Access control
The safeguard most often failed, and the one that leaks records.
- Access between patients and between providers
- Role separation in practice
- Emergency access procedure
- Unique user identification
The HIPAA Security Rule does not require a penetration test. It requires a risk analysis under §164.308(a)(1)(ii)(A) and periodic technical and non-technical evaluation under §164.308(a)(8), and testing is how most covered entities and business associates satisfy the second. A proposed rule published in January 2025 would change that to an explicit annual requirement, but it is still a proposal, and we are not going to sell you work on the strength of a rule that has not been made.
We are a Pakistani company, and that matters here more than in any other engagement we offer. HIPAA itself does not prohibit protected health information being accessed from outside the United States. Several states and many state contracts do: Wisconsin restricts contractors and subcontractors from performing work abroad involving access to patient health information, Texas requires certain managed care services and data to be kept within the United States, Florida ties certified electronic health record data to the continental US, its territories or Canada, and Medicare Advantage organizations must obtain signed offshore vendor attestations.
So here is how we work, and it is not a negotiating position. We test against sanitised or staging environments containing no live patient data, and that is written into the scope document before anything begins. If your contract or your state requires the work to be performed on US soil or by a US-based entity, we are the wrong firm and we would rather say so now than three weeks into procurement.
Scoped to the systems that create, receive, maintain or transmit electronic protected health information, and mapped to the technical safeguards at §164.312.
The safeguard most often failed, and the one that leaks records.
Proving the person is who they claim.
What travels, and whether it is protected on the way.
Where health systems usually connect to each other badly.
Whether you could reconstruct who looked at what.
What the periodic evaluation standard asks you to be able to show.
Before scope, before price. Whether we can lawfully and contractually do this work for you.
The systems that touch ePHI, and the roles that reach it.
Access control first, because that is where the records leak.
Mapped to the safeguards so it feeds your risk analysis.
Dated evidence you can show if asked.
Two documents and a conversation. Written so the person who signs the invoice and the person who writes the fix can both use them.
The work follows HIPAA Security Rule 45 CFR Part 164 Subpart C, NIST SP 800-66, OWASP Web Security Testing Guide and NIST SP 800-115, so the coverage can be checked rather than taken on trust, and the report maps to what your auditor or your enterprise customer already recognises.
This page is one part of our compliance and audit service. Where a finding needs a different kind of engagement to answer properly, we say so in the report rather than selling you the test we happen to be running.
Not today. The Security Rule requires a risk analysis under §164.308(a)(1)(ii)(A) and periodic evaluation under §164.308(a)(8); neither names a penetration test. A notice of proposed rulemaking published in January 2025 would add an explicit annual requirement, with vulnerability scanning every six months. It has not been finalised, and the regulatory agenda has pushed projected final action well beyond its original date. We will update this page when it changes.
Sometimes, and not always. HIPAA itself does not bar offshore access to protected health information, but several states and many state contracts do. We test against sanitised or staging environments with no live patient data and put that in the scope document. If your obligations require the work to be done on US soil, we will tell you we are the wrong firm.
A copy of your system with synthetic or de-identified records in place of real ones. It has to be configured like production to be worth testing - same roles, same integrations, same settings - and we will review that with you before starting rather than discover the difference in the findings.
Yes. The Security Rule reaches business associates directly, and in practice your covered-entity customers will ask for a penetration test report during vendor review whatever the rule says. That second pressure usually arrives first.
Nothing we produce can guarantee that, and anybody promising it is overselling. What a dated, scoped, independent evaluation with documented remediation does is evidence that you performed the periodic evaluation the rule asks for. That is worth having and it is not a guarantee.
Tell us what you need tested. Our team will reply with a clear scope and quote.
An assistant, not a person, so check anything important with us. Please do not type passwords or card numbers here. Messages are kept so we can answer you better.