Does HIPAA Require Penetration Testing? What the Rule Says

Challenges

What the Rule Says Today, and What HHS Has Proposed

Healthcare network diagram with EHR and clinical systems, medical devices, workstations and servers around a segmented, monitored core, the environment a HIPAA penetration test examines

The Security Rule in Force

The word penetration does not appear in the Security Rule. Three provisions point toward testing anyway:

164.308(a)(8), evaluation: periodic technical and nontechnical evaluation, at first and after environmental or operational changes
164.308(a)(1)(ii)(A), risk analysis: an accurate and thorough assessment of vulnerabilities
164.308(a)(1)(ii)(B), risk management: measures that bring those risks down to a reasonable level

NIST SP 800-66 Rev. 2 lists penetration testing under evaluation where reasonable and appropriate, and advises specific written approval from senior management before any test.

The January 2025 Proposal

HHS's proposed rule, published January 6, 2025, would add a vulnerability management standard requiring:

Automated vulnerability scans at least every six months, or more often if the risk analysis calls for it
Penetration testing of relevant systems by a qualified person at least once every 12 months, or more often if the risk analysis calls for it

As of November 1, 2026 it is not final. HHS's latest regulatory agenda places it on the long-term list and targets July 2027 for a final rule.

The precise answer, then: HIPAA does not currently mandate a penetration test, but an organization that never tests will struggle to show its evaluation and risk analysis were accurate and thorough. Testing finds the vulnerabilities your HIPAA risk assessment has to account for. That page covers the analysis; this one covers the testing.

Need an answer for an auditor?

Tell us what your auditor or customer asked for. We will scope a test that answers it, and no larger.

contact us

CURRENT RULE VS. PROPOSALSecurity Rule in force vs January 2025 proposal (not final)
Aspect	Security Rule in force	January 2025 proposal (not final)
Penetration testing	Not named; NIST lists it under evaluation if reasonable and appropriate	At least every 12 months, or more often per the risk analysis
Vulnerability scanning	Not named	At least every 6 months, or more often per the risk analysis
Who tests	Not specified	A qualified person who knows generally accepted cybersecurity principles
Evaluation trigger	Periodic, and after environmental or operational changes	Written evaluation before a change that may affect ePHI
Risk analysis review	No fixed interval	At least every 12 months and after changes
Required vs. addressable	Both categories exist	Distinction proposed for removal

However the final rule lands, the proposal signals the testing cadence HHS regards as reasonable. Planning to it now costs little if the final text changes.

Overview

What to Put in Scope for Healthcare

EHR and Clinical Applications

Role separation between clinical, billing and admin users, privilege escalation, session handling, and the interfaces that move results in and out.

Patient Portals

Registration, login, reset and proxy access, and whether one patient can reach another's records by changing an identifier. These are the pages we harden in HIPAA compliant website development.

APIs and FHIR Endpoints

OWASP's 2023 API risk ranking puts broken object level authorization first. On FHIR servers we test OAuth scopes, SMART on FHIR launch flows, searches that return too much, and bulk export permissions.

Medical Devices on the Network

We test the segmentation around devices and what an attacker could reach from them, coordinating with manufacturers and biomedical engineering. Devices in clinical use are never exploited.

Cloud and Remote Access

Identity and access settings, exposed storage, VPN and remote desktop gateways, and connections held by third-party vendors.

People and Process

Optional phishing simulations run with our security awareness training team, scoped and approved in writing.

In practice

Methodology We Follow

NIST SP 800-115

NIST's Technical Guide to Information Security Testing and Assessment (September 2008) frames planning, discovery, attack and reporting. It belongs to the same NIST body of guidance that HHS draws on for the Security Rule.

OWASP WSTG and API Top 10

Portals and web apps are worked through using version 4.2 of OWASP's Web Security Testing Guide, and APIs are checked against OWASP's 2023 list of top API security risks.

PTES

The Penetration Testing Execution Standard shapes the engagement: pre-engagement, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation and reporting.

Services

Our HIPAA Penetration Testing Services

External Network Testing

Internet-facing hosts, VPNs and remote access, checked for exposed services, outdated software and weak authentication.

Internal Network and Segmentation

What an attacker inside the network can reach, including paths from workstations to EHR servers and device VLANs.

Web Application and Portal Testing

Authentication, authorization, session management, input validation and business logic in patient and staff applications.

API and FHIR Testing

Token handling, object-level access, data exposure and rate limits on REST and FHIR APIs.

Cloud Configuration Review

IAM, storage, network rules and logging in the cloud accounts that hold ePHI.

Retesting

Verification after fixes, with an updated report showing which findings are closed.

These follow the practice of our VAPT and penetration testing services, scoped to ePHI and reported against the Security Rule. Code-level findings can be traced further with an OWASP secure code review.

Process

How a HIPAA Penetration Test Runs

Plan your project

1
Authorization and Rules of Engagement
Signed approval from senior management, as NIST SP 800-66 Rev. 2 recommends, with test windows, contacts and stop conditions.
2
Scope From Your ePHI Inventory
Targets taken from the systems your risk analysis says hold or reach ePHI, so the test answers the questions that matter.
3
Discovery
Asset enumeration and vulnerability scanning to map the attack surface.
4
Manual Testing and Exploitation
Testers validate and chain weaknesses. Once PHI is reachable, we record proof of access and stop; we do not copy patient records.
5
Reporting
Findings with evidence, severity, ePHI impact and remediation steps, plus an executive summary.
6
Retest and Close
We confirm fixes and reissue the report with current status.

