Healthcare App Testing Checklist (HIPAA-aware, 2026)

Healthcare apps sit at the intersection of safety, privacy, and regulation. A bug that would be minor in a social app can be a HIPAA violation or a care-delivery failure here. This checklist focuses o

Healthcare apps sit at the intersection of safety, privacy, and regulation. A bug that would be minor in a social app can be a HIPAA violation or a care-delivery failure here. This checklist focuses on what to verify before shipping — privacy, correctness, accessibility, and the fail-safes that prevent harm.

Why healthcare QA is different

Three reasons:

1. PHI (Protected Health Information) must not leak — logs, screenshots, crash reports, analytics, URL parameters. HIPAA and equivalents penalize leakage heavily.
2. Safety matters — wrong medication dose, missed allergy warning, overlooked drug interaction. UX bugs become clinical incidents.
3. Regulation — FDA / CE mark if the app is a medical device, HITRUST certification, audit logs, retention, consent.

Privacy and compliance

1. PHI never logged to logcat / NSLog / console
2. PHI never in crash reports (verify with intentional crash)
3. Screenshots disabled on screens showing PHI
4. Background app switcher shows blank / logo, not PHI
5. Clipboard cleared after copying patient data
6. Biometric / passcode required to view records
7. Auto-lock within 2 minutes of inactivity
8. Session invalidated on app background > 30 seconds
9. No PHI in push notification payloads (user opts in explicitly)
10. Analytics events scrubbed of PHI
11. TLS 1.2+ enforced, cert pinning active
12. No PHI in URL parameters or deep links
13. Audit log captures every record access with user + timestamp

Authentication and access

1. Strong password policy (12+ chars, complexity)
2. 2FA mandatory for provider accounts
3. Patient accounts optional 2FA, prompted on setup
4. Role-based access — nurse cannot see data scoped to physician
5. Shared-device mode — quick switch without full re-login
6. Account lockout after 5 failed attempts

Clinical correctness

1. Medication dose calculations correct across weight, age, BMI inputs
2. Unit conversion (kg ↔ lb, °C ↔ °F) correct on every screen
3. Allergy warnings fire on every relevant order, not just some
4. Drug interaction check runs on every new prescription
5. Immunization schedule correct per guideline updates
6. Vital sign normal ranges age-appropriate
7. Pediatric doses clearly distinguished from adult
8. Pregnancy warnings visible for contraindicated medications

Data display

1. Patient name, DOB, MRN visible on every clinical screen
2. Units always shown (never "Glucose: 120" without "mg/dL")
3. Timestamps in user's timezone, marked as such
4. Large numbers formatted for readability (10,000 not 10000)
5. Ranges color-coded but not color-only (high/low/critical)
6. Abnormal values flagged visually and announced by screen reader

Forms and input

1. Required fields cannot be skipped
2. Input validation at field level (SSN format, phone format)
3. Error messages specific ("Enter a valid 10-digit phone" not "Invalid")
4. Numeric fields use numeric keyboard
5. Date pickers reject future DOB
6. Long free-text fields (chief complaint) handle newlines

Medication and prescriptions

1. Prescribing flow requires at least 3 confirmations for controlled substances
2. E-prescribe integration tested end-to-end with sandbox pharmacy
3. Refill requests reach the right pharmacy
4. Stop-order date enforced
5. Allergy check fires BEFORE the prescribe button enables

Emergency workflows

1. Emergency contact prominent on every patient screen
2. Code status visible on chart header
3. Rapid response / escalation flow reachable in ≤ 2 taps
4. Offline mode preserves critical reference data (dosing tables, protocols)

Accessibility

1. WCAG 2.1 AA minimum (HHS enforces for federally-funded health apps)
2. Text resizes to 200% without loss
3. Screen reader announces vital signs and medication names correctly
4. Color not the only signal for abnormal values
5. Touch targets at least 48dp — often 64dp preferred for clinical settings

Integration

1. FHIR endpoint responses validate against schema
2. HL7 messages formatted correctly (delimiter issues)
3. EHR sync handles concurrent edits without data loss
4. Lab result delivery time (order → result) tracked and alerted if delayed

Device-specific

1. Camera access for wound photos — image compression respects PHI, EXIF stripped
2. Voice-to-text does not send PHI to Google / Apple cloud services without consent
3. Bluetooth medical devices (pulse ox, glucometer) pair securely

How SUSA helps healthcare QA

SUSA's accessibility_user persona runs WCAG checks per-screen. The adversarial persona tries to exercise corner cases (very long input, special chars). Security analyzer checks for PHI in logs, URLs, clipboard, and screenshots. The business_professional persona checks clinical workflow efficiency (taps-to-complete for common orders). Network intelligence detects any PHI sent over cleartext.

susatest-agent test clinicalapp.apk --persona accessibility_user
susatest-agent test clinicalapp.apk --persona adversarial --security-depth full

For HIPAA-critical apps, SUSA is one layer. Run annual penetration testing by a certified firm, run clinical validation by medical staff, run patient-facing usability studies. SUSA reduces the catchable-by-automation bug surface substantially but does not replace human clinical review.