Website Security for UK Healthcare SaaS: NHS, CQC, and Patient Data

Healthcare Data and the Attacker's Perspective

Patient data has a specific and significant value to attackers that goes beyond most other personal data categories. A healthcare record contains name, date of birth, NHS number, address, and potentially a detailed medical history — everything needed for identity fraud, insurance fraud, and highly targeted social engineering.

In 2024, a ransomware attack on Synnovis — a pathology services provider working with NHS London — resulted in the postponement of thousands of operations and appointments across King's College Hospital, Guy's and St Thomas', and other major London trusts. In 2017, WannaCry forced the cancellation of an estimated 19,000 NHS appointments.

These attacks targeted NHS infrastructure directly. But digital health companies — SaaS platforms that manage patient records, appointment booking systems, remote monitoring tools, care planning software — sit adjacent to that infrastructure. They hold patient data. They integrate with NHS systems. And they are, by and large, smaller organisations with fewer dedicated security resources than an NHS trust.

The UK Regulatory Framework for Digital Health

Data Security and Protection Toolkit

The NHS Data Security and Protection Toolkit (DSPT) is a self-assessment framework for organisations that handle NHS patient data. Completing the DSPT is mandatory for NHS suppliers, and achieving Standards Met status is required to connect to NHS systems and process NHS patient data.

The DSPT includes requirements for: - Regular penetration testing of systems holding NHS data - Vulnerability management processes - Access controls and identity management - Incident response procedures

The toolkit's penetration testing requirement is explicit: organisations should conduct penetration testing at least annually and after significant changes to systems holding NHS patient data.

CQC registration and data security

The Care Quality Commission regulates health and social care providers in England. For CQC-registered providers using digital systems to manage care records, the CQC's Key Lines of Enquiry on safety and responsiveness include expectations around data security and information governance.

UK GDPR and the special category status of health data

Health data is explicitly classified as special category data under UK GDPR, carrying the highest protection requirements. A breach of health data triggers mandatory notification to the ICO within 72 hours and is likely to result in a higher severity assessment than a breach of non-special category data.

ICO fines for health data breaches have reached hundreds of thousands of pounds for organisations that failed to implement appropriate technical measures. For a healthcare SaaS company, an ICO fine combined with the reputational damage of a patient data breach can be existential.

Common Vulnerabilities in Healthcare Applications

Broken access controls in multi-tenancy

Most healthcare SaaS platforms are multi-tenant: multiple clinics, GP practices, or care organisations share a single platform instance, with their data logically separated. If the access controls enforcing that separation are flawed — if a request from one tenant's user can access another tenant's records by manipulating an ID in the request — the entire patient dataset of every customer is at risk.

Multi-tenant isolation bugs are among the most serious vulnerabilities in healthcare SaaS. They are also common, because implementing correct isolation across all data access paths requires consistent application of access checks that is easy to break as the codebase grows.

Insecure file handling for clinical documents

Healthcare applications handle clinical documents: GP letters, discharge summaries, care plans, prescription records. These are stored as files or as structured data. If documents are served from a web endpoint without robust authentication — if the URL to a document is predictable or if authentication is checked inconsistently — patient documents can be accessed without authorisation.

A Yrzo scan specifically tests file-serving endpoints for authentication bypass and predictable URL patterns.

Excessive data exposure in API responses

REST APIs for healthcare applications commonly return more data than the requesting client needs. A mobile app's appointment list endpoint that returns the patient's full medical record alongside their appointment details — when only the appointment time and location are needed — creates unnecessary exposure. If the API is compromised or misconfigured, far more data leaks than should have been accessible.

Weak authentication in clinician-facing interfaces

Admin interfaces and clinician portals are high-value targets. An attacker who compromises a GP practice's credentials can access records for the entire patient list. Multi-factor authentication is the most effective mitigation. Many healthcare SaaS applications still do not enforce MFA for clinician accounts, or enforce it inconsistently.

Third-party script risks on patient portals

Patient-facing portals — appointment booking, test results, messaging — often include third-party scripts: live chat, analytics, marketing tools. Each third-party script executes with full privileges in the patient's browser. A compromised analytics script can exfiltrate whatever the patient types into the portal — including health questions asked through a messaging feature.

What Yrzo AI Covers for Healthcare SaaS

The Professional (£399) and Advanced (£799) tiers are appropriate for healthcare applications. Both tiers include authenticated testing — the scanner tests your application as a logged-in user, which is essential for finding the access control vulnerabilities that matter most in healthcare.

Specific checks relevant to healthcare applications include: - Multi-tenant isolation testing (IDOR across tenant boundaries) - Authentication and session management for clinician and patient portals - File access controls on document endpoints - API response data minimisation checks - Third-party script inventory and integrity assessment - DMARC, SPF, and DKIM configuration for clinical communications - MFA enforcement verification

The Advanced tier's chained exploit validation is particularly valuable for healthcare applications: it attempts to combine lower-severity findings — a predictable session token combined with a missing authentication check on a document endpoint, for example — into an exploitable path before reporting.

For DSPT compliance, a Yrzo AI report provides documented evidence of an annual penetration test with findings and remediation guidance. We can provide a summary mapping findings to DSPT standards on request.

[Start with a free preliminary scan](/free) or go straight to the [Professional scan for £399](/checkout/standard).

Related reading: [Two-Factor Authentication for Website Security](/blog/two-factor-authentication-website-security-uk) · [GDPR Website Security Requirements UK](/blog/gdpr-website-security-requirements-uk) · [Cyber Insurance UK Security Requirements](/blog/cyber-insurance-uk-security-requirements)