Does this make us HIPAA compliant?

No. AgentProof tests and fixes your app. It does not certify you for HIPAA or any other standard. Its reports show what was tested and how each problem was fixed.

Who can see our reports?

Only members of your workspace. You can invite as many as you want at no extra cost.

How often is our app tested?

Monthly, weekly or daily, depending on your plan.

AGENTPROOF TESTS
AND FIXES
HEALTH TECH APPS.

Health apps hold records that only the right patient and the right clinician should see. AgentProof checks who can open each record, and fixes your code when the wrong person can.

Your health app is tested for records the wrong person can open.

PATIENT RECORDS: Can one patient open another patient's chart, results or visit notes by changing an ID?
CLINICS: Can staff at one clinic see patients who belong to a different clinic?
FILES: Can someone who is not signed in open an uploaded scan or lab report from its link?
MESSAGES: Can a user read messages between another patient and their doctor?
FORMER STAFF: Can a staff member who was removed still use an old session?
EXPORTS: Can a regular user download an export meant only for admins?

The Attack Agent checks each of these with real requests to your app, the same requests your own app sends.

An example: a link to a lab report worked without signing in.

EXAMPLE FINDINGLab reports open from their link without signing in

REQUEST

GET /files/lab-report-5521.pdf
Not signed in

RESPONSE

200 OK
A patient's lab report was returned

FIX

- return storage.publicUrl(file.path);
+ await requirePatientAccess(user, file.patientId);
+ return storage.signedUrl(file.path, { expiresIn: 300 });

RETEST

GET /files/lab-report-5521.pdf
401 Unauthorized. Fixed.

Files are now served through links that expire after five minutes, made only for users who may see that patient.

Each fix can wait for your team's review before it goes live.

Review first

Choose pull requests, and no change reaches your app until your team approves it.

Retest after

Every fix is checked by repeating the original attack. A problem is only marked fixed when that attack fails.

Answers to common questions from health tech teams.

DOES THIS MAKE US HIPAA COMPLIANT?: No. AgentProof tests and fixes your app. It does not certify you for HIPAA or any other standard. Its reports show what was tested and how each problem was fixed.
WHO CAN SEE OUR REPORTS?: Only members of your workspace. You can invite as many as you want at no extra cost.
HOW OFTEN IS OUR APP TESTED?: Monthly, weekly or daily, depending on your plan.

Plans for one health app start at $199 a month.

Both agents are in every plan. Weekly checks cost $399 a month and daily checks cost $999.

See plans See how fixes work

AgentProof also tests these kinds of apps.

AgentProof is in development. The example finding on this page is an illustration, not a result from a customer's app.