Automated Security Testing of FHIR Healthcare APIs

Problem statement

Healthcare APIs may expose patient information through broken authorization, IDOR/BOLA, role errors or excessive data exposure.

Objective

Create a synthetic FHIR test environment and Python testing tool that automatically checks access-control behavior across user roles.

Student focus

• API security
• Access control
• Automated testing