Healthtech & health dataYour AI agent writes into patient records
Your AI agent writes into patient records
with no defined perimeter.
Clinical scribes, appointment booking, triage: healthcare agents read external content and write into sensitive systems. We test what an agent can do that it shouldn't, on your test environment, never in production.
Applicable regulations
HDS 2.0
May 16, 2026Health Data Hosting: certification required by May 16, 2026 for any entity hosting health data on behalf of third parties.
GDPR: sensitive data
In forceHealth data is sensitive data (Art. 9). Unauthorized exposure triggers a mandatory CNIL notification within 72 hours.
CNIL: priority sector
Ongoing controlsHealthcare is a CNIL priority enforcement sector. Cegedim Santé: 15.8M patient records exposed, €800K fine in 2024.
Common healthtech vulnerabilities
- APIs returning patient data without proper authentication
- Missing RLS policies on databases (Supabase, Firebase)
- Unauthenticated webhooks that let anyone create admin accounts
- Medical documents stored in public buckets
- Sensitive data moving in the clear, at rest and in transit
On a medical training platform, we found unauthenticated admin account creation, giving full access to every user's data in under two minutes.