HIPAA Penetration Testing: Is It Required & What to Test

Quick answer: The current HIPAA Security Rule does not explicitly name penetration testing, but it requires a risk analysis and periodic technical evaluation of safeguards, and penetration testing is a widely used way to meet both. A proposed update to the Security Rule would expressly require it. Healthcare organizations and their business associates should plan on testing at least annually.

Healthcare is one of the most targeted industries, because records are valuable and downtime can affect patient care. Hospitals, clinics, health-tech vendors, billing companies and other business associates all hold electronic protected health information (ePHI) that the HIPAA Security Rule requires them to safeguard.

This guide explains where HIPAA penetration testing fits: what the rule says today, what has been proposed, what to test and how to prepare. For testing aligned to HIPAA, see Privaxi's HIPAA pen testing service.

Does HIPAA Require Penetration Testing?

The Security Rule is technology-neutral and does not currently list penetration testing as a named requirement. It does, however, require covered entities and business associates to:

• Conduct an accurate and thorough risk analysis of potential risks and vulnerabilities to ePHI.
• Implement risk management measures to reduce those risks to a reasonable and appropriate level.
• Perform periodic technical and non-technical evaluations of whether security policies and procedures meet the rule.
• Review information system activity through audit controls and logs.

Penetration testing is a recognized way to provide evidence for all of these. Auditors, health system customers and cyber insurers also commonly expect it. In practice, HIPAA pen testing is treated as a standard control even where the text does not name it.

Proposed HIPAA Security Rule Changes

In January 2025, the U.S. Department of Health and Human Services proposed updates to the Security Rule that would, once finalized, expressly require penetration testing and remove the distinction between "required" and "addressable" safeguards. As of mid-2026 the update was still a proposal, and the final text could differ. Confirm the current status before you rely on specifics. Privaxi's article on the HIPAA Security Rule changing and what addressable going away means follows the developments, and our guide on why basically covered is not enough explains the risk of waiting.

Even if the final rule changes, the direction is clear: regular testing is becoming an explicit expectation, so building the habit now avoids a scramble later.

How HIPAA Penetration Testing Supports the Risk Analysis

A risk analysis identifies where ePHI lives and what could go wrong. A penetration test adds evidence of what can actually go wrong. It turns assumptions into verified findings: a patient portal that exposes another patient's records, an exposed remote access service or a flat network that lets ransomware reach clinical systems. Findings feed directly into your risk register and risk management plan.

What to Test in a Healthcare Environment

Medical devices and clinical systems need extra care. Agree on safety limits in advance, and test staging or isolated copies where patient safety could be affected.

Business Associates and HIPAA Penetration Testing

If you are a SaaS vendor, billing company, analytics provider or other business associate, your customers will ask for proof of testing in security reviews and business associate agreements. Annual testing and a shareable summary are now routine requests. See our guide to SaaS penetration testing and SOC 2 penetration testing requirements, since many health-tech vendors pursue both.

How Often Should You Perform HIPAA Penetration Testing?

• At least annually, which is the common expectation among auditors and customers.
• After significant changes, such as new patient-facing applications, EHR integrations, cloud migrations or mergers.
• After a security incident, to confirm the path is closed.
• Alongside regular vulnerability scanning, as part of ongoing risk management.

HIPAA Penetration Testing and HITRUST

Many healthcare vendors pursue HITRUST to show HIPAA alignment. Technical testing is part of that story, as covered in HITRUST e1 vs i1 vs r2 and Privaxi's HITRUST penetration testing service.

How to Prepare for HIPAA Penetration Testing

1. Map where ePHI lives, including applications, databases, backups and third parties.
2. Update your system inventory and network diagrams.
3. Define scope and exclusions, especially for clinical and life-critical systems.
4. Agree on test data. Use synthetic or de-identified data in non-production environments where possible.
5. Sign a business associate agreement with the testing provider if testers may access ePHI.
6. Set communication rules for critical findings.
7. Plan remediation and retesting, and record outcomes in your risk management documentation.

Read penetration testing scope for scoping principles and how much penetration testing costs for pricing factors.

Documentation to Keep for HIPAA

• The penetration testing report and executive summary.
• The scope, methodology and tester qualifications.
• A remediation log with owners and dates.
• Retest results and risk acceptance decisions.
• Updates to your risk analysis and risk management plan.
• Records required to be retained under HIPAA documentation rules.

For broader support, Privaxi's HIPAA compliance services cover risk analysis and readiness.

Common Findings in Healthcare Penetration Tests

Ransomware and the Case for Testing

Ransomware is a leading threat to healthcare because downtime directly affects patient care. Attackers typically gain access through phishing, exposed remote access or unpatched systems, then move across the network to encrypt servers and backups. Testing exposes the same chain a ransomware group would use: the first foothold, the path to administrative control and the reachability of backups. Fixing those links, and confirming with a retest, is one of the most direct ways to reduce the chance and impact of an attack.

Questions to Ask a Healthcare Testing Provider

• Do you have experience with clinical environments, EHR integrations and connected devices?
• How do you protect ePHI that testers might encounter, and will you sign a business associate agreement?
• What safety limits do you apply to systems that affect patient care?
• Can you map findings to the Security Rule and your risk analysis?
• Do you provide a summary suitable for covered-entity customers?
• Is retesting included?

Frequently Asked Questions

Is penetration testing required by HIPAA?

Not by name under the current Security Rule, but HIPAA requires risk analysis, risk management and periodic technical evaluation, and penetration testing is a widely accepted way to meet them. A proposed update would expressly require it.

How often should HIPAA pen testing be done?

At least annually and after significant changes to systems that handle ePHI. Customers, auditors and insurers commonly expect annual testing.

Does HIPAA pen testing include medical devices?

It can, but connected medical devices need specialized scoping and safety limits so patient care is not affected.

Do business associates need HIPAA pen testing?

Business associates are directly subject to the Security Rule, and their covered-entity customers routinely ask for proof of testing in security reviews and contracts.

Does the testing provider need a business associate agreement?

If testers may access or view ePHI, a business associate agreement is generally appropriate. Many organizations also use synthetic data and non-production environments to limit exposure.

What is the difference between a HIPAA risk analysis and a penetration test?

A risk analysis identifies where ePHI is and what threats and vulnerabilities could affect it. A penetration test verifies which weaknesses can actually be exploited. They support each other.

Final Thoughts

Whether or not the final rule names it, HIPAA penetration testing has become the practical proof that your safeguards for ePHI work. Test the systems that hold patient data, fix what you find, retest and keep the documentation.

To scope testing for your healthcare environment, explore Privaxi's HIPAA penetration testing service and book a call.