How often: Today's rule leaves frequency to your risk analysis. Testing at least yearly and after significant changes lines up with both the proposed rule and the change trigger in 164.308(a)(8). Engagement length depends on scope, and we set it after scoping.

In practice

Reports Auditors and OCR Investigators Can Use

Scope Tied to ePHI

Every target maps to a system in your inventory, so a reader sees what was covered and what was not.

Dated, Reproducible Evidence

Timestamped requests, responses and screenshots, enough for your team to reproduce each finding.

Severity With Patient Context

Ratings reflect whether a flaw exposes ePHI, could disrupt care systems, or touches only non-sensitive assets.

Security Rule Mapping

Findings referenced to the standards they affect, such as access control, audit controls and transmission security, with an entry for your risk register.

Remediation and Retest Record

Each fix and its retest result, showing that risk management followed the evaluation.

Ready to Retain

Delivered in a form you can keep for the six years the Security Rule requires for its documentation.

Why Xcodefix

Why Xcodefix for HIPAA Penetration Testing

Healthcare Context

Our testers work beside HL7, FHIR and EMR engineers, so clinical interfaces are understood before they are probed.

Manual Testing First

Scanners catch known issues; our testers pursue authorization and business-logic flaws that tools miss.

Compliance Translation

Our HIPAA compliance consultants turn findings into risk register entries and remediation priorities.

Fast Escalation

Critical findings go to your named contact as soon as they are confirmed, and live incidents are handled as same-day work.

Get Started

Get a Penetration Test Scoped to Your ePHI

Send us your systems list or your last risk analysis. We will propose targets, approach and reporting format, and tell you what we would leave out and why.

Prefer email? info@xcodefixglobal.com

Frequently asked questions

HIPAA Penetration Testing Questions

Talk to the specialist who would scope the work — not a call-centre script.

Ask us directly

Does HIPAA require penetration testing?

Not explicitly under the current Security Rule. HIPAA requires a risk analysis and periodic technical evaluation, and NIST SP 800-66 Rev. 2 lists penetration testing as a way to evaluate where reasonable and appropriate. HHS's January 2025 proposal would require annual testing, but as of November 1, 2026 it has not been finalized.

How often should HIPAA penetration testing be done?

The current rule leaves the interval to your risk analysis. The proposed rule would set at least once every 12 months, or more often if your analysis calls for it. We recommend testing annually and after major changes such as an EHR migration, a new portal or a cloud move, which also matches the evaluation trigger in 164.308(a)(8).

Is a vulnerability scan enough for HIPAA?

A scan finds known weaknesses; it does not show whether someone can chain them to reach ePHI or bypass a portal's authorization. The proposed rule treats the two as separate tasks, with scans every six months and penetration tests every 12. Use scans for routine hygiene and penetration tests to learn what an attacker could actually do.

Will the new HIPAA Security Rule require pen testing?

The proposal published January 6, 2025 would require penetration testing by a qualified person at least every 12 months. Public comment closed March 7, 2025, and HHS now projects final action for July 2027, listing the rule as a long-term item. Until a final rule is published, the requirement is not in force.

Who can perform a HIPAA penetration test?

The current rule names no qualification. The proposal would require a qualified person with appropriate knowledge of and experience with generally accepted cybersecurity principles. In practice, choose testers independent of the team that built the systems, with healthcare experience and a written methodology you can show an auditor.

Can you test our patient portal and FHIR API?

Yes. We test portal registration, login, reset and proxy access, and whether one patient can view another's data. For FHIR APIs we check OAuth scopes, SMART on FHIR launch flows, object-level authorization and over-broad search results, using OWASP's API risk list as the checklist.

How is a penetration test different from a HIPAA risk assessment?

A penetration test finds exploitable technical weaknesses in selected systems. A risk assessment covers all ePHI, including people, process and physical threats, and rates every risk by likelihood and impact. Test results feed the assessment as evidence. Our HIPAA risk assessment services page explains that side of the work.

Do you sign a BAA for penetration testing?

Where an engagement could expose our testers to PHI, yes: we work under a Business Associate Agreement, as we do on healthcare work that handles PHI. We also design tests to touch as little PHI as possible, recording proof that access was possible rather than copying any records.

Keep exploring

Related services

Cybersecurity & Threat Intel VAPT & Penetration Testing Web, API, mobile, cloud & network Compliance, Risk & Governance HIPAA / SOC 2 / ISO Audits Gap assessment to audit readiness Cybersecurity & Threat Intel Threat Intel & IR (24/7) Monitoring, hunting & response Cybersecurity & Threat Intel OWASP Secure Code Review Manual + SAST, ASVS-mapped Cybersecurity & Threat Intel Security Awareness Training Phishing simulation & programs Guide HIPAA Compliant Websites Forms, tracking and hosting done safely