Fix My Website
HIPAA Report

https://lascrucesurgentcare.com

Oct 8, 2026 RPT-2C4BDDC4 View Site

* Rescans available every 24 hours

HIGH PRIORITY
5 failed · 0 warnings

* We detected the following that may create HIPAA privacy or security risks on your website.

25
Passed
5
Failed
0
Warnings
30
Checks
SSL / TLS
Security Headers
Transport Security
Cookie Security
Tracking Scripts
Contact Emails
Health Data Safety
Privacy & Legal
Resource Integrity
SPF
DMARC
DKIM
5 Recommendations Available
See actionable steps to improve your HIPAA security score.
View Recommendations
Ready to fix these issues? Our specialists can remediate every finding.
Fix My Website →
SSL / TLS
1 passed
SSL/TLS Certificate Pass
Valid certificate - expires in 54 days (issued by Let's Encrypt)
Security Headers
6 passed
HSTS Pass
✓ max-age=31536000; includeSubDomains
X-Content-Type-Options Pass
✓ nosniff
X-Frame-Options Pass
✓ SAMEORIGIN
Referrer-Policy Pass
✓ strict-origin-when-cross-origin
Permissions-Policy Pass
✓ camera=(), microphone=(), geolocation=()
Server Information Disclosure Pass
Server and technology headers do not expose version information.
Cookie Security
1 passed
Cookie Security Flags Pass
No cookies were set by this page - no cookie security issues.
Transport Security
3 passed
HTTP → HTTPS Redirect Pass
HTTP traffic correctly redirects to HTTPS.
TLS Version Pass
Server enforces TLS 1.2 or higher - deprecated protocol versions are rejected.
Mixed Content Pass
No HTTP resources found loading on this HTTPS page.
Tracking & Analytics
1 passed
Tracking Scripts Pass
No known third-party tracking scripts detected.
Contact Email Quality
1 passed
Contact Email Addresses Pass
All detected email addresses use the site's own domain - good professional practice.
Health Data Safety
3 passed
HTTPS Enforcement Pass
Page served over HTTPS.
Health Form Fields Pass
No forms found.
Third-Party Tracker Exposure Pass
No health-sensitive form content detected - tracker exposure risk is low.
Privacy & Legal
6 passed 4 failed
Fix My Website
Privacy Policy Pass
A privacy policy link or reference was detected on this page.
Notice of Privacy Practices Pass
A Notice of Privacy Practices (NPP) reference was detected — required under HIPAA §164.520.
Terms of Service Pass
A Terms of Service / Terms of Use / Terms & Conditions link was detected.
HIPAA Notice Fail
No HIPAA Notice or policy page detected. Healthcare organizations should clearly communicate their HIPAA compliance posture.
Cookie Policy Pass
A cookie policy, notice, or consent reference was detected.
Accessibility Statement Fail
No accessibility statement found. ADA compliance (Section 508 / WCAG 2.1) is increasingly required for healthcare websites serving the public.
Non-Discrimination Policy Fail
No non-discrimination policy found. Section 1557 of the ACA requires healthcare entities receiving federal funds to post a notice of non-discrimination.
State Privacy Rights Notice Fail
No state privacy rights notice found. Healthcare organizations should address state-level consumer privacy laws (CCPA/CPRA, VCDPA, Washington My Health MY Data Act, etc.) that may apply to their patients and website visitors.
Form Service Compliance Pass
No known non-HIPAA form services detected.
Chat Widget Risk Pass
No known non-HIPAA chat widgets detected.
Resource Integrity
1 passed
Subresource Integrity (SRI) Pass
All external scripts include integrity attributes, or no external CDN scripts were found.
Email Authentication
2 passed 1 failed
Fix My Website
SPF Record Pass
v=spf1 include:spf.protection.outlook.com -all
DMARC Record Fail
No DMARC record. Add TXT record at _dmarc.lascrucesurgentcare.com: v=DMARC1; p=quarantine; rua=mailto:[email protected]
DKIM Record Pass
Found on selector 'selector1': v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAru41xLTsdoNoyoSdfu…
✨

Get an AI summary of this report

Open a new chat with your report pre-loaded

ChatGPT Claude Gemini
5 Recommendations
1
HIPAA Notice: No HIPAA Notice or policy page detected. Healthcare organizations should clearly communicate their HIPAA compliance posture.
2
Accessibility Statement: No accessibility statement found. ADA compliance (Section 508 / WCAG 2.1) is increasingly required for healthcare websites serving the public.
3
Non-Discrimination Policy: No non-discrimination policy found. Section 1557 of the ACA requires healthcare entities receiving federal funds to post a notice of non-discrimination.
4
State Privacy Rights Notice: No state privacy rights notice found. Healthcare organizations should address state-level consumer privacy laws (CCPA/CPRA, VCDPA, Washington My Health MY Data Act, etc.) that may apply to their patients and website visitors.
5
DMARC Record: No DMARC record. Add TXT record at _dmarc.lascrucesurgentcare.com: v=DMARC1; p=quarantine; rua=mailto:[email protected]
Ready to Fix These Issues?
Our specialists can remediate every finding, protect your patients, and keep your website secure.
Fix My Website →