Role and the Patient Record
Security Brigade performed a controlled application and API security assessment focused on object-level authorisation. Testing used authorised accounts and test records to examine whether a user could retrieve or modify information outside their permitted scope.
Our approach
- 01Map application roles, patient-record workflows, API endpoints and sensitive data-access decisions.
- 02Test access boundaries between different roles and between users with the same role but different record permissions.
- 03Validate suspected authorisation gaps using controlled requests and non-production test data where appropriate.
- 04Recommend server-side record-level checks, negative test cases and monitoring improvements, followed by focused retesting.
The results
Patient-Record Access Became an Explicit Server-Side Decision
The composite engagement shows why role-based access controls alone may not protect sensitive healthcare information. The remediation approach requires the application to establish whether each requester is permitted to access the specific record involved. Documented retests and regression cases provide a repeatable way to check that boundary after subsequent application changes.
Ready to discuss your security needs?
Talk to our team about a similar engagement for your organisation.
Request a scoping call