Home
Solutions
HIPAA

Solutions · Compliance · HIPAA

HIPAA penetration testing that gives your risk analysis real evidence

HIPAA compliance asks you to know where ePHI is exposed. ioSENTRIX tests your patient portals, APIs, cloud and networks the way an attacker would, maps each finding to the Security Rule, and includes a retest of your fixes so your risk analysis and evaluation rest on proof, not assumptions.

Scope my HIPAA pentest See how testing maps to the Security Rule

RegulationHIPAA Security Rule · 45 CFR Part 164, Subpart C

Who asksYour compliance team, auditors, and covered entities you serve

What you getProven findings mapped to 164.308 and 164.312, retest included

Independently rated

★★★★★ 4.9 / 5 on G2 (12 reviews) · 5.0 / 5 on Clutch

Reviewed by Omair Manzoor, Founder & CEO, ioSENTRIX · Updated November 2026Key terms: HIPAA security, Penetration testing, Risk assessment

Trusted by security teams at

01The requirement

Is penetration testing required for HIPAA?

Not by name. The current HIPAA Security Rule does not use the term penetration testing. It requires an accurate and thorough risk analysis (45 CFR 164.308(a)(1)(ii)(A), Required) and a periodic technical and nontechnical evaluation (164.308(a)(8)). A penetration test is direct evidence for both.

Mandatory?Not named in the current rule

Risk analysis and evaluation are required; how you evidence them is up to you.

ProposedAnnual pentest proposed, not final

The January 2025 proposed rule would add it. It has not been finalized.

Expected?Strong evidence for evaluation

A pentest shows whether your safeguards protect ePHI against a real attacker.

What is HIPAA penetration testing?

HIPAA penetration testing is a penetration test scoped to the systems that create, receive, maintain or transmit ePHI. It is documented so that findings, remediation and the retest can feed your risk analysis, risk management and periodic evaluation under the Security Rule.

What does HIPAA compliance require for security?

The Security Rule requires administrative, physical and technical safeguards for ePHI, for covered entities and business associates alike. Read the rule on eCFR, or our HIPAA penetration testing guide. The proposed update is on the Federal Register.

02See it in action

From safeguard to recorded evidence

How one access control on a patient portal is tested like an attacker would, fixed, retested and recorded in your HIPAA evaluation.

Illustrative

01Standards this test supports

312(a)(1)Access control

308(a)(8)Evaluation

308(a)(1)(ii)(A)Risk analysis

312(d)Authentication

312(b)Audit controls

308(a)(1)(ii)(B)Risk management

02The safeguard, tested

Safeguard: patients can only see their own recordsHigh

Finding: GET /api/records/{id} returns another patient's record · IDOR · OWASP A01

Safeguard in scope

TestTesters sign in as test patient A and request patient B's record ID
ProveRecord returned: ePHI exposure shown on test data
FixServer-side ownership check described for your engineers
RetestSame request now refused; fix confirmed
RecordFinding, fix and retest recorded in your evaluation

03Evidence folder: access control

Scope, dates and method
Finding with proof and impact
Fix guidance and owner
Retest result
Security Rule mapping

Evidence statusEvidence folder open

A safeguard, not a scan

We start from the safeguard you rely on, such as patients seeing only their own records, and test whether it holds against a real attacker.

Proof your risk analysis can use

Each finding carries evidence, likelihood and impact on ePHI, and the Security Rule standard it relates to, so it drops straight into your risk analysis.

Closed, then recorded

A retest of your fixes is included, so your evaluation records the risk as found, fixed and confirmed.

Illustrative example. The portal, endpoint and statuses are a composite for explanation only and do not describe any client. Testing uses test accounts and data agreed in the rules of engagement.

Text version of the exhibit

Safeguard: your patient portal should let patients see only their own records. The test supports 45 CFR 164.312(a)(1) access control, 164.308(a)(8) evaluation and the 164.308(a)(1)(ii)(A) risk analysis, plus 164.312(d) authentication and 164.312(b) audit controls.
Test: testers sign in as test patient A and request test patient B's record by changing its ID.
Finding: the record is returned. The insecure direct object reference is rated High and mapped to OWASP A01 Broken Access Control, with evidence of ePHI exposure on test data.
Fix: we describe a server-side ownership check for your engineers, feeding your risk management (164.308(a)(1)(ii)(B)).
Retest: the same request is refused and the fix is confirmed.
Recorded: the evidence folder (scope, finding with proof, fix, retest and Security Rule mapping) is recorded in your HIPAA evaluation.

03Requirement to evidence

How does penetration testing map to the HIPAA Security Rule?

