A HIPAA & Security audit before launch, then fixing what we found

Before putting real patient data in their app, a small practice asked us to check it.

About the client

A small US private therapy practice. Patients filled out forms on paper, therapists wrote notes by hand, everything was stored in folders.

They had an app built to replace all that - patient check-in on an iPad, digital notes, AI-assisted note writing. But the developer left with the app half-built. What was there worked, but nobody knew if it was secure or HIPAA compliant.

They needed to know three things before going live: what's broken, how serious it is, and how fast it can be fixed - without starting over.

What we checked

• Backend - every API endpoint, database rules, audit logging
• Admin - who can log in, what they can see, how long sessions last
• iPad app - kiosk mode, therapist mode, the AI notes feature
• Infrastructure - encryption, backups, monitoring, deployment
• HIPAA - where patient data goes, who can access it, audit trail, BAAs, required policies and risk analysis

What we found

3 critical, 5 high, 8 medium and 1 low finding. The system was built with healthcare in mind - login, roles, audit logging, encryption were all there. But it was unfinished and there were real gaps.

• The database was wide open - anyone with the project ID could read, change or delete every patient record.
• No BAAs in place with Google Cloud and OpenAI.
• AI notes sent patient data straight to OpenAI with the API key on the device.
• Audit logs could be edited, record views weren't logged, no backups, no MFA, no HIPAA-compliance documents.

The remediation

The fixes were real work - code changes, moving the AI to the backend, new database rules, logging, MFA. But all of it was done on the existing system. Nothing needed a rebuild. Audit: 1 week. Week 1: launch blockers fixed and launched with real patient data. Week 2: remaining security issues fixed. Week 3: refactoring before new features.

Results

The practice went live with real patient data after the first week. All 17 findings are fixed, and they run their intake and treatment notes on it every day. After the audit, they kept us on to build what came next.

See a sample report (PDF)