HIPAA penetration testing: what the Security Rule requires today, and what HHS has proposed
Today's HIPAA Security Rule does not name penetration testing. It requires an accurate and thorough risk analysis under 45 CFR 164.308(a)(1)(ii)(A) and a periodic technical and nontechnical evaluation under 164.308(a)(8). In January 2025 HHS proposed a rule that would require penetration testing at least once every 12 months and vulnerability scans at least every six months. On 15 September 2026 the Federal Register showed no final rule, so it is not in force. A penetration test is still a direct way to put real technical findings into your risk analysis. Matproof Sentinel costs EUR 149 per run and uses AI agents only.
What the rule says today, and what is proposed
The current Security Rule is risk-based. Section 164.308(a)(1)(ii)(A) requires “an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.” Section 164.308(a)(8) requires “a periodic technical and nontechnical evaluation”. Neither section names a test method or an interval. On 6 January 2025 HHS published a proposed rule, 90 FR 898, that would add a vulnerability management standard at 164.312(h). Its text says “Penetration testing must be performed at least once every 12 months” or more often where the risk analysis requires, by “a qualified person”, and that automated vulnerability scans run “at least once every six months” or more often. On 15 September 2026 the Federal Register listed only the proposed rule under RIN 0945-AA22, with no final rule and no withdrawal, and eCFR showed 164.308 and 164.312 unchanged. We could not reach the federal regulatory agenda, so we print no target date.
- Today, 164.308(a)(1)(ii)(A): an accurate and thorough assessment of risks and vulnerabilities to ePHI. No test method is named.
- Today, 164.308(a)(8): a periodic technical and nontechnical evaluation. No interval is named.
- Proposed, 164.312(h)(2)(iii): penetration testing at least once every 12 months by a qualified person, or more often if your risk analysis says so.
- Proposed, 164.312(h)(2)(i): automated vulnerability scans at least once every six months, or more often.
- Status on 15 September 2026: proposed, not final. Do not plan around a date a vendor gives you, including us.
What a HIPAA-focused penetration test should cover
- Access to ePHI (164.312(a)(1)): authenticated testing to confirm that only authorized users reach patient data, with no broken access control or cross-patient exposure.
- Web applications and APIs: OWASP Top 10 and OWASP API Security Top 10 across patient portals, EHR integrations and health data APIs, FHIR endpoints included.
- Transmission security (164.312(e)(1)): TLS configuration and cipher strength for ePHI in transit.
- Authentication and audit controls (164.312(d) and (b)): MFA enforcement, session management, and whether access to ePHI is logged.
- Data exposure: ePHI leaking through verbose errors, unprotected endpoints or misconfigured storage.
- Report: scope, method, CVSS ratings, proof of exploit and retest results you can file with your risk analysis.
Sample finding
Patient records readable across accounts through an insecure direct object reference
Authenticated testing found that a patient portal endpoint, /api/patients/{patientId}/records, returned records based only on the supplied patient ID, without checking that the logged-in user was that patient or an authorized provider. By changing the ID, a test account retrieved other patients' clinical records. That is a direct exposure of ePHI and a failure of the access control standard in 164.312(a)(1).
Fix: Enforce per-record authorization: check that the logged-in user is the patient or an authorized member of the care team for the specific record, in one central authorization layer. Add automated tests that assert cross-patient access is denied, log all access to ePHI, and run the test again to confirm the fix. Record the finding and the fix in your risk analysis.
Reference: OWASP API1:2023 Broken Object Level Authorization · CWE-639 · 45 CFR 164.312(a)(1) Access control · 45 CFR 164.308(a)(1)(ii)(A) Risk analysis
HIPAA penetration testing options
| — | Free scan | Matproof Sentinel | Traditional consultancy |
|---|---|---|---|
| Automated scan engine | ✓ (3-min preview) | ✓ Full scan | ✗ Manual only |
| OWASP Top 10 coverage | Partial | ✓ Complete | ✓ Complete |
| Proof-of-exploit evidence | ✗ | ✓ Per finding | ✓ Per finding |
| Regulatory mapping (DORA/NIS2/ISO 27001) | ✗ | ✓ Automated | ✓ Manual |
| Audit-ready PDF report | ✗ | ✓ Instant | ✓ 2–4 weeks delivery |
| Continuous / recurring scans | ✗ | ✓ Per deploy | ✗ Annual engagement |
| Time to first result | ~3 min | ~30 min full scan | 2–4 weeks |
| Price | €0 | From €149 | €8,000–€25,000 |
| Source code review (SAST) | ✗ | ✓ On Growth plan | ✓ Scoped engagement |
| API testing (REST/GraphQL) | ✗ | ✓ Automated | ✓ Manual |
US-market providers that publish a price and name HIPAA on the same page
Market: United States · Figures checked on 15 September 2026. Every row links to the page the number comes from.
| Scope | Published price | What it covers | Source |
|---|---|---|---|
| Stingrai, Autonomous Pentest | USD 3,000 one-time | One web app plus its APIs, AI agent | Stingrai, pricing |
| Stingrai, Hybrid Pentest | USD 6,800 one-time | AI agent with human pentesters | Stingrai, pricing |
| Aikido Security, typical pentest | USD 4,000 per assessment | Self-serve AI agents | Aikido Security, AI pentest |
| Strobes, PTaaS Standard | USD 4,800 | 5 credits, 1 target | Strobes, pricing (PTaaS tab) |
| CYBRI, Web Application package | From USD 5,000 | Remediation testing listed on larger packages | CYBRI, pricing |
| Packet33, web and API testing | USD 8,000 to USD 30,000 | Practitioner-led, fixed price per scope | Packet33, pentesting |
Each row is one provider's own list price, not a market average. Naming HIPAA on a page does not mean a report satisfies your risk analysis; that judgement is yours. Scope differs by row.
