Security & privacy · HIPAA Penetration Testing
HIPAA penetration testing for healthtech teams
Protect ePHI in your patient portals, telehealth apps and APIs. We test the technical safeguards attackers go after and give you evidence for your risk analysis.
Does HIPAA require penetration testing?
The current HIPAA Security Rule requires a risk analysis (45 CFR 164.308(a)(1)(ii)(A)) and periodic technical evaluation (164.308(a)(8)), but it does not name penetration testing. The HHS proposed update to the Security Rule, published in January 2025, would make penetration testing at least every 12 months an explicit requirement. Many covered entities and business associates already test annually because a pentest is strong evidence for both obligations.
Last reviewed by the Mighty Infosec team. This page is guidance, not legal advice.
HIPAA Security Rule
Where a pentest fits in HIPAA
164.308(a)(1)(ii)(A)
Risk analysis. An accurate and thorough assessment of risks to the confidentiality, integrity and availability of ePHI.
164.308(a)(8)
Evaluation. Periodic technical and nontechnical evaluation of how well your safeguards work.
164.312
Technical safeguards. Access control, audit controls, integrity, authentication and transmission security, all of which a pentest exercises directly.
Proposed rule (2025)
The HHS proposal would require penetration testing at least every 12 months and vulnerability scanning at least every six months.
How we help
AI-native testing, verified by experts
Follow the ePHI
We map where patient data enters, moves and rests, then focus testing on the paths that expose it.
Test access control hard
Patient to patient, provider to provider and tenant to tenant. Broken authorization is the most common way health data leaks from apps.
Handle data carefully
We prefer test environments and synthetic data. If testing could touch ePHI, we agree data handling terms, including a BAA where needed, before we start.
Evidence for your risk analysis
Findings come with likelihood and impact ratings you can carry straight into your HIPAA risk analysis.
What you receive
- Report mapped to HIPAA technical safeguards
- Risk ratings for your risk analysis
- Retest results and remediation evidence
- Executive summary for compliance and leadership
FAQ
HIPAA Penetration Testing questions
Is the 2025 HIPAA Security Rule update final?
Check the current status with HHS or your counsel. Whatever its status, annual penetration testing is already common practice and strong evidence for the existing risk analysis and evaluation requirements.
Do you need access to real patient data?
No. We test with synthetic accounts and data wherever possible, and agree data handling terms before any test that could touch ePHI.
Do you test telehealth and mobile health apps?
Yes. We test iOS and Android apps, the APIs behind them, video and messaging flows, and integrations with EHR systems.
Services
Services behind this engagement
Web Application Pentesting
AI-native, expert-verified testing of your web apps, from auth bypass to business-logic abuse.
API Pentesting
REST, GraphQL and gRPC testing focused on authorisation and data exposure.
Mobile App Pentesting
Android and iOS testing of the app, its storage, and the APIs behind it.
Talk to us about HIPAA Penetration Testing
Tell us what you're building. In a free 30-minute scoping call we'll map your risks and recommend the right engagement, whether you need a pentest, a threat model or an AI security review.