Hospital website
Every public page, form and file upload checked against the OWASP Top 10.
Keeping patient reports private at Sonoscan Hospital
A full security audit of Sonoscan Hospital’s website, online report access and hosting server, with a ranked fix plan and a retest.
OWASP Top 10OWASP ASVSCERT-In guidelinesDigital Personal Data Protection Act, 2023
The challenge
Why the hospital needed an audit
Patients use the hospital’s website to find services, book visits and access reports. Any weakness there could expose personal and medical information.
The hospital wanted an independent check of its public-facing systems, and a clear list of what to fix first, written so that both its team and its vendors could act on it.
Scope
What we audited
Every system below was tested with the hospital’s written consent and within agreed testing windows.
Patient report access
Login, session handling and access control, so one patient can never see another patient’s report.
Appointment and enquiry forms
Input validation, spam protection and safe handling of submitted details.
Hosting server
Open ports, software versions, SSL/TLS setup, backups and admin access.
Approach
How the audit was carried out
A clear, safe process that never put live hospital services at risk.
- 01
Scope and consent
Agreed systems, testing windows and contacts with the hospital team before any testing began.
- 02
Testing
Automated scanning followed by manual testing of logins, report access and forms.
- 03
Reporting
Each finding rated by risk, with evidence and exact steps to fix it.
- 04
Retest
After fixes were applied, the affected areas were tested again to confirm they were closed.
Standards
Tested against recognised standards
- OWASP Top 10
- OWASP ASVS
- CERT-In guidelines
- Digital Personal Data Protection Act, 2023
Deliverables
What the hospital received
- Executive summary for management
- Detailed technical report with evidence
- Risk-ranked fix plan
- Retest report
Outcome
What changed for the hospital
Findings and system details stay confidential. This is the impact we can share.
Clear priorities
The hospital team knew exactly which issues to fix first and why.
Safer patient data
Report access and forms were reviewed so personal information stays private.
Verified fixes
A retest confirmed the fixes worked, not just that they were applied.
More case studies
Other security audits we have delivered
Security auditHealthcare
MMC Hospital
A security audit of MMC Hospital’s website, admin panel, APIs and email domain, with fixes ranked by risk and a retest.
Read case studySecurity auditHealthcare
DRL Hospital
A security audit of DRL Hospital’s website, staff login portal, internet-facing servers and backups, with a ranked fix plan and a retest.
Read case studyWant the same level of protection?
Tell us which systems you want checked. We reply within one working day with a scope and a fixed quote.
Prefer email? twenovaitc@gmail.com