HIPAA penetration testing is not named in the current Security Rule, but it is moving from good practice toward a stated requirement: HHS proposed annual testing in January 2025, and a Senate-passed bill would direct HHS to require monitoring that includes penetration testing. Neither is in force today. That does not make the question academic, because the current rule already requires a risk analysis and a periodic evaluation of security controls, and a test is the strongest evidence most organizations can produce for both. This guide explains what the rule says now, what is proposed, how a penetration test differs from a vulnerability scan and a risk analysis, what a HIPAA-focused test should cover, and how to turn the results into evidence an auditor or OCR investigator will accept.
HIPAA Penetration Testing Requirements Today
What the Current Security Rule Says
The current HIPAA Security Rule does not mention penetration testing or vulnerability scanning by name. It requires two things that testing supports. The first is an accurate and thorough risk analysis of the risks to the confidentiality, integrity, and availability of ePHI (45 CFR 164.308(a)(1)(ii)(A)). The second is a periodic technical and nontechnical evaluation of how well the security policies and procedures meet the rule (45 CFR 164.308(a)(8)).
A penetration test is a widely used way to make both defensible, because it shows what an attacker can actually reach rather than what a policy says should be protected. Findings also feed the risk management requirement, which obliges an organization to reduce identified risks to a reasonable and appropriate level. HHS has stated that the current Security Rule remains in effect while the rulemaking described below continues.
Why the Lack of a Named Requirement Still Creates Exposure
The absence of a named requirement is not the same as safety. OCR has made failures to conduct an accurate and thorough risk analysis the centerpiece of its enforcement since launching its Risk Analysis Initiative in October 2024, and a risk analysis built only on questionnaires and policy review has no technical evidence behind it. Enterprise customers, health plans, and cyber insurers also often ask for a recent third-party test report during security reviews, whether or not HIPAA asks for one.
There is a practical argument as well. A risk analysis states that a vulnerability exists; a test shows whether it can be exploited and what it leads to. That difference is what lets a compliance officer rank risks by evidence instead of by opinion. Elevate’s guide to the HIPAA security risk assessment covers how the two fit together.
What Is Changing: The HHS Proposal and the Senate Bill
The HHS Proposal Would Make Annual Testing Explicit
HHS published a proposed update to the Security Rule on January 6, 2025. It would require penetration testing at least once every 12 months, or in accordance with the organization’s risk analysis, whichever is more frequent, and it would require vulnerability scanning at least every six months. The proposal defines who may perform the test: a qualified person with appropriate knowledge of and experience with generally accepted cybersecurity principles and methods for protecting the confidentiality, integrity, and availability of ePHI. It applies to covered entities and business associates. The text is in the Federal Register, and HHS’s fact sheet summarizes it.
It is still a proposal. Reporting on HHS’s rulemaking schedule places a final rule no earlier than July 2027 and notes that it may never be finalized. The practical reading is that the proposal describes what HHS considers good practice, so an organization that tests annually is aligned with it whether or not it becomes final.
The Senate Bill Names Penetration Testing Too
The Health Care Cybersecurity and Resiliency Act (S. 3315) passed the Senate by unanimous consent on September 30, 2026. Section 8 would direct HHS to update the Security Rule to require covered entities, business associates, and other non-governmental entities in the Healthcare and Public Health Sector to adopt minimum risk-based practices, including requirements to conduct monitoring, including penetration testing, to maintain the protections of information systems. The bill is not law, the House must still act, and any resulting regulations would take effect 36 months after enactment. Unlike the HHS proposal, the bill sets no testing frequency and leaves that to rulemaking. The text is on Congress.gov.
Two independent efforts, one regulatory and one legislative, now name the same control. That makes penetration testing a reasonable baseline to plan around even though neither effort has produced a binding rule.
Penetration Testing vs Vulnerability Scanning vs Risk Analysis
How the Three Fit Together
The three terms are often used interchangeably, and that confusion is the most common reason an organization believes it has done more than it has. Each answers a different question, and HIPAA needs all three eventually.
| Activity | Question it answers | Method | Role under HIPAA |
|---|---|---|---|
| Risk analysis | Where is ePHI, and what could harm it? | Structured review of assets, threats, vulnerabilities, likelihood, and impact | Required today |
| Vulnerability scan | Which known weaknesses exist? | Automated tools run against systems | Proposed at least every 6 months |
| Penetration test | Can an attacker get in and reach ePHI? | A qualified person simulates attacks and chains weaknesses | Proposed at least every 12 months; named in S. 3315 |
The table shows why a scan cannot stand in for a test. A scan lists weaknesses and assigns severity from a database, while a test shows whether those weaknesses combine into a path to patient data. A test is also not a risk analysis: it is one input to it. A report that says an attacker reached a billing database through a forgotten VPN account is evidence for the risk analysis, but it does not identify every place ePHI lives or rank every threat. Elevate’s Vulnerability Management as a Service covers the scanning layer between tests.
