Does HIPAA Require Penetration Testing?

Health tech founders hear conflicting answers to this question. Here is the clear version: the HIPAA Security Rule has long required risk analysis and periodic technical evaluation, and penetration testing is the most common way to meet those expectations. Regulators have also proposed making it explicit.

What the Security Rule requires today

The HIPAA Security Rule applies to covered entities and business associates that handle electronic protected health information (ePHI). Relevant requirements include:

• Risk analysis (45 CFR 164.308(a)(1)(ii)(A)). Conduct an accurate and thorough assessment of risks and vulnerabilities to ePHI.
• Risk management. Implement measures to reduce those risks to a reasonable level.
• Evaluation (164.308(a)(8)). Perform periodic technical and non-technical evaluations to show your security measures meet the rule's requirements.

None of these say "penetration test," but a risk analysis that never tests whether your application can be broken into is hard to defend as "accurate and thorough." OCR enforcement actions frequently cite inadequate risk analysis.

The proposed update

In early 2025, HHS published a proposed update to the Security Rule. Among other changes, it proposed requiring vulnerability scanning at least every six months and penetration testing at least once every 12 months. As a proposed rule, its final form and timing may change, so check the current status. Either way, the direction is clear: regular technical testing is becoming an explicit expectation.

Why health tech is a high-value target

Health records contain identity, insurance and medical details that are valuable for fraud and extortion. Healthcare organisations have been heavily targeted by ransomware, and business associates, including SaaS vendors, are often the entry point. Hospitals and payers know this, which is why their vendor reviews ask for pentest reports.

What to test in a health tech product

• Access control. Can a patient see another patient's records by changing an ID? Can a clinician in one practice see another practice's data?
• APIs and integrations. FHIR and HL7 interfaces, EHR integrations and partner APIs.
• Authentication. MFA, session handling and password reset flows.
• File handling. Uploaded documents, images and exports.
• Cloud storage. Buckets and databases holding ePHI must not be publicly reachable.
• Logging. Audit logs that record access to ePHI, without leaking PHI into logs themselves.

A practical approach

1. Document a risk analysis that includes technical testing as an input.
2. Test your application and APIs at least annually and after major change.
3. Run continuous automated testing for internet-facing systems.
4. Track every finding to remediation and keep the evidence.

SecurityInfinity agents test access control, APIs, authentication and cloud exposure, verify each finding and provide fixes. Reports work as evidence for your risk analysis and customer reviews. Start free or book a demo.

Frequently asked questions

Is penetration testing legally mandatory under HIPAA?

Not explicitly under the current rule, though it is strongly implied by the risk analysis and evaluation requirements. A 2025 proposed rule would make annual penetration testing explicit.

Do business associates need to test too?

Yes. Business associates must comply with the Security Rule, and covered entities increasingly require evidence of testing in their contracts.

Should PHI be used in testing?

Avoid it. Test against environments with synthetic data where possible, and if production testing is required, ensure agreements and safeguards are in place.