Sources
- eCFR, 45 CFR 164.308 Administrative safeguards — Current text, read 15 September 2026
- Federal Register, HHS proposed rule: HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (90 FR 898) — Published 6 January 2025
- Federal Register, documents under RIN 0945-AA22 — Read 15 September 2026
- Stingrai, pricing — No date shown on page, read 15 September 2026
- Aikido Security, AI pentest — No date shown on page, read 15 September 2026
- Strobes, pricing (PTaaS tab) — No date shown on page, read 15 September 2026
- CYBRI, pricing — No date shown on page, read 15 September 2026
- Packet33, pentesting — No date shown on page, read 15 September 2026
- Matproof pricing — Checked 15 September 2026
Matproof Sentinel for HIPAA
- 1 full pentest scan
- AI-prioritized findings with CVSS 3.1
- Proof-of-exploit per finding
- Audit-ready PDF report
- Regulatory mapping (DORA, NIS2, ISO 27001)
- 3 full Sentinel pentests per month
- Continuous monitoring
- CI/CD integration (GitHub, GitLab)
- All regulatory mappings
- Priority support
- 20 Sentinel pentests per month
- Extra scans at €149 each
- All 10 agents, including Cloud (Prowler) and Mobile (MobSF)
- Continuous schedules: hourly, daily or weekly
- Authenticated scanning (session cookies, bearer tokens)
- Webhook delivery and priority support
Frequently asked questions about HIPAA penetration testing
Does HIPAA require penetration testing?
Not in today's text. 45 CFR 164.308(a)(1)(ii)(A) requires a risk analysis and 164.308(a)(8) requires a periodic evaluation, and neither names penetration testing. An HHS proposed rule published on 6 January 2025 (90 FR 898) would require penetration testing at least once every 12 months. On 15 September 2026 the Federal Register showed no final rule, so that requirement is not in force.
When will the proposed HIPAA penetration testing rule take effect?
We do not know, and we could not confirm a date. The Federal Register lists the proposed rule under RIN 0945-AA22 with no final rule and no withdrawal. The federal regulatory agenda, where a target date would appear, did not load for us. Treat any date you see without a primary source as a guess.
Who would the proposed rule apply to?
The proposed text is written for both covered entities and business associates: it refers to “the covered entity's or business associate's relevant electronic information systems”. Business associates include vendors that handle ePHI for a covered entity, such as SaaS platforms and billing services.
What is a “qualified person” under the proposed rule?
The proposed text says: “A qualified person is a person with appropriate knowledge of and experience with generally accepted cybersecurity principles and methods for ensuring the confidentiality, integrity, and availability of electronic protected health information.” It does not address automated or AI-run testing. Whether an AI-only test would meet it is not settled, and we will not tell you it is.
How much does a HIPAA penetration test cost in the US?
Prices on providers' own pages that also name HIPAA, read on 15 September 2026: Stingrai USD 3,000 for an autonomous test and USD 6,800 for a hybrid test; Aikido Security USD 4,000 for a typical pentest; Strobes USD 4,800 for a standard pack; CYBRI from USD 5,000; Packet33 USD 8,000 to USD 30,000 for web and API testing. Matproof Sentinel is EUR 149 per run or EUR 299 per month. Many firms publish no price.
What is the difference between a HIPAA risk analysis and a penetration test?
The risk analysis is the required process: an assessment of risks and vulnerabilities to ePHI across your safeguards. A penetration test is one technical input to it. It shows which technical weaknesses can actually be exploited, so the risk analysis rests on findings rather than assumptions. You need the risk analysis either way.
Go deeper — related blog articles
What a Matproof Sentinel report does not do for HIPAA
Sentinel runs AI agents that test, and a second AI agent that re-runs each finding. It feeds your risk analysis with technical findings. It is not a risk analysis, and it is not legal advice on what HIPAA requires of you.
- No human penetration tester. The proposed rule speaks of a “qualified person” and does not address AI-run testing, so whether an AI-only test would meet it is not settled.
- No risk analysis. Administrative and physical safeguards are outside what a penetration test covers.
- No social engineering, phishing simulation or physical testing.
- If a customer contract or your counsel asks for a human-led test, buy that engagement and use Sentinel between tests.
Put real technical findings into your risk analysis
Run a free scan to see what is exposed. A full Sentinel report costs EUR 149 per run, with a retest after you fix. It is AI-agent testing with no human tester, and we will tell you when a human-led engagement is the better buy.
Run a free pentest scan