Security review

Someone sent you this because they want to use ImOnFHIR

ImOnFHIR is an independent FHIR interoperability lab — a validator, payload tools, and a knowledge library for prior-authorization workflows. It runs on synthetic data only: no PHI, no accounts, no tracking. The questions security reviews usually ask are answered on this page; anything yours asks that this page does not cover is an email away.

Request whitelisting / a review Full security posture

What it does

Validates Da Vinci PAS bundles against FHIR standards, washes and compares payloads, and explains how prior-auth interoperability actually works.

What it never has

PHI, user accounts, passwords, tracking cookies, or ad trackers. Just anonymous usage counters (Vercel Analytics).

Who runs it

Nick Dugan BSN, RN-BC, CPHIMS — an independent healthcare interoperability engineer. Not a vendor pitch; a working lab.

About the lab →

Whitelist it in three steps

Review the postureThe /security page covers data handling per tool, subprocessors, and vulnerability disclosure.
Allow the domainsSix domains, listed below. Two are ours; four are cookie-free analytics from Vercel and Google. No ad trackers, no font CDNs, no surprise origins.
Email usQuestionnaires, sign-off requests, or questions — one email, prefilled for you. We respond fast.

Domains to allow

A browser using ImOnFHIR contacts exactly these origins:

imonfhir.com
www.imonfhir.com
va.vercel-scripts.com
vitals.vercel-insights.com
www.googletagmanager.com
www.google-analytics.com

imonfhir.com: The site, the Lab, and its same-origin APIs
www.imonfhir.com: Canonical redirect host
va.vercel-scripts.com: Vercel Analytics script (anonymous, cookie-free)
vitals.vercel-insights.com: Vercel Web Vitals beacon
www.googletagmanager.com: Google Analytics 4 script — public pages only, never a Lab tool
www.google-analytics.com: Google Analytics 4 beacon — cookieless, no advertising endpoints permitted by our CSP

Note: validator.imonfhir.com never sees browser traffic — validation requests go same-origin to imonfhir.com, and our servers talk to the sidecar behind Cloudflare Access.

Data handling at a glance

Surface	Summary
Validator	Pasted payloads are processed transiently on our servers (1 MB cap, not persisted or logged). Synthetic or de-identified FHIR only.
Washer & Compare	Run entirely in the browser. Pasted payloads never reach ImOnFHIR servers — enforced by an automated network-silence test in CI, not just asserted. The Washer produces synthetic test data, not de-identified data. Provider and facility identity, including names, NPIs and addresses, passes through unchanged, and clinical notes are cleared rather than replaced.
Analytics	Anonymous usage counters via Vercel Analytics. No cookies, no identifiers, never payload contents.
Accounts	None. There is no login, no user database, and no personal data to store.

The longer version — including the validator’s server-side path and the full subprocessor list — is on /security.

Submit a request

Whitelisting sign-off, a SIG Lite / CAIQ style questionnaire, or plain questions — send them over and we aim to respond within two business days, usually faster. The button prefills the email so your team only has to fill in the blanks.

Email a security review request

Prefer plain email? Write to security@imonfhir.com. Machine-readable contact: /.well-known/security.txt.