CITT

    Scan results

    CommonSpirit - AR/GA/KY/TN/TX

    iOS

    Epic MyChart patient portal for CommonSpirit Health System. Access medical records, test results, medications, appointments, and sync health data with HealthKit.

    CITT SCORE
    76
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Patients managing care with CommonSpirit Health

    What It Means For You

    Health data stays within the app with no third-party services receiving user information. Network connections have some weaker protections, which means data sent over public Wi-Fi travels with less protection than expected. Overall, personal and medical information is handled with reasonable care.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (19)

    Data Security

    4 total
    1 Medium
    2 Low
    1 Info

    Network Security

    6 total
    2 High
    1 Medium
    1 Low
    2 Info

    Code Security

    6 total
    1 Medium
    1 Low
    4 Info

    Privacy

    3 total
    1 Medium
    1 Low
    1 Info

    Security Strengths

    • ✓No third-party SDKs, analytics, advertising, or tracking — zero PHI exposure to external platforms
    • ✓No embedded API keys, secrets, or hardcoded credentials anywhere in the IPA bundle
    • ✓Keychain usage confirmed with clearKeychainOnInstall best practice to prevent credential persistence across reinstalls
    • ✓Session idle timeout (EnableIdleTimer) active
    • ✓Universal Links correctly configured to prevent URL scheme hijacking
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    health
    sensitive data
    location

    Package

    org.commonspirit.CommonSpiritSouth

    Version

    11.5.2 (Build 11.5.2.1)

    Analysis Date

    Apr 6, 2026

    0

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on App Store

    Recommendation: Acceptable

    Key Findings

    Data Security - 4 findings (1 medium, 2 low, 1 info)

    Network Security - 6 findings (2 high, 1 medium, 1 low, 2 info)

    Code Safety - 0 findings

    Privacy - 3 findings (1 medium, 1 low, 1 info)

    Privacy Concerns

    What Data is Collected

    The app collects personal and health information needed for patient portal use, including name, contact details, and medical record access for appointment scheduling and care management.

    Third-Party Data Sharing

    No third-party services were identified as receiving user data. Health information remains within the app and CommonSpirit Health's own systems.

    Understanding the Scores

    CategoryScore
    Security71/100
    Privacy87/100
    Data Security77/100
    Network Security58/100
    Code Safety92/100
    Data Collection90/100
    Data Sharing100/100
    User Control92/100

    Positive Security Features

    • Health information is not shared with advertising networks or analytics companies
    • Strong user controls give patients meaningful authority over their own data
    • The app's code is built with solid safety practices, reducing the risk of common software errors affecting the device

    Areas for Improvement

    • Some network connections use older or weaker protection methods, meaning data sent over public Wi-Fi or untrusted networks travels with less protection than expected.
    • Data stored locally on the device could benefit from stronger protections in case the phone is lost or accessed without permission.
    • Improving how the app verifies the identity of the servers it communicates with would provide better protection on public networks.

    About This Analysis

    This scorecard is based on automated static analysis of the application's code and configuration. Scores reflect security and privacy practices at the time of the scan.

    App Details

    • App: org.commonspirit.CommonSpiritSouth
    • Version: 11.5.2 (Build 11.5.2.1)
    • Scan Date: 2026-04-06

    Right of Reply

    Developer not yet contacted