Playing with FHIR? Don't get burned, white-hat hacker cautions

This October, cybersecurity expert Alissa Knight released a white paper in partnership with API threat protection vendor Aproov exploring how healthcare's so-called last mile remains vulnerable to attacks. The report, called "Playing With FHIR," was "the largest unveiling of vulnerabilities in the history of the healthcare industry since the first electronic healthcare system came online in the 1960s," said Knight in her keynote at the HIMSS Healthcare Cybersecurity Forum on Monday. For the report, Knight tested three production FHIR APis, which served an ecosystem of 48 apps and APIs. All told, the ecosystem covered aggregated electronic health record data from 25,000 providers and payers. Knight also found that 100% of FHIR APIs tested allowed API access to other patients' health data using one patient's credentials