generated: '2026-07-24'
method: searched
source: >-
  https://www.hotdoc.com.au/.well-known/openid-configuration ;
  https://practices.hotdoc.com.au/security/
note: >-
  Conformance asserted from HotDoc's live OpenID Connect / OAuth 2.0 discovery
  metadata and its published security & compliance page. HotDoc consumes
  Australian practice-management-system APIs rather than publishing FHIR, so no
  HL7 FHIR / SMART-on-FHIR conformance is claimed.
standards:
- id: oauth2
  conforms: true
  evidence: RFC 8414 authorization-server metadata served at /.well-known/oauth-authorization-server with authorize/token/revoke/introspect endpoints.
- id: oidc
  conforms: true
  evidence: OpenID Connect Discovery 1.0 document at /.well-known/openid-configuration; RS256 id_token signing, pairwise subjects, live JWKS.
- id: rfc8414-oauth-metadata
  conforms: true
  evidence: /.well-known/oauth-authorization-server returns valid JSON metadata on both www and api hosts.
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404; a human security page is served instead.
- id: soc2
  conforms: true
  evidence: SOC 2 Type II annual accreditation stated on practices.hotdoc.com.au/security/.
- id: fhir-r4
  conforms: false
  evidence: No FHIR CapabilityStatement (/metadata) or SMART configuration served; HotDoc consumes PMS APIs instead.
- id: rfc9457-problem-details
  conforms: false
  evidence: No public REST/OpenAPI surface to assert problem+json error semantics.