Is schweigerderm.com HIPAA secured?

Based on our automated scan, schweigerderm.com has security issues that need to be addressed — 8 check(s) failed.

What does a HIPAA security scan check for?

Our HIPAA security scan checks for SSL/TLS encryption, security headers (HSTS, X-Frame-Options, etc.), third-party tracking scripts that may expose patient data, presence of a Privacy Policy and Notice of Privacy Practices, cookie security, email authentication (SPF, DMARC, DKIM), mixed content, health form field exposure, and more.

How do I fix HIPAA security issues on my website?

Common fixes include installing an SSL certificate, adding security headers via your web server configuration, removing non-compliant tracking scripts, publishing a HIPAA-compliant Privacy Policy and Notice of Privacy Practices, and ensuring contact forms use HIPAA-compliant services. View the full recommendations in this report or contact a HIPAA specialist for hands-on remediation.

HIPAA Security Scan: schweigerderm.com - HIGH PRIORITY

SSL / TLS

Security Headers

Transport Security

Cookie Security

Tracking Scripts

Contact Emails

Health Data Safety

Privacy & Legal

Resource Integrity

SPF

DMARC

DKIM

15 Recommendations Available

See actionable steps to improve your HIPAA security score.

View Recommendations

Ready to fix these issues? Our specialists can remediate every finding.

Fix My Website →

SSL/TLS Certificate Pass

Valid certificate - expires in 39 days (issued by Google Trust Services)

HSTS Fail

Missing. Recommended: max-age=31536000; includeSubDomains

X-Content-Type-Options Fail

Missing. Recommended: nosniff

X-Frame-Options Pass

✓ SAMEORIGIN

Referrer-Policy Fail

Missing. Recommended: strict-origin-when-cross-origin

Permissions-Policy Fail

Missing. Recommended: geolocation=(), microphone=(), camera=()

Server Information Disclosure Warning

Server headers expose version/technology: cloudflare, WP Engine. Remove or redact to avoid leaking infrastructure details.

Cookie Security Flags Pass

All 1 cookie(s) include Secure, HttpOnly, and SameSite attributes.

HTTP → HTTPS Redirect Fail

HTTP requests are not redirected to HTTPS. Visitors on http:// receive an unencrypted connection.

TLS Version Pass

Server enforces TLS 1.2 or higher - deprecated protocol versions are rejected.

Mixed Content Pass

No HTTP resources found loading on this HTTPS page.

Tracking Scripts Warning 2 found

2 third-party tracker(s) detected on this page.

Google Analytics 4 Google Tag Manager

Google Analytics 4 Warning

Third-party tracking script detected on this page.

Google Tag Manager Warning

Third-party tracking script detected on this page.

Contact Email Addresses Pass

All detected email addresses use the site's own domain - good professional practice.

HTTPS Enforcement Pass

Page served over HTTPS.

Health Form Fields Warning

Health-related form content detected. Keywords: health, medical, diagnosis, patient, insurance, dob, ssn, condition. Ensure HIPAA-compliant safeguards are in place.

Tracker Exposure on Health Page Fail

Health-sensitive form content found alongside 2 tracker(s): Google Analytics 4, Google Tag Manager. This may constitute a HIPAA/privacy violation.

A privacy policy link or reference was detected on this page.

Notice of Privacy Practices Pass

A Notice of Privacy Practices (NPP) reference was detected — required under HIPAA §164.520.

A Terms of Service / Terms of Use / Terms & Conditions link was detected.

HIPAA Notice Fail

No HIPAA Notice or policy page detected. Healthcare organizations should clearly communicate their HIPAA compliance posture.

Cookie Policy Pass

A cookie policy, notice, or consent reference was detected.

Accessibility Statement Pass

An accessibility statement, ADA compliance notice, or WCAG reference was detected.

Non-Discrimination Policy Fail

No non-discrimination policy found. Section 1557 of the ACA requires healthcare entities receiving federal funds to post a notice of non-discrimination.

State Privacy Rights Notice Pass

A state privacy rights notice was detected (CCPA, CPRA, VCDPA, Washington WMHMD, or similar).

Form Service Compliance Pass

No known non-HIPAA form services detected.

Chat Widget Risk Warning

Chat widget(s) detected: HubSpot. Confirm a HIPAA BAA is in place with each provider before collecting any patient information through these channels.

Subresource Integrity (SRI) Warning

2 external script(s) lack SRI integrity attributes: cdn.cookielaw.org, www.googletagmanager.com. A compromised CDN could inject malicious code into your pages.

SPF Record Pass

v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net include:sendgrid.net include:spf.mandrillapp.com include:4505846.spf04.hubspotemail.net include:mail.verity.cloud a:mail.axomo.com a:mail1.axomo.com a:mail2.axomo.com -all

DMARC Record Pass

v=DMARC1; p=quarantine; sp=quarantine; np=reject; adkim=r; aspf=r; rua=mailto:[email protected],mailto:[email protected]

DKIM Record Pass

Found on selector 'k1': k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9…

✨

Get an AI summary of this report

Open a new chat with your report pre-loaded

ChatGPT Claude Gemini

HSTS: Missing. Recommended: max-age=31536000; includeSubDomains

X-Content-Type-Options: Missing. Recommended: nosniff

Referrer-Policy: Missing. Recommended: strict-origin-when-cross-origin

Permissions-Policy: Missing. Recommended: geolocation=(), microphone=(), camera=()

Server Information Disclosure: Server headers expose version/technology: cloudflare, WP Engine. Remove or redact to avoid leaking infrastructure details.

HTTP → HTTPS Redirect: HTTP requests are not redirected to HTTPS. Visitors on http:// receive an unencrypted connection.

Tracking Scripts: 2 third-party tracker(s) detected on this page.

Google Analytics 4: Third-party tracking script detected on this page.

Google Tag Manager: Third-party tracking script detected on this page.

Health Form Fields: Health-related form content detected. Keywords: health, medical, diagnosis, patient, insurance, dob, ssn, condition. Ensure HIPAA-compliant safeguards are in place.

Tracker Exposure on Health Page: Health-sensitive form content found alongside 2 tracker(s): Google Analytics 4, Google Tag Manager. This may constitute a HIPAA/privacy violation.

HIPAA Notice: No HIPAA Notice or policy page detected. Healthcare organizations should clearly communicate their HIPAA compliance posture.

Non-Discrimination Policy: No non-discrimination policy found. Section 1557 of the ACA requires healthcare entities receiving federal funds to post a notice of non-discrimination.

Chat Widget Risk: Chat widget(s) detected: HubSpot. Confirm a HIPAA BAA is in place with each provider before collecting any patient information through these channels.

Subresource Integrity (SRI): 2 external script(s) lack SRI integrity attributes: cdn.cookielaw.org, www.googletagmanager.com. A compromised CDN could inject malicious code into your pages.

Ready to Fix These Issues?

Our specialists can remediate every finding, protect your patients, and keep your website secure.

Fix My Website →

https://schweigerderm.com