List of UK healthcare companies that are not “secure by default”

By /

This is one of several posts of the topic of security of websites. Inspired by my initial post on the security of UK banks.

The reason for splitting this data into multiple posts is to make it more manageable. So that data on one institution is not mixed with data on another type of institution.

The following key is used for the secure status:

YesThe site is secure, loaded via https
DualThe site can be loaded via http, or via https.
InvalidThe site loads via https, but the security certificate is invalid and thus the site is insecure.
PartialThe site loads via https, but loads some parts of the page without https. The site is insecure.
NoThe site is loaded via http, not via https.
FixedThe site is loaded via https, but at the time of first writing it was loaded via http.
??We could not find a website to evaluate.

We tested 24 healthcare companies. We found 2 healthcare companies that did not have a secure home page (not https or did have https with an invalid security certificate). That is 8% of UK healthcare companies have security vulnerabilities.

Healthcare companySecureHome Page
Aviva HealthcareYeshttps://www.aviva.co.uk/
AXA PPPYeshttps://www.axappphealthcare.co.uk/
Benenden Healthcare SocietyYeshttps://www.benenden.co.uk/
Birmingham Hospital Saturday FundYeshttps://www.bhsf.co.uk/
BupaYeshttps://www.bupa.co.uk/
CS HealthcareYeshttps://www.cshealthcare.co.uk/
Engage Mutual AssuranceYeshttps://www.onefamily.com/
Exeter Family FriendlyYeshttps://www.the-exeter.com/
General & Medical HealthcareYeshttps://www.generalandmedical.com/
Health-on-LineYeshttps://www.health-on-line.co.uk/
HealthshieldYeshttps://www.healthshield.co.uk/
HSFYeshttps://www.hsf.co.uk
InsuretyNohttp://www.april-uk.com
MedicashYeshttps://www.medicash.org
National FriendlyYeshttps://nationalfriendly.co.uk/
SagaDualhttp://www.saga.co.uk
Secure HealthYeshttps://www.securehealth.co.uk/
Sovereign HealthYeshttps://www.sovereignhealthcare.co.uk/
Simply HealthYeshttps://www.simplyhealth.co.uk/
VitalityYeshttps://www.vitality.co.uk/
WestfieldYeshttps://www.westfieldhealth.com/
WHAYeshttps://www.whahealthcare.co.uk/
WHCAYeshttps://www.orchardhealthcare.co.uk/
WPAYeshttps://www.wpa.org.uk/

Commentary

Saga’s website is avialable via http and via https. This should be https only.

Disclaimer

I shouldn’t need to point this out, but i will, all the same, just to be clear.

The data provided on this page should taken at face value. If you’re not sure about something, please verify it yourself. Nothing reported here should be regarded as a criticism or an endorsement or recommendation of an organisations security effectiveness. I am simply passing comment on whether the home page (whatever that may be) is provided as https on not. Other security concerns are a separate matter.

If your organisation is listed here and is not marked as secure, your best course of action is to fix that, not to complain that someone is reporting a fact anyone with a web browser can discover. The security status of your home page is public information, albeit information that many people don’t understand.

Guest posts

No, we’re not interested in having a guest post about finance related topics. These articles are about security, not finance.

Original post

This post was originally published 15 Dec 2017 on the softwareverify.com blog. We moved these posts to this dedicated domain 27 March 2025.

Scroll to Top