01 — Authorise and prepare
Agree objectives, system ownership, third-party boundaries, test identities and representative data. Write the rules of engagement before execution. Include the environment version, communication channel and authority to pause activity.
Use synthetic patient identities and agreed data cohorts. Name a clinical escalation contact, set request limits and exclude treatment-affecting actions unless separately authorised. Stop immediately if testing encounters unexpected live clinical data or threatens a care workflow.
02 — Model the attack path
A healthcare estate extends beyond one hospital. We connect identity, referrals, remote care and third-party integrations into a scope that follows the patient-data journey.
- Can a portal account retrieve another synthetic patient’s document?
- Can a partner integration change a referral outside its permitted organisation?
- Can a supplier support identity reach an internal data export or recovery role?
Use these questions to choose a realistic sequence and a bounded proof point. Explain where an assumed starting position or supplied credential will limit the conclusion.
03 — Execute and observe
Combine approved discovery with manual validation. Keep request rates and actions within the operating plan. Record successful and blocked operations with the identity and context used. Stop at agreed proof rather than expanding access simply because it is technically possible.
04 — Reconstruct the evidence
Reconcile tester observations with application, identity and defence records. Distinguish a response from a confirmed state change, a reachable host from usable authority and an assisted scenario from unaided access. Record clock differences that affect the timeline.
05 — Remediate and retest
Prioritise by the demonstrated path, reachable business operation and control context. Agree owner, due date and acceptance criteria. Separate an executed retest from a future plan, and preserve the findings that remain open.
Primary sources
General information, not a compliance opinion. Confirm legal applicability and testing requirements for your entity and jurisdiction.
