Why clinical systems fail at access control specifically
Healthcare software is designed so that a clinician can reach a record quickly, because in an emergency that is the correct priority. Every design decision that serves that goal pushes against least privilege.
The result is systems where the role model is broad by intention and nobody has tested what it permits in practice. That gap is where the findings are, and it is not a coding error, it is an unexamined trade-off.
Where testing usually finds something
These are the surfaces that come up repeatedly in health systems, in rough order of how often they produce a finding.
- Role boundaries that permit reading records outside a user's circle of care
- Patient portals where altering an identifier returns another patient's record
- Integration endpoints, including HL7 and FHIR interfaces, with weaker authorization than the main application
- Audit logs that record reads but are never reviewed, or are modifiable by the people they log
- Vendor and support access that outlived the project it was created for
- AI assistants with read access to records and no record of what they read
Breach notification is why untested is expensive
PHIPA s. 12(2) requires notifying the affected individual at the first reasonable opportunity where personal health information is stolen, lost, or used or disclosed without authority, subject to the Act's exceptions.
A finding in a report costs a ticket. The same weakness discovered by someone else costs a notification, a regulator conversation, and a conversation with your patients. That asymmetry is the business case.
How your data is handled during the engagement
Testing systems that hold personal health information means handling personal health information, so the handling terms are part of the scope rather than an afterthought.
CyberArc's data handling is PHIPA-aware. Client data is processed on local AI models by default, and cloud AI tools are used only with the client's written consent. A custodian cannot authorize an arrangement that would itself constitute an unauthorized disclosure, so this is agreed in writing before any access is granted.
Digital health products, not just clinics
A company selling software to clinics usually sits in both roles: a service provider to custodians and, for its own data, a custodian. Customers increasingly ask for evidence of testing during procurement.
The multi-tenant question dominates here. If one clinic's data can be reached from another clinic's account, that is a single finding affecting every customer at once, and it is the first thing worth testing.