Health Records, Medical Data, & Billing Exposed Despite Encryption, WAF, & HIPAA Safeguards

Company Description

A global telehealth platform exposed electronic health records, consultation transcripts, insurance claims, prescribing data, and billing information, leaving sensitive data at risk of breach, fines, and reputational loss.

Perfai Security's Role

Autonomous app testing across 145 endpoints. With 62 vulnerabilities found (48 critical/high), the agents flagged, prioritized, and instantly remediated issues — reducing what would have taken months of manual effort.

App Count

Endpoints Tested

145

Vulnerabilities

Critical / High

What we found, in plain English

Anyone could look up a patient's therapy history, including family members' records and scheduled consultations. Therapy notes, diagnoses, and care schedules are protected health information; exposing them violates patient privacy and HIPAA trust.
Login credentials and personal details for every user were reachable without proper access checks. Credentials and PII in the open let attackers impersonate patients or staff and pivot deeper into the system.
Specialist schedules, group sessions, and program data were exposed even though the platform used encryption and a web application firewall. Encryption and firewalls protect data in transit, but they cannot fix missing authorization checks on who can view records.

Full technical findings

Sensitive Data Exposures

Specialists
- PII
- History
Groups
Family Members
Interventions / Consultations
Programs
Users
- Credentials
- PII
- History
- Tasks
Scheduled-Access

Testing Categories

OWASP API Security Top-10 List
OWASP Web Top-10 List
Perfai Security Next-Gen Top-30 List
OWASP Business Logic Top-10 List
OWASP Mobile Top-10 List
OWASP AI Agent Top-10 List
RBAC

Estimated Breach Cost With:

50 Customers | $388,000

See what Perfai Security finds in your app

Paste a URL. Get a free security report in minutes.

Start Free →