Compliance

HIPAA Penetration Testing

The HIPAA Security Rule asks for an accurate risk analysis and periodic technical evaluation. A pentest gives both real evidence.

Get a quote Request a sample report

In plain English

What HIPAA expects from security testing

The HIPAA Security Rule is risk-based. It doesn’t hand you a list of tests to run. Instead, it requires an accurate and thorough risk analysis of threats to electronic protected health information (ePHI), and periodic technical and nontechnical evaluations of how well your safeguards work, repeated when your environment changes.

A penetration test is a practical way to do both. It turns “we think our patient portal is secure” into dated evidence of what an attacker could actually reach, which your risk analysis and evaluation can rely on.

This may become more prescriptive. In January 2025, HHS published a proposed rule that would, among other changes, require penetration testing at least once every 12 months. At the time this page was last reviewed it was still only a proposal, so the current Security Rule applies. Take legal advice on your specific obligations.

Relevant references

45 CFR 164.308(a)(1)(ii)(A): Risk analysis. Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information (ePHI).
45 CFR 164.308(a)(8): Evaluation. Perform a periodic technical and nontechnical evaluation, and repeat it in response to environmental or operational changes, to establish how well your security policies and procedures meet the Security Rule.
HHS proposed rule, 90 FR 898 (6 January 2025): A proposed update to the Security Rule that would require penetration testing at least once every 12 months. As of this page's last review, it is still a proposed rule and is not in force.

General guidance, not legal or audit advice. Confirm what your auditor or assessor expects for your scope.

Evidence

How our report supports it

Real-world evidence of vulnerabilities to feed into your risk analysis
A documented technical evaluation of systems that create, receive, store or transmit ePHI
Severity ratings that support risk management decisions and prioritisation
Retest results showing remediation, for your records and for business partners
A scope and methodology you can retain as documentation of the evaluation

Scope

Recommended scope

Every environment is different. This is where we usually start, and we'll confirm it on a scoping call.

Web Application Penetration Testing

Patient and clinician portals and other applications that handle ePHI.

API Penetration Testing

APIs that exchange health data, including integrations with partners.

Mobile App Penetration Testing (iOS & Android)

Patient-facing iOS and Android apps, which often store or cache sensitive data.

Cloud Security Testing (AWS, Azure, GCP)

Cloud environments where ePHI is stored or processed.

Timing

When to test

Run testing before your periodic risk analysis update, so its findings inform the assessment.
Re-evaluate after significant changes, such as a new platform, major release or migration, as 164.308(a)(8) expects.
If you are a business associate, align testing with what your covered-entity customers ask for in security reviews.
Track the HHS proposed rule. If finalised, it would set a fixed annual testing requirement.

FAQ

HIPAA testing questions

Does HIPAA require penetration testing?

The current Security Rule doesn't name penetration testing. It requires an accurate and thorough risk analysis and periodic technical evaluation, and a pentest is a widely used way to meet both. HHS proposed in January 2025 to require penetration testing at least every 12 months, but that rule has not been finalised.

Do business associates need testing too?

The Security Rule's administrative safeguards, including risk analysis and evaluation, apply to business associates as well as covered entities. Many healthcare customers also ask their vendors for recent pentest evidence.

Will you see real patient data?

We prefer to test in an environment with synthetic data. If production testing is necessary, we agree rules of engagement first, access only what's needed to prove an issue, and handle any data under our NDA and data-handling commitments.

Does a penetration test make us HIPAA compliant?

No. Our penetration test report supports your compliance programme; it doesn't certify compliance, and there is no official HIPAA certification. Take legal advice on your specific obligations.

Sources

Guide7 min read

Pentest vs Vulnerability Scan: What's the Difference?

Vulnerability scans and penetration tests both find security problems, but they answer different questions. Learn when each fits and why scans fall short.

7 October 2026

Guide8 min read

How to Prepare for Your First Penetration Test

A practical checklist for your first penetration test: how to set scope, prepare accounts and environments, pick contacts and keep communication clear.