HIPAA does not explicitly require penetration testing by name, but the Security Rule mandates regular technical and non-technical evaluations under §164.308(a)(8), and penetration testing is one of the most effective ways to satisfy this requirement. For small medical practices handling protected health information (PHI), annual penetration testing combined with vulnerability scanning is the practical standard that demonstrates due diligence and helps avoid the average $50,000+ penalties for HIPAA violations.
The context matters more in 2026 than ever. Clop ransomware is actively targeting healthcare organizations, with tech giants Philips and GE investigating recent breach claims. Meanwhile, CISA has flagged actively exploited vulnerabilities including CVE-2025-62593 in Ray-Project Ray, and ransomware gangs are exploiting Windows Task Host flaws. Small practices are not exempt from these threats—attackers increasingly target healthcare specifically because patient data commands premium prices on dark web markets.
What HIPAA Actually Says About Security Testing
The HIPAA Security Rule requires covered entities to conduct regular evaluations of their security measures. Specifically, the Security Management Process standard (§164.308(a)(1)) requires a risk analysis and risk management program, while the Evaluation standard (§164.308(a)(8)) requires periodic technical and non-technical evaluations.
HHS guidance has consistently emphasized that "periodic" means at least annually, and whenever there are significant changes to systems or threats. The Office for Civil Rights (OCR) has cited inadequate risk assessments in numerous enforcement actions, with settlements ranging from $31,000 to over $16 million.
Penetration testing goes beyond basic vulnerability scanning by simulating real attacker behavior—attempting to exploit discovered weaknesses, chain vulnerabilities together, and access PHI. This active testing approach reveals whether your defenses actually work under attack conditions.
What Small Practices Actually Need
For a practice with 3-15 employees, a typical annual security evaluation should include:
External penetration test: Testing your internet-facing systems (patient portal, email, website, remote access) from an attacker's perspective. This usually takes 1-3 days of testing time and costs $3,000-$8,000 depending on scope.
Internal network assessment: Testing what an attacker could access if they compromised one workstation or gained physical access. Includes wireless security, workstation hardening, and segmentation. Usually 1-2 days, $2,500-$6,000.
Vulnerability scanning: Automated quarterly scans of all systems to identify missing patches and misconfigurations. Many firms include this as an ongoing service for $200-$500/month.
Social engineering testing: Phishing simulations to test staff awareness. Given that over 90% of breaches start with phishing, this is critical. Usually $1,000-$2,500 for a campaign.
Wireless network testing: If you offer patient WiFi or use wireless for practice operations. $1,500-$3,000.
A comprehensive first-year program typically runs $8,000-$15,000, with annual retesting at $6,000-$12,000. Practices with electronic health record (EHR) systems hosted entirely by HIPAA-compliant vendors may have slightly reduced scope, but you're still responsible for workstations, network security, and access controls.
Common Mistakes That Trigger OCR Investigations
The biggest mistake is treating HIPAA compliance as a checkbox exercise. OCR investigators look for evidence of an ongoing security program, not a one-time audit.
Assuming your EHR vendor handles everything: Your Business Associate Agreement (BAA) covers their systems, not your network, workstations, or staff practices. Third-party breaches are increasingly common—Heights Finance just disclosed that hackers stole data from 1.2 million individuals via a third-party platform.
Only doing vulnerability scans: Automated scanners find known vulnerabilities but don't test whether attackers can actually exploit them or chain them together. GitLab just patched a critical GraphQL flaw that could let unauthenticated attackers delete projects—automated scans might flag it, but penetration testing shows the real-world impact.
Ignoring WordPress and web applications: If your practice website runs WordPress, you're exposed. A Forminator plugin flaw affecting 600,000+ sites enables unauthenticated remote code execution. Patient portals and appointment schedulers need security testing.
No documentation: HIPAA requires documented policies, risk assessments, and remediation plans. A penetration test without a formal report and remediation tracking provides no compliance value.
Treating penetration testing as adversarial: The goal is to find and fix problems before real attackers do. Practices that view testing as "trying to make us look bad" miss the point entirely.
The Step-by-Step Process
Month 1: Initial risk assessment and scoping
Identify all systems that store, process, or transmit PHI. This includes EHR, billing systems, email, patient portals, backup systems, and even fax servers. Document your network architecture and create an asset inventory.
Month 2-3: First penetration test
Engage a qualified firm to conduct external and internal testing. Testing should occur during business hours so staff behavior and active systems are evaluated. Expect 2-4 weeks from kickoff to final report.
Month 4-6: Remediation
Address high and critical findings immediately. Medium-risk items should have remediation plans with timelines. Document everything—OCR wants to see that you identified risks and took reasonable steps to address them.
Ongoing: Quarterly vulnerability scanning
Automated scans catch new vulnerabilities as they're disclosed. CISA's Known Exploited Vulnerabilities catalog grows weekly—you need continuous monitoring.
Annual: Retesting and program review
Repeat penetration testing annually and after significant changes (new EHR, office move, new patient portal). Update your risk assessment and security policies.
What Makes Healthcare Testing Different
Medical practices can't afford downtime. Testing must be carefully scoped to avoid disrupting patient care. Experienced penetration testers use non-disruptive techniques and maintain constant communication.
PHI access during testing requires special handling. Testers should work under a BAA and follow HIPAA minimum necessary standards. Any PHI accessed during testing must be documented and securely handled.
Medical devices add complexity. Many practices now have network-connected diagnostic equipment, imaging systems, or IoT devices. These often run outdated software and can't be easily patched, requiring network segmentation and compensating controls.
Beyond Compliance: Real Security
The Azure credential theft affecting Fortune 500 companies and French tax authority breach affecting 678,000 individuals demonstrate that even large, well-resourced organizations struggle with security. Small practices face the same sophisticated threats but with fraction of the resources.
Penetration testing helps you:
Identify exposures before breaches: The average healthcare breach costs $408 per record. For a practice with 10,000 patient records, that's $4 million in potential exposure.
Validate security investments: Are your firewall, antivirus, and security awareness training actually working? Testing provides evidence.
Meet cyber insurance requirements: Most policies now require annual testing and may deny claims if you can't demonstrate due diligence.
Avoid OCR penalties: Documented security testing and remediation demonstrates the "reasonable and appropriate" safeguards HIPAA requires.
Getting Started
Look for penetration testing firms with healthcare experience and relevant certifications (OSCP, GPEN, CEH). Ask about their testing methodology, reporting format, and whether they'll work under a BAA. Request references from other small practices.
Budget $10,000-$15,000 for your first comprehensive assessment, then $6,000-$10,000 annually for ongoing testing. This is substantially less than the average HIPAA penalty or breach cost.
Start with a risk assessment to identify your highest-priority systems, then phase in testing over 6-12 months if budget is constrained. The key is establishing a documented, ongoing program—not achieving perfect security overnight.
If you're a small medical practice in the New York area looking to establish HIPAA-compliant security testing, Vici Tech Solutions provides penetration testing specifically tailored to healthcare organizations.