Perin Health is committed to protecting the security, safety, and privacy of its products, systems, and users. We welcome reports from security researchers, customers, healthcare organizations, and other members of the public who believe they have identified a potential cybersecurity vulnerability affecting a Perin Health product or service.
Reporting a Vulnerability
Please report suspected vulnerabilities by emailing: security@perinhealth.com
Include as much of the following information as possible:
● The affected product, service, application, API, or system
● The product or software version, if known
● A description of the suspected vulnerability
● The steps required to reproduce the issue
● The potential security or patient-safety impact
● Relevant screenshots, logs, or proof-of-concept information
● Your name and contact information, if you would like a response
● Whether you intend to disclose the vulnerability publicly
Please do not include patient information, protected health information, credentials, or other sensitive personal data in your report.
Our Response
Perin Health will:
● Acknowledge receipt of a vulnerability report within two business days
● Review and triage the reported issue
● Contact the reporter if additional information is needed
● Provide reasonable status updates during the investigation
● Coordinate remediation and disclosure activities when appropriate
● Notify affected stakeholders when necessary to protect patient safety and product security
Remediation timelines will depend on the severity, complexity, exploitability, and potential patient-safety impact of the vulnerability.
Responsible Research Guidelines
When conducting security research, please:
● Make a good-faith effort to avoid privacy violations, data loss, patient harm, and interruption of Perin Health services
● Access only the information necessary to demonstrate the vulnerability
● Stop testing and notify Perin Health immediately if patient information, personal information, or other sensitive data is encountered
● Do not modify, retain, download, or disclose data belonging to others
● Do not perform denial-of-service testing, social engineering, phishing, physical intrusion, or destructive testing
● Do not introduce malware or otherwise impair a product or service
● Allow Perin Health a reasonable opportunity to investigate and address the issue before publicly disclosing it
Good-Faith Research
Perin Health will not pursue legal action against individuals who conduct security research in good faith and comply with this policy. Research that causes harm, compromises patient safety, violates privacy, disrupts services, or exceeds the boundaries of this policy is not authorized.
Coordinated Disclosure
Please do not publicly disclose a suspected vulnerability until Perin Health has had a reasonable opportunity to investigate and remediate it. Perin Health will work with reporters in good faith to coordinate an appropriate disclosure timeline.
Where appropriate and with the reporter’s permission, Perin Health may publicly acknowledge individuals who responsibly report validated vulnerabilities.
Patient-Safety Concerns
If you believe a vulnerability presents an immediate risk to patient safety, clearly state “URGENT PATIENT-SAFETY CYBERSECURITY ISSUE” in the email subject line.
This reporting channel is not intended for medical emergencies, clinical support, or general customer-service requests. If you are experiencing a medical emergency, contact local emergency services.