TITAN AI - HEALTHCARE TIER - LIVE PROOF

Detector: PHI-001
Storage account containing Protected Health Information (PHI) has server-side encryption disabled. Blob containers with patient records, lab results, and discharge summaries are stored in cleartext, exposing ePHI to unauthorized access if the storage layer is compromised.

Detector: HIP-003
The FHIR R4 API endpoint exposes the bulk $export operation without requiring OAuth 2.0 bearer token authentication. An unauthenticated caller can initiate a full patient data export, extracting the entire patient population dataset including demographics, diagnoses, medications, and insurance information.

Detector: HIP-007
HL7v2 ADT (Admit/Discharge/Transfer) messages containing patient Social Security Numbers in PID-19 segment are transmitted over unencrypted TCP port 2575. Network packet inspection confirmed SSN values visible in plaintext during transit between the ADT interface engine and the Application Gateway backend pool.

Detector: AUD-001
Azure Activity Log diagnostic settings are not configured at the subscription level. Administrative actions, security events, resource health changes, and data-plane access operations are not being captured to a centralized Log Analytics workspace or storage account. This creates a gap in the audit trail required for breach investigation and compliance reporting.

Detector: PHI-004
Storage account designated as the PHI archive retains patient data blobs in the hot access tier for 180 days before lifecycle management moves them to cool storage. The organization retention policy mandates that PHI older than 90 days must be migrated to archive-tier immutable storage. This 90-day gap increases exposure window and storage cost for sensitive ePHI.

Detector: BAA-002
The healthcare subscription is actively processing Protected Health Information but no Business Associate Agreement (BAA) has been executed with the cloud service provider for this subscription. Under HIPAA, any entity that creates, receives, maintains, or transmits PHI on behalf of a covered entity must have a signed BAA in place before processing begins.

Detector: SEC-011
The patient-facing web portal issues session tokens with a static lifetime and no server-side rotation. Analysis of the App Service authentication configuration shows session cookies persisting beyond 30 minutes without re-authentication or token refresh. This allows session hijacking attacks to maintain unauthorized access to patient health records indefinitely.

Detector: SEN-004
The EHR SQL database containing patient records has Transparent Data Encryption (TDE) disabled. Automated backup files (.bak) are stored without encryption, meaning a compromised backup file would expose the full patient database including demographics, clinical notes, medication history, and insurance details in plaintext.

Detector: BAS-001
Network Security Group attached to the clinical workstation subnet contains an inbound rule allowing TCP port 3389 (RDP) from source 0.0.0.0/0. This exposes clinical workstations with access to the EHR system directly to brute-force attacks, credential stuffing, and known RDP exploits (BlueKeep, DejaBlue) from any internet source.

Detector: CMP-008
The Key Vault storing PHI encryption keys and FHIR API credentials has an access policy granting GET permissions on secrets and keys to a service principal with tenant-wide scope. This broad access violates the principle of least privilege and allows any application registered under the overly permissive service principal to retrieve PHI encryption keys.

Detector: SCT-015
The API Management instance hosting the clinical FHIR REST API does not enforce rate limiting on the /Patient/$everything endpoint. This operation returns the complete health record for a patient and is computationally expensive. Without throttling, an attacker with a valid token could enumerate and exfiltrate the entire patient database through rapid sequential calls.

Detector: SEC-019
The DICOM medical imaging viewer web application renders patient name metadata from DICOM headers without HTML entity encoding. An attacker who can inject a crafted DICOM file with a malicious patient name tag (0010,0010) can execute arbitrary JavaScript in the browser session of any clinician viewing the study. This enables session hijacking and unauthorized PHI access.

Detector: AIG-003
AI behavioral analysis detected an anomalous pattern: a service account executed bulk SELECT queries against the patient demographics table between 02:00-04:00 UTC, outside of normal ETL processing windows. The query volume exceeded the 30-day baseline by 340%. This pattern is consistent with unauthorized data exfiltration or compromised service account credentials.

Detector: PLS-002
The storage account hosting PHI container logs does not have its own diagnostic settings configured. Blob read, write, and delete operations on containers holding patient documents, imaging files, and clinical attachments are not being audited. This creates a blind spot in the access trail for sensitive healthcare data.

Detector: PRD-001
The production resource group containing all healthcare tier resources does not have a CanNotDelete management lock applied. Any user or automation with Contributor or Owner RBAC role can accidentally or maliciously delete the entire resource group and all contained resources including databases, storage accounts, and FHIR services, causing catastrophic data loss and service disruption.

Detector: CND-005
The API Management gateway serving clinical FHIR endpoints still accepts TLS 1.0 and TLS 1.1 connections. These protocol versions contain known vulnerabilities (POODLE, BEAST) that allow man-in-the-middle attackers to decrypt PHI transmitted between clinical applications and the API gateway. PCI DSS and HIPAA both mandate TLS 1.2 as the minimum protocol version.

Detector: FRG-012
The patient portal web application authenticates to backend services (SQL Database, Key Vault, Storage) using stored connection strings with embedded credentials instead of Azure Managed Identity. Stored credentials in application settings create a credential sprawl risk and require manual rotation, increasing the probability of credential exposure through configuration dumps or application vulnerabilities.

Detector: BAS-009
The clinical DICOM imaging workstation virtual machine has Azure Disk Encryption (ADE) disabled on its OS disk. The VM processes and temporarily caches medical imaging files (X-rays, MRIs, CT scans) that contain patient PHI embedded in DICOM metadata. An unencrypted OS disk snapshot or VHD export would expose cached patient imaging data.