How to report suspected security vulnerabilities responsibly.

This page applies to good-faith reports about suspected security vulnerabilities involving Wells Legacy Health & Wellness websites, forms, digital pages, online resources, public links, public-facing systems, or practice-controlled digital tools.

This page should be read with the Information Security & Data Protection, Privacy Breach Notice Procedure, Web & Mobile Privacy Policy, Terms of Service, and Legal, Privacy & Compliance pages.

Good-faith reports may include suspected concerns such as:

• Broken access control or account access concerns.
• Exposed public pages, files, directories, or unintended public content.
• Suspicious links, phishing pages, fraudulent pages, or impersonation attempts involving the practice.
• Misdirected form data, unintended data display, or website privacy concerns.
• Website configuration concerns that could create security or privacy risk.
• Potential vulnerability affecting a practice-controlled public page or digital tool.
• Security concerns involving contact forms, online resources, booking links, or website integrations.

This Responsible Disclosure page does not authorize security testing, hacking, scanning, exploitation, or any activity that could harm Wells Legacy Health & Wellness, patients, staff, providers, vendors, systems, data, or the public.

Do not:

• Access, copy, download, modify, delete, photograph, store, transmit, disclose, or share patient information or protected health information.
• Attempt to gain unauthorized access to accounts, portals, systems, databases, dashboards, email, servers, files, or vendor platforms.
• Run vulnerability scans, automated scans, password attacks, brute force attacks, denial-of-service testing, load testing, malware, ransomware, or exploit code.
• Conduct phishing, social engineering, pretexting, impersonation, spam, physical security testing, phone calls, staff manipulation, or vendor manipulation.
• Disrupt availability, degrade performance, change content, alter records, bypass controls, or interfere with patient care, operations, scheduling, billing, or communications.
• Publicly disclose a suspected vulnerability before Wells Legacy Health & Wellness has reviewed and addressed the concern.

If you accidentally encounter patient information, protected health information, billing information, login credentials, personal information, employee information, provider information, or other sensitive data, stop immediately and report the concern without copying, saving, transmitting, disclosing, or further accessing the information.

Do not include screenshots, documents, medical details, account contents, credentials, full identifiers, or sensitive data in an email unless Wells Legacy Health & Wellness specifically asks for a secure method to receive limited information needed for review.

Patient privacy concerns may also be reviewed under the Notice of Privacy Practices, Privacy Breach Notice Procedure, and Information Security & Data Protection pages.

To report a suspected vulnerability, contact Wells Legacy Health & Wellness through the Contact page, call (321) 306-6755, or email info@wellslegacyhealth.com.

Include only what is necessary to understand the issue, such as:

• Your name and contact information, unless you choose to report without identifying yourself.
• The URL, page, link, or system area involved.
• A clear description of what you observed.
• The date and approximate time you noticed the concern.
• Device, browser, or operating system details, if relevant.
• Steps to reproduce the issue only if they do not involve unauthorized access, patient data, disruption, or active testing.
• A statement confirming that you did not access, copy, disclose, modify, delete, or retain sensitive information.

Wells Legacy Health & Wellness may review a responsible disclosure report internally, with website support, IT providers, privacy personnel, compliance personnel, legal support, hosting providers, software vendors, or other appropriate service providers.

The practice may acknowledge a report, request clarification, investigate the concern, refer the issue to a vendor, take corrective action, determine that no action is required, or handle the matter under privacy, security, compliance, legal, or breach response procedures.

Response timing may depend on the severity, complexity, verification needs, vendor involvement, healthcare privacy considerations, and the potential effect on patients, systems, providers, staff, or operations.

Wells Legacy Health & Wellness may use third-party platforms for hosting, website tools, appointment booking, telehealth, forms, payment processing, email, analytics, maps, reviews, social media, security, and operational support.

If a suspected vulnerability involves a third-party platform, vendor, hosting provider, plugin, application, or external account, the issue may need to be reviewed or addressed by that third party. Wells Legacy Health & Wellness may refer the concern to the relevant vendor, provide general direction, or ask the reporter to use the third party’s official security reporting process.

This page does not authorize testing against third-party systems, vendor platforms, hosting providers, booking platforms, telehealth tools, payment processors, email providers, social media accounts, map services, or other external services.

Wells Legacy Health & Wellness does not offer a bug bounty program, monetary reward, employment opportunity, contract, public recognition, or compensation for responsible disclosure reports unless a written agreement is signed by an authorized representative of the practice.

Submitting a report does not create authorization to access systems, perform testing, use exploit tools, retain information, disclose information, conduct follow-up testing, or communicate on behalf of Wells Legacy Health & Wellness.

Reports involving extortion, threats, unauthorized access, data theft, malware, ransom demands, public disclosure pressure, payment demands, or harmful activity may be referred to legal counsel, vendors, regulators, or law enforcement as appropriate.

This website, email, contact forms, responsible disclosure page, policy pages, social media, and routine communication channels are not for medical emergencies, immediate safety threats, cybercrime in progress, extortion threats, active compromise, ransomware, or urgent law enforcement matters.

If you are experiencing a medical emergency, call 911. If you believe cybercrime, fraud, extortion, identity theft, or active criminal conduct is occurring, consider contacting appropriate law enforcement or using official reporting channels.

Wells Legacy Health & Wellness may update this Responsible Disclosure page from time to time. The updated version will be posted on this page with a revised “Last updated” date.

Continued use of the website, online resources, reporting channels, or related digital tools after updates are posted means the updated policy applies going forward.