Does HIPAA Require a Penetration Test? What the Rule Says Today

Does HIPAA require a penetration test?

No. The current Security Rule does not mention penetration testing anywhere. The rule requires, at 45 CFR 164.308(a)(8), a periodic technical and non-technical evaluation of whether your security policies and procedures meet the rule's requirements, and a risk analysis under 164.308(a)(1)(ii)(A) that identifies vulnerabilities to ePHI. A penetration test is one way to do the technical part of that. It is not the only way, and it is not named.

That answer changes if the January 2025 proposal becomes final, so the rest of this post covers both.

The rule as it stands today

The evaluation standard reads, in effect: perform a periodic technical and non-technical evaluation, based initially on the standards in the rule and afterwards in response to environmental or operational changes affecting the security of ePHI, that establishes how well your policies and procedures meet the rule.

Three things follow from the wording.

1. It is periodic. Once, at implementation, is not enough; a new EHR, a new location or a breach triggers another.
2. It has a technical half. Reading policies does not satisfy it. Something has to look at the systems.
3. It is outcome-based. HHS leaves the method to you, provided the method is reasonable for a practice of your size and risk.

The technical half can be a configuration review, a vulnerability scan, a penetration test or a combination. For a two-location practice on a cloud EHR, a quarterly external scan plus an annual configuration review of the email tenant, the firewall and the devices is a defensible evaluation. For a practice that runs its own patient portal or integrates with hospital systems, a penetration test of that portal is hard to argue against.

The January 2025 proposal

The proposed rule, published in the Federal Register on 6 January 2025, would turn the choice into a requirement. Among its changes, it would require vulnerability scanning at least every six months and penetration testing at least once every twelve months, alongside an annual compliance audit, a written asset inventory and network map, encryption and multi-factor authentication as mandatory rather than addressable specifications.

The status line: the January 2025 proposal is still a proposal; the Unified Agenda lists final action for July 2027; the current rule applies now. Nothing in the proposal is enforceable today, and the final text can differ.

Our Security Rule update guide tracks the proposal in detail. The practical advice has not changed since we wrote it: a practice that starts scanning twice a year now will have an evidence trail before any final rule needs one.

The price of a penetration test

Published ranges are wide because scope varies. "The average cost of a penetration test ranges from $2500 to $50,000," according to Astra Security's pricing guide updated 19 August 2026, and the same page says "External network pentests typically cost $5,000-$10,000 for up to 25 IPs". A small practice with one public IP and a cloud EHR sits at the bottom of that range or below it; a practice hosting its own portal sits higher.

Vulnerability scanning is a different line. Scanners run as software, monthly or quarterly, for a fraction of a test, and that is the control most small practices are missing. What a HIPAA risk analysis costs covers how testing fits into the analysis fee.

When a test is worth it now

Situation	Reasonable technical evaluation
Cloud EHR, cloud email, no servers on site	Quarterly external vulnerability scan, annual configuration review, device check
Self-hosted EHR or file server	The above plus an internal scan and a review of remote access
Patient portal, custom integration or API you built or host	Annual penetration test of that application
Hospital or payer vendor review asks for a pen test report	Annual test, scoped to what they ask about
Cyber insurer asks on the renewal form	Whatever the form specifies; a scan report often satisfies it
After a breach or a serious incident	A test of the affected systems, as part of the response

If your risk analysis has not identified which row you are in, start there. Risk analysis vs a full compliance program explains why the analysis comes first, and the HIPAA annual review shows where the evaluation sits in the yearly calendar.

Where AccuSights fits

We do the evaluation as part of the risk analysis, run the scans ourselves with the endpoint agent that is built in, and scope a penetration test only where your systems justify one, with a named engineer rather than a ticket queue and remediation included. We do not certify HIPAA compliance, because no one can. Start with the HIPAA framework page or book a free Risk Diagnosis and we will tell you which row of the table you are in.