Vulnerability Disclosure
At Bloomsbury Health, securing clinical communications and protecting patient data is our highest priority. We recognize the vital role that independent security researchers and ethical hackers play in helping us keep our systems, and the clinicians and patients who rely on them safe.
If you believe you have found a security vulnerability in a Bloomsbury Health product or platform, we encourage you to report it to us safely and responsibly.
Safe Harbor
When conducting vulnerability research according to this policy, we consider this research to be:
Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;
Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and
Lawful, helpful to the overall security of the Internet, and conducted in good faith.
You are expected, as always, to comply with all applicable laws.
If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via help@bloomsburyhealth.org before going any further.
Reward Hierarchy (Bug Bounty)
To show our appreciation for researchers who help secure our platforms, Bloomsbury Health offers financial rewards for verified, previously unreported vulnerabilities. Rewards are based on the severity of the vulnerability, determined at our sole discretion using industry standards and the specific real-world impact on clinical data and system integrity.
P1 (Critical): $3500 – $4500
P2 (High): $1500 – $2500
P3 (Medium): $500 – $750
P4 (Low): $175 – $225
(Note: Duplicate reports will not be rewarded; the first researcher to report a valid vulnerability will receive the bounty. Automated scanner output without a valid proof-of-concept is generally ineligible.)
How to Report a Vulnerability
Please submit all vulnerability reports to our actively monitored security inbox:
Contact Address: help@bloomsburyhealth.org
To help us triage and resolve the issue quickly, please include:
1. A clear description of the vulnerability type and its potential impact.
2. The specific URL, IP address, or endpoint where the vulnerability was found.
3. Step-by-step, non-destructive instructions or a benign Proof of Concept (PoC) so our team can accurately reproduce the issue.
4. (Optional) Any recommendations for remediation.
Rules of Engagement
Because our software handles sensitive clinical workflows and facilitates urgent medical care, patient safety and data privacy are non-negotiable. To qualify for a reward and Safe Harbor, you must strictly comply with the following rules:
1. Protect Patient Data at All Costs: If you inadvertently access any actual Personally Identifiable Information (PII) or Protected Health Information (PHI) during your testing, you must stop testing immediately, report the vulnerability to us right away, and permanently delete any local copies. You must not view, save, copy, transfer, or disclose this data.
2, No Disruption of Service: You must not perform any testing that could degrade, disrupt, or deny service to healthcare clinicians. Denial of Service (DoS/DDoS) attacks, network flooding, and high-intensity automated scanning are strictly prohibited.
3. No Destructive Action: Modifying, deleting, or corrupting data that does not belong to you is strictly prohibited.
4. Use Test Accounts Only: Only interact with test accounts that you own or have been granted explicit permission to use. Never interact with real clinician or patient accounts.
5. No Social Engineering or Physical Testing: Do not attempt phishing, vishing, spamming, or physical penetration testing against Bloomsbury Health employees, NHS personnel, or hosting facilities.
Coordinated Disclosure
We ask that you practice Coordinated Vulnerability Disclosure (CVD). Please keep your findings strictly confidential and do not share them publicly or with third parties until Bloomsbury Health has investigated the report, resolved the vulnerability, and fully rolled out the patch to our clinical users.