Is medskinessentials.com HIPAA secured?

Based on our automated scan, medskinessentials.com has security issues that need to be addressed — 11 check(s) failed.

What does a HIPAA security scan check for?

Our HIPAA security scan checks for SSL/TLS encryption, security headers (HSTS, X-Frame-Options, etc.), third-party tracking scripts that may expose patient data, presence of a Privacy Policy and Notice of Privacy Practices, cookie security, email authentication (SPF, DMARC, DKIM), mixed content, health form field exposure, and more.

How do I fix HIPAA security issues on my website?

Common fixes include installing an SSL certificate, adding security headers via your web server configuration, removing non-compliant tracking scripts, publishing a HIPAA-compliant Privacy Policy and Notice of Privacy Practices, and ensuring contact forms use HIPAA-compliant services. View the full recommendations in this report or contact a HIPAA specialist for hands-on remediation.

HIPAA Security Scan: medskinessentials.com - HIGH PRIORITY

SSL / TLS

Security Headers

Transport Security

Cookie Security

Tracking Scripts

Contact Emails

Health Data Safety

Privacy & Legal

Resource Integrity

SPF

DMARC

DKIM

16 Recommendations Available

See actionable steps to improve your HIPAA security score.

View Recommendations

Ready to fix these issues? Our specialists can remediate every finding.

Fix My Website →

SSL/TLS Certificate Pass

Valid certificate - expires in 65 days (issued by Let's Encrypt)

HSTS Fail

Missing. Recommended: max-age=31536000; includeSubDomains

X-Content-Type-Options Fail

Missing. Recommended: nosniff

X-Frame-Options Fail

Missing. Recommended: SAMEORIGIN

Referrer-Policy Fail

Missing. Recommended: strict-origin-when-cross-origin

Permissions-Policy Fail

Missing. Recommended: geolocation=(), microphone=(), camera=()

Server Information Disclosure Warning

Server headers expose version/technology: cloudflare, WP Engine. Remove or redact to avoid leaking infrastructure details.

Cookie Security Flags Pass

All 1 cookie(s) include Secure, HttpOnly, and SameSite attributes.

HTTP → HTTPS Redirect Fail

HTTP requests are not redirected to HTTPS. Visitors on http:// receive an unencrypted connection.

TLS Version Pass

Server enforces TLS 1.2 or higher - deprecated protocol versions are rejected.

Mixed Content Pass

No HTTP resources found loading on this HTTPS page.

Tracking Scripts Warning 1 found

1 third-party tracker(s) detected on this page.

Google Analytics 4

Google Analytics 4 Warning

Third-party tracking script detected on this page.

Contact Email Addresses Pass

All detected email addresses use the site's own domain - good professional practice.

HTTPS Enforcement Pass

Page served over HTTPS.

Health Form Fields Warning

Health-related form content detected. Keywords: health, medical, patient, ssn, condition, hipaa, treatment, provider. Ensure HIPAA-compliant safeguards are in place.

Tracker Exposure on Health Page Fail

Health-sensitive form content found alongside 1 tracker(s): Google Analytics 4. This may constitute a HIPAA/privacy violation.

A privacy policy link or reference was detected on this page.

Notice of Privacy Practices Pass

A Notice of Privacy Practices (NPP) reference was detected — required under HIPAA §164.520.

No Terms of Service, Terms of Use, or Terms & Conditions link found. Publishing clear terms protects your organization and sets user expectations.

HIPAA Notice Pass

A HIPAA Notice or dedicated HIPAA policy page was detected.

Cookie Policy Pass

A cookie policy, notice, or consent reference was detected.

Accessibility Statement Pass

An accessibility statement, ADA compliance notice, or WCAG reference was detected.

Non-Discrimination Policy Fail

No non-discrimination policy found. Section 1557 of the ACA requires healthcare entities receiving federal funds to post a notice of non-discrimination.

State Privacy Rights Notice Fail

No state privacy rights notice found. Healthcare organizations should address state-level consumer privacy laws (CCPA/CPRA, VCDPA, Washington My Health MY Data Act, etc.) that may apply to their patients and website visitors.

Form Service Compliance Pass

No known non-HIPAA form services detected.

Chat Widget Risk Pass

No known non-HIPAA chat widgets detected.

Subresource Integrity (SRI) Warning

5 external script(s) lack SRI integrity attributes: stats.wp.com, www.googletagmanager.com, embeds.iubenda.com, www.dlmreview.com. A compromised CDN could inject malicious code into your pages.

SPF Record Pass

v=spf1 include:spf.protection.outlook.com -all

DMARC Record Fail

No DMARC record. Add TXT record at _dmarc.medskinessentials.com: v=DMARC1; p=quarantine; rua=mailto:[email protected]

DKIM Record Pass

Found on selector 's1': k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvaCf8rAi8ZIS1DPbigHLwe…

✨

Get an AI summary of this report

Open a new chat with your report pre-loaded

ChatGPT Claude Gemini

HSTS: Missing. Recommended: max-age=31536000; includeSubDomains

X-Content-Type-Options: Missing. Recommended: nosniff

X-Frame-Options: Missing. Recommended: SAMEORIGIN

Referrer-Policy: Missing. Recommended: strict-origin-when-cross-origin

Permissions-Policy: Missing. Recommended: geolocation=(), microphone=(), camera=()

Server Information Disclosure: Server headers expose version/technology: cloudflare, WP Engine. Remove or redact to avoid leaking infrastructure details.

HTTP → HTTPS Redirect: HTTP requests are not redirected to HTTPS. Visitors on http:// receive an unencrypted connection.

Tracking Scripts: 1 third-party tracker(s) detected on this page.

Google Analytics 4: Third-party tracking script detected on this page.

Health Form Fields: Health-related form content detected. Keywords: health, medical, patient, ssn, condition, hipaa, treatment, provider. Ensure HIPAA-compliant safeguards are in place.

Tracker Exposure on Health Page: Health-sensitive form content found alongside 1 tracker(s): Google Analytics 4. This may constitute a HIPAA/privacy violation.

Terms of Service: No Terms of Service, Terms of Use, or Terms & Conditions link found. Publishing clear terms protects your organization and sets user expectations.

Non-Discrimination Policy: No non-discrimination policy found. Section 1557 of the ACA requires healthcare entities receiving federal funds to post a notice of non-discrimination.

State Privacy Rights Notice: No state privacy rights notice found. Healthcare organizations should address state-level consumer privacy laws (CCPA/CPRA, VCDPA, Washington My Health MY Data Act, etc.) that may apply to their patients and website visitors.

Subresource Integrity (SRI): 5 external script(s) lack SRI integrity attributes: stats.wp.com, www.googletagmanager.com, embeds.iubenda.com, www.dlmreview.com. A compromised CDN could inject malicious code into your pages.

DMARC Record: No DMARC record. Add TXT record at _dmarc.medskinessentials.com: v=DMARC1; p=quarantine; rua=mailto:[email protected]

Ready to Fix These Issues?

Our specialists can remediate every finding, protect your patients, and keep your website secure.

Fix My Website →

https://medskinessentials.com