PHI data-flow analysis
Agreed PHI paths are traced from input to storage and transmission, with exposure concerns and remaining gaps recorded.
Industry · Healthcare
Protect the paths PHI travels.
Trace protected health information through intake, storage, and transmission, review the access controls around it, and prepare evidence for HIPAA review.
- acme
- /clinic-portal
- /Vulnerabilities
- /WF-0519
Critical
Sourceroutes/patients.ts:66
req.query.q
1
Interpolated into the name filter
`WHERE name ILIKE '%${q}%'`reports/search.ts:232
Reachable by any signed-in clinician
router.get("/patients/search", auth())routes/patients.ts:64Sinkreports/search.ts:31
await db.raw(sql)
Patient search builds SQL from the query string
CriticalCVSS 9.3
- Weakness
- CWE-89 · SQL injection
- Confidence
- 97
- Validation
- Exploitable
- Proof
- UNION query returned rows from the records table
The problem
PHI exposure hides in ordinary code paths.
An export endpoint, a log line, an integration callback. winfunc follows PHI through the application and flags where it leaves the boundary it should stay in, with the evidence your compliance team needs. BAAs are available.
Included
What winfunc covers.
- PHI data-flow review across intake, storage, and transmission
- Role and authorization analysis for PHI workflows
- Audit-logging review for PHI access
- FHIR, HL7, and EHR integration review
- Cryptographic-use review from code and configuration
- Session-management and authentication review
- HIPAA Security Rule context for findings
- Business Associate Agreement available
Outcomes
What your team walks away with.
HIPAA review support
Findings are organized against Security Rule questions, including §164.312, to support your assessment.
Access and audit
Authorization around PHI and the audit records it should create are reviewed together.
Data handling you can sign
Zero data retention, no training on customer code, and a BAA for PHI in scope.
Continue the evaluation
Start with one repository
Bring us your hardest codebase.
We'll bring the proof.
Scope a first audit with our security engineers. You get findings with traces, reproduction evidence, and patches ready for review.