Does HIPAA Require Penetration Testing? Current Rules vs. the Proposal

Current HIPAA penetration testing requirements don’t exist by name: the Security Rule never mentions a penetration test, but it requires a risk analysis and a periodic technical and nontechnical evaluation of your security policies and procedures. So does HIPAA require penetration testing today? Not by name. In January 2025, HHS proposed penetration testing at least once every 12 months, but that proposal isn’t binding.

The rule applies to covered entities and their business associates. Whether a pentest belongs in that evaluation depends on your risk analysis and on where electronic protected health information (ePHI) lives. Our compliance penetration testing covers HIPAA and gives you evidence for that analysis and your audit. We don’t certify HIPAA compliance.

Current HIPAA rules vs. proposed changes

• Current requirement (45 CFR 164.308): Section 164.308(a)(8) calls for a “periodic technical and nontechnical evaluation” of your security policies and procedures, and 164.308(a)(1)(ii)(A) calls for “an accurate and thorough assessment of the potential risks and vulnerabilities” to ePHI. A pentest is one way to show that this evaluation tested real attack paths.
• Proposed NPRM updates: The HHS proposed rule of January 6, 2025 would add these requirements, per the HHS fact sheet:
  • Annual penetration testing: At least once every 12 months, under the proposal (see how often you should run a penetration test).
  • Vulnerability scanning: At least every six months.
  • Multi-factor authentication: Would be required, with limited exceptions.
  • 72-hour restoration: Procedures to “restore the loss of certain relevant electronic information systems and data within 72 hours.”

(Note: As of October 2026, HHS hasn’t finalized the proposal: it remains a proposed rule and isn’t binding, and the current Security Rule remains in effect. See the HHS NPRM page.)

Best practices for a HIPAA penetration test

Test where ePHI lives and keep evidence an auditor can read:

• Scope: Cover every system that stores or moves ePHI, such as patient portals and EHR platforms (web application testing), interfaces such as FHIR APIs (API testing), cloud workloads on AWS, Azure or GCP, mobile apps and internal networks. Include subdomains, older APIs and admin panels.
• Independent testers: Tests are run by our team of 25 certified senior pentesters (OSCP, OSCE, CISSP), aligned with OWASP WSTG, PTES and NIST SP 800-115. We sign an NDA before testing.
• Documentation: You get an Executive Summary for management and a Technical Report listing each vulnerability with exploitation evidence and step-by-step remediation. See a sample penetration test report.

In API tests of medical applications, we’ve found tokens that stayed valid after logout: the interface ended the session, but the backend still accepted the token. A scan can miss this because it doesn’t connect login, logout and the token lifecycle. The fix was to make logout invalidate the token immediately. See our GDPR and HIPAA test of a medical SaaS platform.

Preparing for a HIPAA penetration test: timing, price and retest

Before an audit, plan around these points:

• Timeline: Most of our tests run 1 to 3 weeks, plus a few days for the report. We report critical vulnerabilities while testing is still running.
• Price: HIPAA scopes are quoted individually in tester-days after a scoping call, with no hidden fees. For reference, our standard web application or API test costs $2,500–$5,500, and our complex infrastructure or cloud (AWS or Azure) test runs $5,000–$12,000+ (see penetration testing pricing).
• Retest: To check whether findings are closed, a retest is available after fixes.
• Other frameworks: For EU patient data, see GDPR penetration testing; for other regulations, compare penetration testing requirements.

Sources: 45 CFR 164.308 (eCFR); 45 CFR 160.103 (eCFR); HIPAA Security Rule NPRM, 90 FR 898 (Federal Register); HHS NPRM fact sheet; HHS NPRM page.