Fill in your details optional The prompt below updates as you type. What you type stays in this browser and is never sent to us.
You are an expert in this kind of work, and you know the Healthcare sector from the inside.
## Your task
Act as an application-security engineer. Build a STRIDE threat model for [SYSTEM OR FEATURE] at a hospital and clinic network, which handles data for patients, clinicians and hospital administrators. List assets, entry points and trust boundaries, then each threat with likelihood, impact and a mitigation. Prioritise against HIPAA, patient privacy and clinical accuracy.
## About my situation
- How we measure success: patient wait time and readmission rate
## What matters in Healthcare
- Rules and standards that usually apply: patient-privacy law (HIPAA in the US, GDPR in the EU, the DPDP Act and ABDM guidelines in India); accreditation standards such as JCI or NABH; informed consent; rules on advertising medical services; clinical content must be checked by a qualified clinician and must not diagnose.
- Common risks to plan for: patient-safety incidents; health-record data breaches; medication errors; insurance claim denials; staff burnout; health misinformation.
- Tools commonly used: hospital information system (HIS) or EHR; PACS; appointment booking; billing software; WhatsApp reminders.
- Words people in this field use: OPD/IPD; triage; EHR/EMR; discharge summary; care pathway; insurance pre-authorisation; ICD codes.
- Rules differ by country. If I have not said where I work, ask me, and do not present one country's law as if it applied everywhere.
## What I will give you
Architecture description: [DESCRIBE ARCHITECTURE]
## How to work through it
1. Describe the system: assets, users, entry points and trust boundaries.
2. Go through STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) for each entry point.
3. Rate each threat by likelihood and impact.
4. Give a practical mitigation for each.
5. Order the mitigations by priority.
## What to deliver
- Assets and trust boundaries
- Threat table with likelihood, impact and mitigation
- Prioritised action list
- A data flow diagram in Mermaid syntax
## Rules
- Make every point specific to my situation and my industry; replace generic advice with detail that fits.
- Use plain language, short sentences, and tables where they make the answer easier to scan.
- Use only the facts I give you. Do not invent figures, laws, sources or quotes. Mark anything you had to assume with "Assumption:".
- If something important is missing, ask me up to 3 short questions before you start.
## Before you answer
Check your draft against this list and fix anything that fails:
- The code works as written: no invented libraries, functions or APIs, and versions are named where they matter.
- It is written for a hospital and clinic network; nothing in it would read the same for any other business.
- Nothing in it breaks HIPAA, patient privacy and clinical accuracy.
- Every item under "What to deliver" is included.
How to use this prompt
- Copy the prompt. Press Copy prompt and the full text goes to your clipboard.
- Fill the brackets. Use the form above, or replace [SYSTEM OR FEATURE], [DESCRIBE ARCHITECTURE] with your own details.
- Paste and send. Paste it into ChatGPT and Claude and send. Ask follow-up questions to refine the answer.
Why use this Security threat model prompt?
This security threat model prompt is written for a hospital and clinic network. It tells the assistant who the answer is for (patients, clinicians and hospital administrators) and the limits it must respect: HIPAA, patient privacy and clinical accuracy. That context is what turns a generic reply into one a Healthcare team can use straight away.
Most people type a single line and get a generic answer back. This prompt gives the assistant the role, the context and the structure it needs, so the first answer is already close to what you would hand to your team. Because it is written for Healthcare, it keeps the focus on what that industry measures: patient wait time and readmission rate.
How to get the best answer
- Be specific in the brackets: real names, numbers and dates give a far better answer than placeholders.
- Paste real material: where the prompt asks for notes, data or text, paste the actual content rather than a summary.
- Refine in the same chat: ask "make it shorter", "turn it into a table" or "add more detail on step 2".
- Check the result: review it against what you know about patient wait time and readmission rate before you share it.
Other industries
Same prompt for other industries
The same security threat model prompt, rewritten for each industry.
FAQ
Frequently asked questions
Which AI assistant works best with this Security threat model prompt?
It works in any chat assistant. It suits ChatGPT and Claude best. Paste it in, send it, and ask follow-up questions in the same chat.
What do I need to replace before sending it?
Replace the 2 highlighted brackets – [SYSTEM OR FEATURE], [DESCRIBE ARCHITECTURE] – with your own details. The more specific you are, the better the answer.
Is this prompt only for Healthcare?
This version is written for a hospital and clinic network. The same prompt is also available for 15 other industries, listed on this page.
Is it free to use?
Yes. Copy it as often as you like and use it in your own work. No sign-up is needed.
Can I trust the answer?
Treat it as a strong first draft. Check facts and figures yourself, especially anything with legal, financial, medical or safety consequences.
Keep exploring