Is holy-cross.com HIPAA secured?

Based on our automated scan, holy-cross.com has security issues that need to be addressed — 5 check(s) failed.

What does a HIPAA security scan check for?

Our HIPAA security scan checks for SSL/TLS encryption, security headers (HSTS, X-Frame-Options, etc.), third-party tracking scripts that may expose patient data, presence of a Privacy Policy and Notice of Privacy Practices, cookie security, email authentication (SPF, DMARC, DKIM), mixed content, health form field exposure, and more.

How do I fix HIPAA security issues on my website?

Common fixes include installing an SSL certificate, adding security headers via your web server configuration, removing non-compliant tracking scripts, publishing a HIPAA-compliant Privacy Policy and Notice of Privacy Practices, and ensuring contact forms use HIPAA-compliant services. View the full recommendations in this report or contact a HIPAA specialist for hands-on remediation.

HIPAA Security Scan: holy-cross.com - HIGH PRIORITY

SSL / TLS

Security Headers

Transport Security

Cookie Security

Tracking Scripts

Contact Emails

Health Data Safety

Privacy & Legal

Resource Integrity

SPF

DMARC

DKIM

9 Recommendations Available

See actionable steps to improve your HIPAA security score.

View Recommendations

Ready to fix these issues? Our specialists can remediate every finding.

Fix My Website →

SSL/TLS Certificate Pass

Valid certificate - expires in 48 days (issued by Let's Encrypt)

HSTS Pass

✓ max-age=31622400

X-Content-Type-Options Pass

✓ nosniff

X-Frame-Options Pass

✓ SAMEORIGIN

Referrer-Policy Fail

Missing. Recommended: strict-origin-when-cross-origin

Permissions-Policy Fail

Missing. Recommended: geolocation=(), microphone=(), camera=()

Server Information Disclosure Pass

Server and technology headers do not expose version information.

Cookie Security Flags Pass

No cookies were set by this page - no cookie security issues.

HTTP → HTTPS Redirect Pass

HTTP traffic correctly redirects to HTTPS.

TLS Version Pass

Server enforces TLS 1.2 or higher - deprecated protocol versions are rejected.

Mixed Content Pass

No HTTP resources found loading on this HTTPS page.

Tracking Scripts Warning 1 found

1 third-party tracker(s) detected on this page.

Google Tag Manager

Google Tag Manager Warning

Third-party tracking script detected on this page.

Contact Email Addresses Pass

All detected email addresses use the site's own domain - good professional practice.

HTTPS Enforcement Pass

Page served over HTTPS.

Health Form Fields Warning

Health-related form content detected. Keywords: health, medical, patient, insurance, condition, treatment, provider, physician. Ensure HIPAA-compliant safeguards are in place.

Tracker Exposure on Health Page Fail

Health-sensitive form content found alongside 1 tracker(s): Google Tag Manager. This may constitute a HIPAA/privacy violation.

A privacy policy link or reference was detected on this page.

Notice of Privacy Practices Pass

A Notice of Privacy Practices (NPP) reference was detected — required under HIPAA §164.520.

A Terms of Service / Terms of Use / Terms & Conditions link was detected.

HIPAA Notice Fail

No HIPAA Notice or policy page detected. Healthcare organizations should clearly communicate their HIPAA compliance posture.

Cookie Policy Pass

A cookie policy, notice, or consent reference was detected.

Accessibility Statement Pass

An accessibility statement, ADA compliance notice, or WCAG reference was detected.

Non-Discrimination Policy Pass

A non-discrimination policy or Section 1557 notice was detected.

State Privacy Rights Notice Fail

No state privacy rights notice found. Healthcare organizations should address state-level consumer privacy laws (CCPA/CPRA, VCDPA, Washington My Health MY Data Act, etc.) that may apply to their patients and website visitors.

Form Service Compliance Pass

No known non-HIPAA form services detected.

Chat Widget Risk Pass

No known non-HIPAA chat widgets detected.

Subresource Integrity (SRI) Warning

2 external script(s) lack SRI integrity attributes: maps.googleapis.com, cdn.jsdelivr.net. A compromised CDN could inject malicious code into your pages.

SPF Record Pass

v=spf1 include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all

DMARC Record Pass

v=DMARC1; p=reject; rua=mailto:[email protected]

DKIM Record Pass

Found on selector 'k1': k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9…

✨

Get an AI summary of this report

Open a new chat with your report pre-loaded

ChatGPT Claude Gemini

Referrer-Policy: Missing. Recommended: strict-origin-when-cross-origin

Permissions-Policy: Missing. Recommended: geolocation=(), microphone=(), camera=()

Tracking Scripts: 1 third-party tracker(s) detected on this page.

Google Tag Manager: Third-party tracking script detected on this page.

Health Form Fields: Health-related form content detected. Keywords: health, medical, patient, insurance, condition, treatment, provider, physician. Ensure HIPAA-compliant safeguards are in place.

Tracker Exposure on Health Page: Health-sensitive form content found alongside 1 tracker(s): Google Tag Manager. This may constitute a HIPAA/privacy violation.

HIPAA Notice: No HIPAA Notice or policy page detected. Healthcare organizations should clearly communicate their HIPAA compliance posture.

State Privacy Rights Notice: No state privacy rights notice found. Healthcare organizations should address state-level consumer privacy laws (CCPA/CPRA, VCDPA, Washington My Health MY Data Act, etc.) that may apply to their patients and website visitors.

Subresource Integrity (SRI): 2 external script(s) lack SRI integrity attributes: maps.googleapis.com, cdn.jsdelivr.net. A compromised CDN could inject malicious code into your pages.

Ready to Fix These Issues?

Our specialists can remediate every finding, protect your patients, and keep your website secure.

Fix My Website →

https://holy-cross.com