Fix My Website
HIPAA Report

https://thedermbar.com

Oct 9, 2026 RPT-A13A1D0F View Site

* Rescans available every 24 hours

HIGH PRIORITY
6 failed · 1 warning

* We detected the following that may create HIPAA privacy or security risks on your website.

23
Passed
6
Failed
1
Warnings
30
Checks
SSL / TLS
Security Headers
Transport Security
Cookie Security
Tracking Scripts
Contact Emails
Health Data Safety
Privacy & Legal
Resource Integrity
SPF
DMARC
DKIM
7 Recommendations Available
See actionable steps to improve your HIPAA security score.
View Recommendations
Ready to fix these issues? Our specialists can remediate every finding.
Fix My Website →
SSL / TLS
1 passed
SSL/TLS Certificate Pass
Valid certificate - expires in 86 days (issued by Google Trust Services)
Security Headers
5 passed 1 failed
Fix My Website
HSTS Pass
✓ max-age=31536000
X-Content-Type-Options Pass
✓ nosniff
X-Frame-Options Pass
✓ SAMEORIGIN
Referrer-Policy Pass
✓ strict-origin-when-cross-origin
Permissions-Policy Fail
Missing. Recommended: geolocation=(), microphone=(), camera=()
Server Information Disclosure Pass
Server and technology headers do not expose version information.
Cookie Security
1 passed
Cookie Security Flags Pass
All 1 cookie(s) include Secure, HttpOnly, and SameSite attributes.
Transport Security
3 passed
HTTP → HTTPS Redirect Pass
HTTP traffic correctly redirects to HTTPS.
TLS Version Pass
Server enforces TLS 1.2 or higher - deprecated protocol versions are rejected.
Mixed Content Pass
No HTTP resources found loading on this HTTPS page.
Tracking & Analytics
1 passed
Tracking Scripts Pass
No known third-party tracking scripts detected.
Contact Email Quality
1 passed
Contact Email Addresses Pass
All detected email addresses use the site's own domain - good professional practice.
Health Data Safety
3 passed
HTTPS Enforcement Pass
Page served over HTTPS.
Health Form Fields Pass
No forms found.
Third-Party Tracker Exposure Pass
No health-sensitive form content detected - tracker exposure risk is low.
Privacy & Legal
7 passed 3 failed
Fix My Website
Privacy Policy Pass
A privacy policy link or reference was detected on this page.
Notice of Privacy Practices Pass
A Notice of Privacy Practices (NPP) reference was detected — required under HIPAA §164.520.
Terms of Service Pass
A Terms of Service / Terms of Use / Terms & Conditions link was detected.
HIPAA Notice Fail
No HIPAA Notice or policy page detected. Healthcare organizations should clearly communicate their HIPAA compliance posture.
Cookie Policy Pass
A cookie policy, notice, or consent reference was detected.
Accessibility Statement Fail
No accessibility statement found. ADA compliance (Section 508 / WCAG 2.1) is increasingly required for healthcare websites serving the public.
Non-Discrimination Policy Fail
No non-discrimination policy found. Section 1557 of the ACA requires healthcare entities receiving federal funds to post a notice of non-discrimination.
State Privacy Rights Notice Pass
A state privacy rights notice was detected (CCPA, CPRA, VCDPA, Washington WMHMD, or similar).
Form Service Compliance Pass
No known non-HIPAA form services detected.
Chat Widget Risk Pass
No known non-HIPAA chat widgets detected.
Resource Integrity
1 passed
Subresource Integrity (SRI) Pass
All external scripts include integrity attributes, or no external CDN scripts were found.
Email Authentication
1 warning 2 failed
Fix My Website
SPF Record Fail
No SPF record found. Add TXT record: v=spf1 include:_spf.google.com ~all
DMARC Record Fail
No DMARC record. Add TXT record at _dmarc.thedermbar.com: v=DMARC1; p=quarantine; rua=mailto:[email protected]
DKIM Record Warning
No DKIM record found on common selectors. Your mail provider may use a custom selector.
✨

Get an AI summary of this report

Open a new chat with your report pre-loaded

ChatGPT Claude Gemini
7 Recommendations
1
Permissions-Policy: Missing. Recommended: geolocation=(), microphone=(), camera=()
2
HIPAA Notice: No HIPAA Notice or policy page detected. Healthcare organizations should clearly communicate their HIPAA compliance posture.
3
Accessibility Statement: No accessibility statement found. ADA compliance (Section 508 / WCAG 2.1) is increasingly required for healthcare websites serving the public.
4
Non-Discrimination Policy: No non-discrimination policy found. Section 1557 of the ACA requires healthcare entities receiving federal funds to post a notice of non-discrimination.
5
SPF Record: No SPF record found. Add TXT record: v=spf1 include:_spf.google.com ~all
6
DMARC Record: No DMARC record. Add TXT record at _dmarc.thedermbar.com: v=DMARC1; p=quarantine; rua=mailto:[email protected]
7
DKIM Record: No DKIM record found on common selectors. Your mail provider may use a custom selector.
Ready to Fix These Issues?
Our specialists can remediate every finding, protect your patients, and keep your website secure.
Fix My Website →