The Finding You Were Asked to Bury
You are a senior penetration tester. On an authorized test of a patient portal you found that the API accepts any record ID and returns the full record to any logged-in user. To prove it you retrieved three records - real patients, one of whom you recognize as a local public figure. Your draft report describes the flaw and the proof. The client's VP of Engineering calls: "That endpoint is by design - our partner clinics use it. Take it out of the report." Your master services agreement says findings go to the client and may not be disclosed to third parties without written consent. The client is a HIPAA covered entity and represents 30% of your firm's revenue this year. Your firm's partner reviews the report before it is issued.
1. What do you do with the finding and the concealment request?
Read the worked answer
Keep the finding in the report. Refuse the removal.
The request mislabels the issue. "By design" describes the client's intent, not the behavior - an endpoint that returns any patient's full record to any authenticated user is an authorization failure regardless of why it exists. If partner clinics genuinely need cross-tenant access, that is exactly the control that is missing: a mapping from the authenticated principal to the records they are entitled to. Removing the finding would leave the client believing they have been tested and are clean.
On the MSA: read it precisely. It restricts disclosure to third parties - it does not license an inaccurate report to the client. Those are different obligations and the VP is conflating them.
Standard, defensible practice is to keep the finding and add the client's management response verbatim alongside it - "the client states this behavior is intentional for partner clinic use and disputes the rating." That gives the VP what they actually want (their position on the record) without falsifying yours. If they still refuse, issue the report with the technical facts as observed.
2. What is your obligation regarding the three patient records you accessed?
Read the worked answer
This depends on the rules of engagement, and you should check them before you say anything else.
- If the RoE permitted accessing real data as proof (common in a live production test with a BAA in place), you were authorized, but you still have custody obligations: retain only the minimum evidence, store it encrypted and access-restricted, do not paste the PHI into the report body - cite record identifiers and redact content - and purge copies at report close.
- If the RoE did not permit viewing real patient data - or there is no BAA covering you - then your test itself created an access event the client must evaluate, and possibly a reportable one. That must be disclosed to the client in writing, promptly, with the specifics: which records, when, by whom, and what you retained.
Either way, the public-figure detail is irrelevant to the technical finding and must not appear anywhere. It is also a reason to be careful about who inside your firm sees the evidence file.
Be honest about the uncomfortable part: a tester who discovers an authorization flaw by exploiting it has stepped into the same risk they are reporting, and saying so first is far better than being asked later.
3. How do you raise this internally, and what if the partner sides with the client?
Read the worked answer
Raise it in writing, before the report is issued. A short note to the partner and the engagement lead: the request received, your assessment that the finding is accurate and material, what you propose (finding retained plus management response), and the PHI custody question. This is not an accusation - it is the normal paper trail that protects everyone, including the partner.
If the partner sides with the client, work up the ladder rather than out the door:
- Firm's quality/risk or ethics lead. Most firms have one, and a suppression request on a material security finding in a healthcare context is precisely what that role exists for.
- Refuse to be the named tester on a report you believe is misleading. That is a real and available step; it is not the same as resigning, and it puts the decision where it belongs.
- Recognize the revenue conflict explicitly. 30% of revenue is exactly the pressure that makes independent review necessary, and naming it out loud is the professional move, not an embarrassment.
Be clear-eyed about the limit: you generally cannot report the client to a regulator without consent where the MSA forbids it, and you should not pretend otherwise. What you can do is refuse to sign, refuse to soften, and document. Those are sufficient. Signing a false report because the alternative is uncomfortable is not.