One test can support several standards at once. This is the mapping we put in your report, so your compliance team can trace each piece of evidence back to the rule.

Standard	What it asks	What ioSENTRIX tests	Evidence for your file
164.308(a)(1)(ii)(A)Risk analysis	An accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI.	Threat modeling and penetration testing of systems holding ePHI.	Proven vulnerabilities with likelihood and impact
164.308(a)(1)(ii)(B)Risk management	Security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.	Prioritized fix guidance, then a retest of your fixes.	Remediation plan and retest results
164.308(a)(8)Evaluation	Periodic technical and nontechnical evaluation, and again after environmental or operational changes affecting ePHI security.	An independent penetration test of apps, APIs, cloud and network in scope.	Report with scope, dates, method and testers
164.312(a)(1)Access control	Allow access to ePHI only to persons or software programs granted access rights.	Authorization, IDOR, role and tenant checks in portals and APIs.	Access-control findings with proof
164.312(b)Audit controls	Mechanisms that record and examine activity in systems that contain or use ePHI.	Whether our test activity was logged, and optional red team detection checks.	What was logged and what was missed
164.312(d)Authentication	Verify that a person or entity seeking access to ePHI is the one claimed.	Login, MFA, password reset and session handling on web and mobile.	Authentication findings and fixes
164.312(e)(1)Transmission security	Guard against unauthorized access to ePHI transmitted over an electronic communications network.	TLS configuration, API transport and mobile app traffic.	Transport findings by endpoint

Standard wording summarized from 45 CFR 164.308 and 164.312 (eCFR, current text). The Security Rule does not name penetration testing; it is one way to evidence these standards. Orientation, not legal advice.

04Timing

When should you run a HIPAA penetration test?

Before you finalize your risk analysis, and again whenever your environment or operations change.

Risk analysis
Identify where ePHI lives and which systems matter most.
Scope input
Scope ePHI systems
Portals, apps, APIs, EHR integrations, cloud and networks.
Written scope
Test
Manual testing by certified engineers. A web application test typically takes 1–2 weeks.
Manual testing
Fix and retest
Fix guidance for each finding, then a retest of your fixes.
Retest included
Evaluation record
Results recorded as part of your periodic evaluation.
Evidence pack
Repeat after change
New systems, integrations or operational changes affecting ePHI security.
Next cycle

Covered entityYour own ePHI systems

Providers, health plans and clearinghouses test the systems they run, and use the results in their risk analysis and evaluation.

Business associateEvidence for your customers too

Vendors that handle ePHI follow the same Security Rule standards, and covered entities may ask for a recent report.

05Evidence pack

What's in a HIPAA penetration test evidence pack?

What your compliance team, auditors and covered-entity customers ask for, in one place.

Executive summary
Scope, method and results in plain language for leadership and compliance.
Scope and method
Systems holding ePHI, dates, testers and the standards followed.
OWASP Top 10NIST SP 800-115
Findings with proof
Each finding with evidence, likelihood, impact on ePHI and steps to reproduce.
Fix guidance
Specific remediation for your engineers, prioritized for your risk management plan.
Retest results
Fixes retested and recorded, so risks are tracked to closure.
Security Rule mapping
Each result mapped to the standard it supports.
164.308(a)(1)164.308(a)(8)164.312(a)(1)164.312(d)

06Independently verified

★★★★★

“The team at ioSENTRIX is professional and highly skilled at their craft.”

Awwab A.SVP, Chief Information Security Officer · Verified G2 review ↗

★★★★★

“We were impressed with ioSENTRIX's ability to independently validate the security of our customer-facing product.”

Zeehasham R.Data Scientist, Security Operations · Insurance · Verified Clutch review ↗

4.9 / 5 on G212 reviews · High Performer, Fall 2026↗

5.0 / 5 on ClutchPremier Verified↗

Penetration Testing Solution of the Year2026 CyberSecurity Breakthrough Awards↗

CREST-accredited firmPenetration testing↗

ISO/IEC 27001 certifiedOur own information security management system↗

SOC 2 Type 2 attestedOur own controls, independently examined↗

07How we help

Services that support a HIPAA program

From the first risk analysis to retests after every significant change.

Case study · Full stack penetration test

Role-based access, authentication and encryption tested in a Citrix-hosted environment

Network reconnaissance past Citrix restrictions found critical internal vulnerabilities
Cross-site scripting, missing authorization checks and privilege escalation identified and mitigated
Report with remediation by severity, written for engineers and leadership

Read the case study

Services for HIPAAHIPAA compliance support (CaaS)Risk analysis support, documentation and audit preparation.Web application and API penetration testingPatient portals and APIs, typically 1–2 weeks.Mobile app penetration testingiOS and Android health apps and their back ends.Cloud security assessmentAWS, Azure and GCP configuration review for ePHI workloads.Application securityThreat modeling, architecture and code review.Healthcare cybersecurityTesting across portals, EHR integrations, devices and staff.FDA 510(k) medical device testingPremarket cybersecurity testing for device makers.

