The use of the internet and web applications has significantly increased across various sectors, including education, healthcare, finance, and entertainment. However, web applications are highly vulnerable to various types of cyberattacks, such as SQL Injection, Cross-Site Scripting (XSS), and code injection, which can threaten the confidentiality, availability, and integrity of data. In line with technological advancements, the 2022 Ministry of Health regulation mandates that all healthcare facilities in Indonesia implement Electronic Medical Records (EMR). Universitas Andalas Hospital (RS UNAND) has adhered to this policy by developing a web-based EMR system. This study aims to evaluate and analyze the security of the EMR application used at RS UNAND. The Vulnerability Assessment process in this study was conducted using the Acunetix Web Vulnerability Scanner tool, which is designed to identify and assess vulnerabilities in web applications. The results of the first scan revealed that the RS UNAND EMR application had significant vulnerabilities, with a threat level of 3 (high). This scan identified 573 alerts, including 1 high-level, 253 medium-level, 2 low-level, and 317 informational alerts. These issues were followed by a thorough recap and further analysis to determine optimization steps. Several major vulnerabilities identified included HTML Form Without CSRF Protection, User Credentials Sent in Clear Text, Directory Listing, Source Code Disclosure, Git Repository Found, Multiple Vulnerabilities Fixed in PHP Versions, and Slow HTTP Denial of Service Attack. Optimization measures were then taken through a comprehensive review of the source code and enhancements to the security features of the EMR application. After the optimization, the second scan showed a significant reduction in the threat level, with the RS UNAND EMR application dropping to threat level 1 (low), with 12 alerts, consisting of 0 high and medium-level alerts, 9 low-level alerts, and 3 informational alerts. This study underscores the importance of regular security assessments and the optimization of security features to protect sensitive data in electronic medical record systems.