generated: '2026-08-02'
method: searched
source: live probes of artisight.com plus published product/security pages
standards:
- id: oauth2
  conforms: true
  evidence: 'https://artisight.com/.well-known/oauth-authorization-server returns 200
    with authorization_endpoint, token_endpoint, revocation_endpoint and grant_types_supported
    [authorization_code, refresh_token].'
- id: rfc8414-authorization-server-metadata
  conforms: true
  evidence: well-known/artisight-oauth-authorization-server.json (HTTP 200, application/json)
- id: rfc9728-protected-resource-metadata
  conforms: true
  evidence: well-known/artisight-oauth-protected-resource.json (HTTP 200, application/json)
- id: rfc7636-pkce
  conforms: true
  evidence: code_challenge_methods_supported = ["S256"]
- id: model-context-protocol
  conforms: true
  evidence: 'MCP server registered at https://artisight.com/wp-json/mcp/mcp-oauth-server
    (WordPress MCP Adapter); tools/list responds 401 mcp_unauthorized rather than 404,
    confirming a live MCP endpoint.'
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404
- id: rfc9727-api-catalog
  conforms: false
  evidence: /.well-known/api-catalog returns 404
- id: openid-connect
  conforms: false
  evidence: /.well-known/openid-configuration returns 404
- id: a2a-agent-card
  conforms: false
  evidence: /.well-known/agent-card.json and /.well-known/agent.json both return 404
- id: openapi
  conforms: false
  evidence: No OpenAPI/Swagger document found on artisight.com or any subdomain; docs.,
    developer., api. and app. artisight.com do not resolve in DNS.
- id: rfc9457-problem-details
  conforms: false
  evidence: 'WordPress REST errors use the WordPress envelope {"code","message","data":{"status"}}
    with Content-Type application/json, not application/problem+json.'
- id: hl7-fhir
  conforms: unknown
  evidence: 'Artisight advertises "Native Epic or Cerner integration with zero API
    fees. Bi-directional EMR data flow in real time" on https://artisight.com/smart-hospital-technology/
    but names no HL7v2, FHIR or SMART-on-FHIR profile anywhere on its public site.'
compliance:
  published: true
  page: https://artisight.com/smart-hospital-technology/
  certifications:
  - name: HIPAA Expert Determination Certification
    evidence: '"Artisight is the only smart hospital technology platform to achieve
      independent HIPAA certification for its full AI training and deployment process"
      / "Expert Determination Certification — U.S.-verified HIPAA compliance" (https://artisight.com/smart-hospital-technology/)'
  - name: AICPA SOC
    evidence: AICPA SOC seal displayed site-wide (https://artisight.com/wp-content/uploads/2025/12/21972-312_SOC_NonCPA_Blk-1.webp);
      the specific SOC report type is not stated publicly.
  controls:
  - Encryption AES-256 at rest, TLS 1.3 in transit
  - Audit logging and role-based access control
  - On-premise/edge video processing, no public-cloud video streaming, no PHI leaves
    the hospital
x-evidence:
  fetched: '2026-08-02'
  hosts_probed: [artisight.com, www.artisight.com, docs.artisight.com, developer.artisight.com,
    api.artisight.com, app.artisight.com, status.artisight.com, trust.artisight.com]