Practice Fusion Vulnerability Disclosure

generated: '2026-08-14'
method: searched
probe: true
source: https://veradigm.com/legal/security-program/
notes: >-
  There is a published security contact but NO published vulnerability
  disclosure programme. Practice Fusion serves no security.txt on any host
  (api.practicefusion.com and www.practicefusion.com both 404), runs no bug
  bounty on HackerOne, Bugcrowd or Intigriti, and publishes no responsible- or
  coordinated-disclosure policy, safe-harbour statement or triage SLA. The only
  route a finder has is the postal address and compliance mailbox on the parent
  company's Security Program page. Recorded as a real, named, reachable security
  contact — and as an explicit absence of everything else, which for an ONC
  Certified Health IT vendor handling PHI is the notable finding.
formal_vdp: false
bug_bounty: false
safe_harbour: false
security_txt: false
policy: []
contact:
- PandSCompliance@veradigm.com
contact_postal: 'Veradigm LLC, 305 Church at North Hills St, Raleigh, NC 27609, Attention: Chief Security Officer'
security_policy_page: https://veradigm.com/legal/security-program/
evidence:
- {source: 'https://veradigm.com/legal/security-program/', http_status: 200, kind: security-policy-page, note: 'names the Veradigm Security Team, the Chief Security Officer and the PandSCompliance mailbox'}
- {source: 'https://www.practicefusion.com/.well-known/security.txt', http_status: 404, kind: security.txt}
- {source: 'https://api.practicefusion.com/.well-known/security.txt', http_status: 404, kind: security.txt}
- {source: 'https://veradigm.com/.well-known/security.txt', http_status: 403, kind: security.txt}
- {source: 'https://www.practicefusion.com/responsible-disclosure/', http_status: 404, kind: disclosure-page}
- {source: 'https://www.practicefusion.com/vulnerability-disclosure/', http_status: 404, kind: disclosure-page}
- {source: 'https://www.practicefusion.com/security/', http_status: 404, kind: disclosure-page}
recommendation: >-
  Publish /.well-known/security.txt (RFC 9116) on www.practicefusion.com and
  api.practicefusion.com with Contact, Policy, Preferred-Languages and Expires —
  a single static file would close the gap for a platform holding 43M+ clinical
  records.
checked: '2026-08-14'