This tool provides an automated, indicative self-assessment for informational purposes only. It does not constitute a security audit, penetration test, or legal or regulatory advice, and does not guarantee compliance with HIPAA, OWASP, or any other standard. Consult qualified security and compliance professionals.
FHIR API security checklist
A free, indicative security self-assessment for healthcare APIs. Check your FHIR deployment against OAuth 2.0, SMART on FHIR, the OWASP API Security Top 10 and HIPAA technical safeguards, and get a scored report with prioritised fixes in about ten minutes.
What you get
Instant security score
Weighted questions across ten control areas, from authentication and TLS to PHI protection, scored the moment you finish.
Free, no email needed
Severity-ranked gaps
The findings most likely to expose patient data, ranked so your team knows what to fix first.
Free, no email needed
Standards mapping
Every finding mapped to OAuth 2.0, SMART on FHIR, the OWASP API Security Top 10 and HIPAA technical safeguards.
Free, no email needed
Prioritised remediation report
A scored report with prioritised recommendations you can hand to engineering, delivered by email when you ask for it.
Emailed on request
How it works
Answer the checklist and see your score as you go.
About 10 minutes
Ten control areas: authentication, authorization, TLS, hardening, validation, audit, PHI protection, OWASP API, FHIR specifics and HIPAA.
Private by design
Answers are scored in your browser as you go. They are processed only to build the report you request, never sold or shared.
Indicative, not an audit
A planning tool for engineering and compliance teams. Not a security audit, penetration test or legal advice.
Find your FHIR API gaps before an attacker does
Free, indicative, about ten minutes.
FAQ
Ten control areas of a FHIR deployment: authentication, authorization, TLS, hardening, input validation, audit logging, PHI protection, the OWASP API Security Top 10, FHIR-specific risks and HIPAA technical safeguards.
No. It is an automated, indicative self-assessment for planning. It does not replace an audit, a penetration test or qualified security and compliance advice.
Weighted questions across the control areas are scored the moment you finish. Findings are ranked by severity and mapped to OWASP, SMART on FHIR and HIPAA.
They are scored in your browser as you go. If you ask for the report by email, they are processed to build it and are never sold or shared.
CodeGeeks Solutions, a software development and AI company based in Ukraine and Estonia.
Want a second pair of eyes on the results?
Book a scoping call with CodeGeeks to walk through the findings and plan the fixes. A conversation, not a penetration test.