Clinical Perimeter AugustInnovations LLC dba Clinical Perimeter

Penetration testing for healthcare software, by someone who has run it.

Your buyers are asking how you protect patient data. Clinical Perimeter tests your web application the way an attacker would — in staging, with synthetic data — and gives you the report and attestation letter your buyers, your HIPAA risk analysis, and your SOC 2 prep actually ask for.

Scope a test See what's included

One application. One flat price. No production systems, no real patient data — ever.

The test

Web Application Penetration Test — $5,500 flat

One web application, tested white-box/gray-box: you give us staging access, test accounts for each role, and any architecture documentation you can share. More context means deeper testing.

What gets tested

  • Authentication and session management
  • Authorization — including clinical vs. administrative role separation
  • Input validation: injection, cross-site scripting
  • Business logic and API endpoints
  • Healthcare-specific checks: PHI in responses, exports, error messages, and logs

What you receive

  • Full findings report — severity, evidence, reproduction steps, remediation
  • Attestation letter for buyer and auditor requests
  • 60-minute remediation call with your team
  • One retest within 30 days, with an updated attestation

Terms, plainly

  • 50% to schedule, 50% on report delivery
  • Report within 10 business days of the testing window closing
  • Signed engagement agreement and rules of engagement before any testing
  • Not included: production systems, real patient data, denial-of-service, social engineering, physical, internal-network, wireless, or mobile-app testing
$5,500

Flat, per application. No hourly meter, no quote process.

Start with a scoping call

Method

Checklist-driven, healthcare-aware

Testing follows the OWASP Web Security Testing Guide — a published, repeatable methodology — with additional checks written specifically for applications that handle protected health information.

Staging and synthetic data only

Testing never touches a production system or real patient data. If a staging environment with synthetic data isn't available, we will help you scope getting one — we won't test production instead.

Evidence you can act on

Every finding ships with evidence and reproduction steps, rated by severity, with remediation written for your engineers — and a plain-language summary for the buyers who asked for the test.

Critical findings don't wait

If testing turns up a critical vulnerability, you hear about it the same day — not for the first time in the final report.

About

Clinical systems first, security testing second — in that order

Clinical Perimeter is the security practice of AugustInnovations LLC, founded by Taylor Augustin. Taylor has spent 7+ years in clinical systems — currently a Clinical Application Specialist II working with the eClinicalWorks EHR — supporting the software clinicians use every day, and now tests healthcare applications with that operational background: how clinical and administrative roles actually divide, where PHI tends to leak, and what a finding means for a care workflow, not just a scanner score.

Contact

Scope a test

A 20-minute scoping call is the first step. Email us with the basics below and we'll set it up.

Do not send credentials, system access, or patient information by email. Access is exchanged only under a signed agreement, through a secure channel.

hello@clinicalperimeter.com