What the Security Rule actually says
§164.308(a)(1)(ii)(A) requires an accurate and thorough risk analysis of the risks to electronic protected health information. §164.308(a)(8) requires a "periodic technical and nontechnical evaluation" of how well your safeguards meet the rule. The Office for Civil Rights treats technical testing of your internet-facing and internal systems as part of that evaluation. HIPAA is the least prescriptive framework about frequency and method, which means the burden is on you to show you did something real, documented it, and acted on it.
What a defensible HIPAA test shows
- The systems that store, process, or transmit ePHI were in scope
- Findings rated by severity, with dates
- Remediation and retesting of anything that could expose ePHI
- An annual cadence, or after major changes to systems
Getting it done this week
Automated external penetration testing from Clone Systems covers your internet-facing systems: patient portals, telehealth endpoints, web applications, remote access. From $1,995 for one asset. Internal penetration testing, from $2,995 for 25 hosts, covers the network where ePHI lives. Authenticated web application scanning, from $5,995 a year for 10 applications, tests behind the login where patient data is handled. Managed penetration testing by our engineers is available when a human-led engagement is required.
Why Clone Systems
Clone Systems has served healthcare organizations for over two decades and has been a PCI Approved Scanning Vendor since 2007. Published prices, buy online, results in days.
What is changing
In January 2025 the Department of Health and Human Services proposed an update to the HIPAA Security Rule that would require a penetration test at least once every 12 months and vulnerability scans at least every six months. The update is not final yet, and the government's current schedule projects a final decision in July 2027. Getting on a yearly testing rhythm now means nothing changes for you when it lands.
Not sure which test you need? Answer a few questions.
Will your auditor accept it? See what is in the report.
Buy a pen test and start today · Request managed pen test scoping
Related
- A real penetration test used to cost $10,000
- Penetration testing for SOC 2
- Penetration testing for ISO 27001
- Penetration testing for PCI DSS Requirement 11.4
Clone Systems is a PCI Security Standards Council Approved Scanning Vendor, listed since 2007. This page is general guidance, not legal or audit advice.
Need an engineer-led test? See external network penetration testing, internal network and Active Directory testing, web application penetration testing and cloud penetration testing.