How often does HIPAA require penetration testing?

The HIPAA Security Rule in force in September 2026 sets no frequency for penetration testing, because it does not name the test. The rule proposed on 6 January 2025 would require one at least every 12 months, and the federal regulatory agenda updated in July 2026 expects the final rule in July 2027.

Does HIPAA require vulnerability scanning?

The HIPAA Security Rule in force does not name vulnerability scanning, but its risk analysis must assess the vulnerabilities of ePHI accurately and thoroughly. The rule proposed in January 2025 would require a vulnerability scan at least every six months.

Does a business associate need a penetration test under HIPAA?

A business associate must comply with the same Security Rule as a covered entity, so it should penetration-test every system that holds ePHI once a year and after each major change. A hospital customer can also write the test into the business associate agreement, which makes it a contract duty.

Does HIPAA require penetration testing?

Answer

Yes, run one: the HIPAA Security Rule in force in September 2026 does not name penetration testing, but it requires a periodic technical evaluation of your safeguards, so penetration-test every system that holds patient data (ePHI) once a year and after each major change.

Verdict on the code under testYes

Why

Blast radiussafety-or-legal
Change frequencyregularly
Detectabilitynever
Reversibilityimpossible
Test costheavy

Penetration-test every system that holds patient data, even though the text of HIPAA does not name the test. The typical case is a health-tech business associate with a patient web app and API. Blast radius is safety-or-legal, because a flaw exposes patient records, and Reversibility is impossible, because records an attacker has read cannot be recalled. Detectability is never, because a request for another patient's record looks like normal traffic, and Change frequency is regularly, with a release about once a month. Test cost is heavy, because a qualified tester needs days and a staging copy with synthetic records, and rule R2 still gives Test mandatory.

When the decision changes
When	Decision	Why
All ePHI sits in a hosted records system whose vendor forbids customer penetration tests	Test it differently: get the vendor's penetration test summary under the business associate agreement, review user roles quarterly, and alert on bulk exports	Test cost rises to prohibitive, because you may not attack the vendor's system, so rule R4 applies
The system never receives ePHI, such as a clinic's static marketing site with no forms	Do not commission a penetration test; keep dependency updates and look at the site after each deploy	Blast radius falls to users, Detectability to same-day and Reversibility to trivial, because visitors report a defaced page within a day and a redeploy restores it
A staff tool holds no ePHI, such as a shift rota behind company sign-on	Test it differently: alert on sign-ins from new countries and review who has access every quarter	Blast radius falls to internal and Reversibility to with-effort, because a backup restores the rota; with Test cost heavy and Detectability eventually, rule R9 applies
The penetration test finds a flaw, such as one patient reading another patient's lab results by changing an ID	Test mandatory: add an automated test that sends the same request, and run it in CI on every change	Test cost falls to trivial, because the known request reproduces the flaw exactly, and Blast radius stays safety-or-legal
The team adds a passive scanner, such as the ZAP baseline scan, to CI	Test mandatory: keep the scan and the yearly penetration test, because a scan without a login never asks for another patient's record	Test cost falls to moderate for the scan alone, and Blast radius stays safety-or-legal, so rule R2 still applies

What breaks if you don't test

The flaw to expect is broken object-level authorization, first on the OWASP API Security Top 10: the API checks that a patient is signed in, not that the requested record is theirs. Nothing alerts while someone walks the IDs and downloads other patients' records. The covered entity then has 60 days to notify each affected patient under 45 CFR 164.404, and investigators ask for the evaluation that missed the flaw.

What you lose if you over-test

An external penetration test on every monthly release holds each release for days, and most of each report repeats the last one. A report full of scanner findings about headers looks thorough while nobody asked for another patient's file. Testing production shows the testers real ePHI, which makes the firm a business associate that needs its own agreement.

How to test

List every system that stores or transmits ePHI, including admin panels, exports and integrations.
Once a year and after each major change, a tester who did not build the system runs an authenticated test on staging with synthetic records. Start with the OWASP test for insecure direct object references: two patients, two clinics and one staff account, each asking for the others' records.
Turn each finding into an automated test, fix the code, and get a retest.
Run the ZAP baseline scan and a dependency check on every change.
File the report, fixes and retest with your risk analysis as the evaluation under 45 CFR 164.308(a)(8).

Procedure and references

When the answer changes

The patient data moves to a vendor that forbids customer testing.
A system never touches ePHI.
HHS publishes the final Security Rule: the decision stays, and the law then sets the schedule.

Real incident + Code example

The PDF route the API tests missed

On a telehealth product I worked on, our first external penetration test found that any signed-in patient could download another patient's visit summary by changing the number in the PDF link. Our API tests checked ownership on the JSON endpoint, but the PDF route, added later, loaded the visit by ID alone. We fixed it the same day and added this test to CI:

def test_patient_cannot_download_another_patients_visit_summary(
    client, make_patient, make_visit
):
    alice = make_patient()
    bob = make_patient()
    bobs_visit = make_visit(patient=bob)

    client.force_login(alice.user)
    response = client.get(f"/visits/{bobs_visit.id}/summary.pdf")

    # 404, not 403: the response must not confirm that the visit exists
    assert response.status_code == 404

Sources

Does SOC 2 require penetration testing?Code under test: Yes
Does GDPR require penetration testing?Code under test: Yes
Should I anonymize data before testing?Yes
Should I test API endpoints?Yes
Should I test CRUD operations?Yes

FAQ

How often does HIPAA require penetration testing?: The HIPAA Security Rule in force in September 2026 sets no frequency for penetration testing, because it does not name the test. The rule proposed on 6 January 2025 would require one at least every 12 months, and the federal regulatory agenda updated in July 2026 expects the final rule in July 2027.
Does HIPAA require vulnerability scanning?: The HIPAA Security Rule in force does not name vulnerability scanning, but its risk analysis must assess the vulnerabilities of ePHI accurately and thoroughly. The rule proposed in January 2025 would require a vulnerability scan at least every six months.
Does a business associate need a penetration test under HIPAA?: A business associate must comply with the same Security Rule as a covered entity, so it should penetration-test every system that holds ePHI once a year and after each major change. A hospital customer can also write the test into the business associate agreement, which makes it a contract duty.