What a HIPAA Penetration Test Should Cover
Start From the ePHI Inventory, Not the IP Range
The scope of a HIPAA test should follow the data. Begin with the systems that create, receive, maintain, or transmit ePHI, then add the paths that lead to them: identity systems, remote access, and the connections to vendors and business associates. A scope built from an address range tests whatever happens to be in the range, while a scope built from the ePHI inventory tests what the Security Rule is actually about. The same inventory is an input to the risk analysis, so the work is not duplicated.
Systems and Attack Paths Worth Including
Externally reachable services come first: VPNs and remote access gateways, patient and provider portals, email, and anything exposed to the internet that connects to a system holding ePHI. Web applications and APIs deserve their own testing, since patient portals and integrations between electronic health record systems and other applications are common entry points. Elevate’s guide to web application penetration testing covers that method.
Internal testing asks what an attacker could do after gaining a foothold. It examines whether the network is segmented so that a compromised workstation cannot reach clinical or billing systems, whether privileged accounts and Active Directory can be abused, and whether multifactor authentication can be bypassed. Cloud configurations, wireless networks, and, where the organization agrees, phishing and other social engineering belong in scope when they lead to ePHI. Connected medical and building devices can be included only with explicit rules, because testing must never put patient care at risk.
Methods and Standards Behind a Credible Test
A credible test follows a documented method rather than a tool run. NIST SP 800-115 is the standard reference for technical security testing, and the OWASP Web Security Testing Guide is the usual basis for web applications. The report should state which methodology was used, what was in scope and excluded, how findings were rated, and which tests were manual rather than automated. Automated scanning alone does not meet the description of a penetration test, and a report that cannot show manual work should be treated as a scan.
How to Scope and Prepare a HIPAA Penetration Test
Set Rules of Engagement That Protect Patient Care
Before testing starts, agree in writing on the testing window, the systems that are off limits, the actions that are prohibited, and who the tester calls if something breaks. Production systems that support clinical care need particular care: denial-of-service techniques are normally excluded, and an emergency stop procedure should exist. System owners and any cloud providers whose approval is required must authorize the test in advance. These rules protect patients as well as the organization, and they are part of what a qualified tester should ask for unprompted.
Decide Whether the Testing Firm Needs a Business Associate Agreement
A tester who may encounter ePHI during an engagement raises a HIPAA question of its own. Many organizations execute a business associate agreement with the testing firm, or document a determination that none is needed, and define how evidence containing ePHI is handled, retained, and destroyed. The right answer depends on the engagement and on the organization’s own determination, so confirm it with counsel. This is general information, not legal advice. What is not acceptable is to leave the question unasked, because the report itself may contain screenshots or data samples.
Choose a Frequency That Matches the Proposal
An annual test is the sensible baseline, because it matches what HHS has proposed. The proposal also says testing should follow the risk analysis when that calls for more, which in practice means testing after significant changes: a new electronic health record platform, a cloud migration, a major release of a patient-facing application, or a merger that brings in new systems. Vulnerability scanning between tests keeps the picture current, and a risk-based schedule is easier to defend than a calendar date nobody can explain.
Pick a Qualified Tester
The HHS proposal defines a qualified person by knowledge and experience, not by a named certification. In practice, look for independence from the team that built or manages the systems, experience with healthcare environments, a documented methodology, manual testing, and a retest included in the engagement. Elevate’s guides on how to choose a penetration testing company and on what drives penetration testing cost work through both questions.
Penetration Test Results as HIPAA Evidence
Map Findings to the Risk Analysis and Risk Management Plan
A report that sits in a folder is not evidence of compliance. Each finding should become an entry in the risk analysis and the risk management plan, with an owner, a decision on how the risk will be treated, and a date. Critical and high findings that involve ePHI systems come first. The mapping is what turns a technical document into proof that the organization identified a risk and acted on it, which is exactly what an investigator looks for after a breach.
