generated: '2026-08-22'
method: probed
source: >-
  https://auth.humanlongevity.com/.well-known/openid-configuration (machine-readable), plus the
  provider's own published pages: https://www.humanlongevity.com/terms/,
  https://www.humanlongevity.com/genomics/, https://www.humanlongevity.com/privacy/
scope_note: >-
  Human Longevity publishes no API contract, so every cross-cutting API standard below that depends
  on a contract is recorded as not-conformant on the honest basis that there is nothing to conform.
  The standards it DOES conform to are the ones its client-portal authorization server implements,
  plus the clinical/regulatory programs its own pages state.
conformance:
- id: oauth2
  conforms: true
  evidence: >-
    auth.humanlongevity.com advertises authorization_endpoint, token_endpoint, revocation_endpoint,
    device_authorization_endpoint and 13 grant types in its discovery document.
  source: https://auth.humanlongevity.com/.well-known/openid-configuration
- id: oidc
  conforms: true
  evidence: >-
    A complete OpenID Connect Discovery 1.0 document is served, including issuer, userinfo_endpoint,
    jwks_uri, id_token_signing_alg_values_supported and claims_supported.
  source: https://auth.humanlongevity.com/.well-known/openid-configuration
- id: rfc8414
  conforms: true
  evidence: >-
    /.well-known/oauth-authorization-server returns 200 with an RFC 8414 authorization server
    metadata document (byte-identical to the OIDC discovery document).
  source: https://auth.humanlongevity.com/.well-known/oauth-authorization-server
- id: rfc7636
  conforms: true
  evidence: 'code_challenge_methods_supported advertises S256 (and plain).'
  source: https://auth.humanlongevity.com/.well-known/openid-configuration
- id: rfc7591
  conforms: true
  evidence: 'A dynamic client registration endpoint is advertised at https://auth.humanlongevity.com/oidc/register.'
  source: https://auth.humanlongevity.com/.well-known/openid-configuration
- id: rfc9728
  conforms: false
  evidence: '/.well-known/oauth-protected-resource returns 404 on every Human Longevity host probed.'
- id: hipaa
  conforms: true
  evidence: >-
    "HLI utilizes industry best practices specified in the HIPAA Security Rule located at
    45 CFR Part 160, subparts A and C of Part 164 to ensure your health information is confidential
    and secure." The genomics product page additionally states genomes are stored in "HLI's
    HIPAA-compliant database."
  source: https://www.humanlongevity.com/terms/
  type: regulatory-program
- id: clia
  conforms: true
  evidence: >-
    The Genomics product page states whole genome sequencing is performed in a "CLIA-certified lab —
    same quality standards as your hospital." No certificate number is published.
  source: https://www.humanlongevity.com/genomics/
  type: regulatory-program
- id: ccpa
  conforms: false
  evidence: >-
    The privacy policy expressly states "the requirements of the CCPA do not apply to HLI's
    operations, based on the express terms of the statute," with a commitment to comply should that
    change. Recorded as a stated non-applicability, not a failure.
  source: https://www.humanlongevity.com/privacy/
- id: rfc9457
  conforms: false
  evidence: No public API and no published error contract, so no problem+json envelope exists to assess.
- id: json:api
  conforms: false
  evidence: No public API contract published.
- id: odata
  conforms: false
  evidence: No public API contract published.
- id: scim
  conforms: false
  evidence: No SCIM schema URN or /scim/v2 surface found on any Human Longevity host.
- id: pagination
  conforms: false
  evidence: No public API contract published.
- id: idempotency
  conforms: false
  evidence: No public API contract published; no write surface a third party can call.
domain_standards:
  regime: health
  regime_source: api-search/network/_data/scoring.yml industry_regulatory.health
  note: >-
    The health regime's standards shortlist (FHIR, SMART on FHIR, US Core, USCDI, Da Vinci, CARIN
    Blue Button, FHIR Bulk Data, CDS Hooks, C-CDA, HL7 v2, DICOM) was checked against every public
    Human Longevity page and every host probed in this pass. None is declared, and none could be
    declared, because no contract is published. This is a reward-only dimension: recorded as absent,
    not as a penalty.
  checked:
  - id: fhir
    declared: false
  - id: smart-on-fhir
    declared: false
  - id: us-core
    declared: false
  - id: uscdi
    declared: false
  - id: carin-blue-button
    declared: false
  - id: fhir-bulk-data
    declared: false
  - id: hl7-v2
    declared: false
  - id: dicom
    declared: false
    note: >-
      HLI operates 3T MRI and coronary CT imaging, which are DICOM-producing modalities, but no
      DICOMweb endpoint or DICOM conformance statement is published for third-party access.