AugustInnovations LLC · Documents · Clinical Perimeter — Services
Clinical Perimeter — Service Sheet
AugustInnovations LLC dba Clinical Perimeter · hello@clinicalperimeter.com · clinicalperimeter.com
The problem
Your buyers — clinics, health systems, and enterprise customers — are asking how you protect the patient data in your application, and "we take security seriously" is no longer an answer. A HIPAA risk analysis or SOC 2 program needs evidence: an independent, documented penetration test of the application itself.
The service
One web application, tested white-box/gray-box in your staging environment with synthetic data only:
- Authentication and session handling
- Authorization and role separation (including clinical vs. administrative roles)
- Input validation and injection
- Business logic
- API endpoints
- Healthcare-specific exposure checks — protected health information appearing in responses, exports, error messages, and logs
Methodology is checklist-driven from the OWASP Web Security Testing Guide (WSTG).
What you receive
- Full findings report — every finding with severity, evidence, reproduction steps, and remediation guidance written for your engineers.
- Attestation letter — a one-page letter on letterhead stating that the testing was performed, the methodology used, and the scope covered — suitable for buyer and auditor requests.
- 60-minute remediation call — we walk your team through the findings and the fix order.
- One retest within 30 days — fixes are verified and the attestation is updated.
Engagement terms
- Flat-fee engagement — one price, scoped and agreed in writing before work begins
- Report delivered within 10 business days of the testing window closing
- Engagements are scheduled through hello@clinicalperimeter.com
Guardrails (non-negotiable)
- No testing without signed authorization. A signed Rules of Engagement and written client authorization are executed before any testing begins — every time.
- Staging and synthetic data only. Production systems and any system containing real patient data are never tested.
- Confidential handling. Evidence is stored encrypted, access-limited, and retained per the engagement agreement.
Not included
Production systems or any system containing real patient data; denial-of-service or load testing; social engineering or phishing; physical security; internal-network, wireless, or mobile-application testing.
Who performs the test
Tests are performed by Taylor Augustin, founder of AugustInnovations LLC — a Clinical Application Specialist II with 7+ years of clinical application systems experience (Cerner, Epic, eClinicalWorks) and a former Certified Surgical Technologist. That clinical-systems background is the point: the tester knows how healthcare applications are actually built, deployed, and misused.
Contact
hello@clinicalperimeter.com — tell us about your application and why you need the test. Please do not send credentials, system access, or patient information by email.