08Insights

Read before you scope your HIPAA test

July 21, 2026

HIPAA Penetration Testing: A Guide for Healthcare & Health-Tech

Learn what HIPAA penetration testing is, why it matters, what systems to test, common vulnerabilities, best practices, and how it supports healthcare compliance.

October 9, 2024

6 Steps To Conduct A HIPAA Risk Assessment

A HIPAA risk assessment assesses the threats to the privacy and security of PHI, the likelihood of a threat occurring, and the potential impact of each threat.

September 10, 2024

HIPAA Compliance Solutions | ioSENTRIX

ioSENTRIX offers a user-friendly and thorough security service for HIPAA security. Our solution is efficient, accurate, and hassle-free for implementation.

09FAQ

HIPAA penetration testing questions

Short answers to what healthcare security and compliance teams ask us most.

Ask us something else

Is penetration testing required for HIPAA?

Not by name. The current HIPAA Security Rule (45 CFR Part 164, Subpart C) does not use the term penetration testing. It requires an accurate and thorough risk analysis (164.308(a)(1)(ii)(A)) and a periodic technical and nontechnical evaluation (164.308(a)(8)). A penetration test is direct evidence for both, which is why many covered entities and business associates commission one.

Will the proposed HIPAA Security Rule update require penetration testing?

It would, but it is not final. HHS published a proposed rule on January 6, 2025 (90 FR 898) that would require penetration testing by a qualified person at least once every 12 months, or more often if your risk analysis calls for it. As of November 2026 the proposal has not been finalized, and the Security Rule text in force does not include it.

How often should we run a HIPAA penetration test?

The Security Rule does not set a frequency. It asks for a periodic evaluation, and another one in response to environmental or operational changes affecting the security of ePHI. Many organizations test at least annually and after significant changes, such as a new patient portal, EHR integration or cloud migration.

Do business associates need HIPAA penetration testing?

The Security Rule standards, including risk analysis and evaluation, apply to business associates as well as covered entities. A recent penetration test report is practical evidence for both, and covered entities may ask their vendors for one during due diligence.

What should a HIPAA penetration test cover?

The systems that create, receive, maintain or transmit electronic protected health information (ePHI): patient portals and mobile apps, APIs and EHR integrations, cloud infrastructure, internal and external networks, and the access controls around them. Scope follows your risk analysis.

Is a vulnerability scan enough for HIPAA?

Usually not on its own. A vulnerability scan lists known weaknesses automatically. A penetration test is carried out by people who exploit and chain weaknesses, including access control and business logic flaws, and prove whether ePHI can be reached. Both can feed your risk analysis.

Does ioSENTRIX certify HIPAA compliance?

No. ioSENTRIX provides testing, evidence and compliance support that feed your risk analysis, risk management and evaluation. Decisions about your HIPAA compliance remain with your organization and its advisors.

Ready when you are

Get HIPAA evidence your risk analysis can rely on

Tell us whether you are a covered entity or business associate, and which systems handle ePHI. We will help you scope the right test.

Written scope and timeline before testing starts
Retest of fixes included
Report mapped to the HIPAA Security Rule

Scope your HIPAA penetration test

Takes about a minute.

HIPAA penetration testing that gives your risk analysis real evidence

Is penetration testing required for HIPAA?

What is HIPAA penetration testing?

What does HIPAA compliance require for security?

From safeguard to recorded evidence

A safeguard, not a scan

Proof your risk analysis can use

Closed, then recorded

How does penetration testing map to the HIPAA Security Rule?

When should you run a HIPAA penetration test?

Risk analysis

Scope ePHI systems

Test

Fix and retest

Evaluation record

Repeat after change

What's in a HIPAA penetration test evidence pack?

Executive summary

Scope and method

Findings with proof

Fix guidance

Retest results

Security Rule mapping

Services that support a HIPAA program

Role-based access, authentication and encryption tested in a Citrix-hosted environment

Read before you scope your HIPAA test

HIPAA penetration testing questions

Is penetration testing required for HIPAA?

Will the proposed HIPAA Security Rule update require penetration testing?

How often should we run a HIPAA penetration test?

Do business associates need HIPAA penetration testing?

What should a HIPAA penetration test cover?

Is a vulnerability scan enough for HIPAA?

Does ioSENTRIX certify HIPAA compliance?

Get HIPAA evidence your risk analysis can rely on