Penetration testing for healthcare
A leaked card can be cancelled. A leaked diagnosis cannot, and ransomware groups know a clinic cannot wait days to get its systems back. We test the portals, apps, APIs and networks that hold patient data, and we do it without needing to see a single real record.
Where we focus
Healthcare systems connect many parties: patients, staff, labs, insurers and software vendors. Each connection is a place where the wrong person can end up seeing the wrong record.
| Area | What we test |
|---|---|
| Patient portals and apps | Whether one patient can open another patient's records, results or messages by changing an ID, and whether staff roles stop at what each role needs. |
| FHIR and integration APIs | Health data APIs and EHR integrations tested for broken authorization, over-shared fields and tokens that grant more than they should. |
| Telehealth and mobile apps | What the app stores on the phone, what it sends, and the APIs behind it, against OWASP MASVS. |
| Clinic and hospital networks | External and internal network tests: exposed remote access, weak segmentation between guest, clinical and admin networks, and paths to domain admin. |
| Third-party access | Vendor and support accounts, remote access tools and shared credentials, which are a common way into healthcare networks. |
HIPAA and penetration testing
The HIPAA Security Rule requires a risk analysis and a periodic evaluation of your safeguards. It does not yet name penetration testing, but a test is the most direct evidence that your technical safeguards work.
That may change. Updates to the Security Rule proposed by HHS in January 2025 would require a penetration test at least once a year and vulnerability scans every six months. They are still a proposal, so check the current status with your compliance adviser. Outside the US, health data is a special category under GDPR, and India's DPDP Act requires safeguards for all personal data.
For the wider picture, read our healthcare cybersecurity guide.
How we handle patient data
- A mutual NDA before you share anything
- Test accounts and synthetic records, so real patient data is not needed
- Anything that exposes patient data reported as soon as we confirm it
- Testing windows that keep clinical systems available
- Everything we collected purged at the end of the engagement
Related reading
Healthcare testing questions
Does HIPAA require a penetration test?
Not by name today. The Security Rule requires a risk analysis and periodic technical evaluation, and a penetration test is the usual way to show your safeguards work. Changes proposed by HHS in 2025 would make an annual test mandatory if they are adopted.
Will you need access to real patient data?
No. We ask for test accounts and synthetic records in a test environment. If part of the test has to run against production, we agree the rules first and stop to tell you the moment we can reach real patient data.
Can testing disrupt clinical systems?
We agree testing windows and exclude anything fragile up front. Web, API and mobile testing usually runs against a test environment, and network testing avoids disruptive techniques unless you ask for them.
Can one test cover HIPAA and SOC 2?
Usually, yes, if the scope covers the systems both reviews include. Tell us every framework on the scoping call and the report will be written to support each one.
Start your security assessment.
Tell us about your application, architecture or compliance requirements. Our team will scope a penetration test around them.