Sensitive Data: High Number of Personal Health Information¶

Identifier: high_number_of_phi

Scanner Support¶

GraphQL Scanner	REST Scanner	WebApp Scanner	ASM Scanner	Automated Pentest

Description¶

When access control isn't properly implemented, protected health information (PHI) can leak to the public, potentially leading to data breaches, financial loss, legal penalties, and HIPAA violations.

How we test: We scan responses to detect PHI such as medical record numbers, health insurance information, and other health-related identifiers. We count the number of PHI instances found and alert if the count exceeds the configured threshold, indicating potential access control failures.

Configuration¶

Example¶

Example configuration:

---
security_tests:
  high_number_of_phi:
    detection_threshold: 3
    skip: false

Reference¶

`detection_threshold`¶

Type: integer

Threshold to trigger alert if the number of values found.

`skip`¶

Type: boolean

Skip the test if true.