Retest and Keep the Record
Fixing a finding is not the same as verifying the fix, so critical and high findings should be retested and the results recorded. HIPAA requires documentation of required actions and assessments to be retained for six years, which makes the scope statement, the report, the remediation evidence, and the retest confirmation worth keeping together. A year later, that package is what answers the question of whether testing happened and what was done about it.
Elevate’s penetration testing practice has delivered 500+ penetration tests across networks, web applications, APIs, and AI and LLM systems, and its HIPAA compliance service connects the results to the risk analysis. If you want to scope a test against your ePHI systems, book a call with an Elevate advisor.
Conclusion
Penetration testing sits in an unusual place in HIPAA: not named in the current rule, proposed as an annual requirement by HHS, and named again in a Senate-passed bill. The consistent signal is that organizations are expected to show what an attacker can actually reach, not only what their policies say. That is already the standard that the risk analysis and evaluation requirements imply, and the proposals would make it explicit.
The practical plan is short. Scope from the ePHI inventory, test at least annually and after significant change, use a qualified tester with a documented method, agree on rules that protect patient care, settle the business associate question, and map every finding to the risk analysis and risk management plan. Keep the package for six years. An organization that does this is aligned with the HHS proposal and the Senate bill whether or not either becomes final.
There is no official HIPAA certification, and HHS enforces the rule. Elevate Consult prepares healthcare organizations and their vendors for audits and OCR reviews, from the risk analysis through testing. Book a call with an Elevate advisor to scope a test against your ePHI systems.
Key Takeaways
HIPAA penetration testing is not required by name today, but the direction is clear and the preparation is the same either way.
- Not named today. The current Security Rule does not mention penetration testing, but it requires a risk analysis and periodic evaluation that testing supports.
- Annual testing is proposed. HHS’s January 2025 proposal would require tests at least every 12 months, by a qualified person, or more often according to the risk analysis; it is not final.
- The Senate bill names it too. S. 3315 would direct HHS to require monitoring that includes penetration testing; it is not law and sets no frequency.
- A scan is not a test. Scanning lists known weaknesses, while a penetration test shows whether an attacker can reach ePHI.
- Scope from the data. Start with the ePHI inventory, add the paths that lead to it, and set rules of engagement that protect patient care.
- Evidence is the point. Map findings to the risk analysis, retest, and keep the record for six years.
Frequently Asked Questions
Does HIPAA require penetration testing?
Not explicitly today. The current HIPAA Security Rule does not name penetration testing, but it requires an accurate and thorough risk analysis and a periodic technical and nontechnical evaluation, and a penetration test is a widely used way to support both. HHS proposed in January 2025 to require penetration testing at least once every 12 months, or more often according to the risk analysis, but that proposal is not final. A Senate-passed bill would also direct HHS to require monitoring that includes penetration testing. HHS has said the current rule stays in effect during the rulemaking.
How often should a HIPAA penetration test be performed?
At least once a year is the sensible baseline, because it matches the HHS proposal, which would require testing at least every 12 months or in accordance with the risk analysis, whichever is more frequent. Testing should also follow significant changes, such as a new electronic health record platform, a cloud migration, a major release of a patient-facing application, or an acquisition that adds systems. Vulnerability scanning between tests keeps the picture current. No frequency is binding today, so document the reasoning behind the schedule you choose.
What is the difference between a HIPAA penetration test and a vulnerability scan?
A vulnerability scan uses automated tools to list known weaknesses and rate their severity. A penetration test is performed by a qualified person who simulates an attacker, chains weaknesses together, and shows whether ePHI can actually be reached. The HHS proposal treats them as separate requirements, with scans at least every six months and tests at least every 12 months. A scan cannot replace a test, and a test does not replace regular scanning.
Does a penetration testing company need a business associate agreement?
It depends on whether the tester may encounter ePHI and on the organization’s own determination. Many organizations execute a business associate agreement with the testing firm, or document why none is needed, and set rules for how evidence containing ePHI is handled, retained, and destroyed. The question should be settled before testing starts and confirmed with counsel. This is general information, not legal advice.
Does a penetration test satisfy the HIPAA risk analysis requirement?
No. A penetration test is one input to a risk analysis, not a substitute for it. The risk analysis must identify where ePHI is created, received, maintained, and transmitted, and assess threats, vulnerabilities, likelihood, and impact across all of it. A test shows which vulnerabilities an attacker can exploit and what they lead to, which makes the analysis more accurate, but each finding still has to be recorded and treated in the risk analysis and risk management plan.