HIPAA penetration testing: what the Security Rule says today and what HHS proposed

The HIPAA Security Rule now in force does not mention penetration testing. In January 2025 HHS proposed a rule that would require one at least every 12 months. As of 9 November 2026 that proposal is not final.

These are two separate facts, and this page gives the exact text and source for each.

What does the current Security Rule require?#

The rule in force (45 CFR Part 164, Subpart C) asks for risk analysis and periodic evaluation. It does not name pentests. We checked the eCFR text of 45 CFR 164.308, current to 5 November 2026. The word "penetration" does not appear in it.

Two standards apply to testing:

• Risk analysis (164.308(a)(1)(ii)(A)): conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information (ePHI).
• Evaluation (164.308(a)(8)): "Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and, subsequently, in response to environmental or operational changes affecting the security of electronic protected health information".

A pentest can serve as part of a technical evaluation. The rule does not say how often, and does not say a pentest is required. You choose methods based on your risk analysis.

What did HHS propose in January 2025?#

HHS published a notice of proposed rulemaking (NPRM) on 6 January 2025 (90 FR 898, document 2024-30983, RIN 0945-AA22). Comments closed on 7 March 2025. The proposal would add a standard for vulnerability management at proposed 164.312(h).

The proposed text includes:

These are proposals. They have no legal force until HHS publishes a final rule.

What is the status as of November 2026?#

The proposal is still not final. The Federal Register lists the January 2025 NPRM as the only action under RIN 0945-AA22 since it was issued. The Unified Agenda entry on Reginfo.gov (agenda 202510) shows the stage "Long-Term Actions" and a final rule date of "07/00/2027".

The status leaves three points open:

• July 2027 is a target date for issuing a final rule. It is not a compliance deadline.
• We could not confirm reports of other recent steps, so we do not state them.
• The rule might change before it is final, or it might not be finalized at all.

This status changes, so check the Federal Register and Reginfo.gov entry for RIN 0945-AA22 before you rely on it.

Why do healthcare customers ask for a pentest now?#

They must manage risk, and they pass that duty to vendors. A covered entity needs assurance from its business associates, and a pentest report is a common form of proof. Contracts, security questionnaires and cyber insurance carry these demands. The Security Rule text does not.

If you sell to healthcare, expect questions like those in security questionnaire pentest questions. Prepare a short, honest answer: when you last tested, the scope, who tested, and the fix status.

How should you plan if the rule might change?#

Plan for the proposal without waiting for it. A yearly web and API test, with retest, is easy to explain under the current rule and fits the proposal. It costs you little if the rule does not pass. A workable plan:

1. Put pentesting into your risk analysis as a technical evaluation method.
2. Set an interval you can defend, for example once a year and after major changes. See how often should you pentest.
3. Define the "qualified person" now: experience, method, independence from the build team.
4. Keep the report, fix tickets and retest evidence together.
5. Re-check the rule status every quarter.

What should the test cover?#

Scope the test around where ePHI lives and moves. For a web app or API, that means:

• Authentication, sessions and account recovery.
• Authorization between users, roles and tenants.
• API endpoints that return patient or member records.
• File upload and export paths.
• Logging and access paths for admin tools.

Use test accounts and synthetic records. Do not put real ePHI into a test environment you do not control. Sign a written authorization first, as covered in penetration testing rules of engagement. If the tester might see real ePHI, ask your privacy counsel whether you need a business associate agreement with the testing firm.

How does this compare with other frameworks?#

HIPAA is the only one of the common frameworks where a pentest requirement is proposed but not in force. The table shows the position as of November 2026.

For the PCI DSS wording, see PCI DSS penetration testing requirements.

What should you not say?#

Avoid these three claims:

• "HIPAA requires an annual pentest." Not today. It is proposed.
• "HIPAA certified pentest." We found no HHS program that certifies pentest reports. Ask for the facts of the test instead.
• "A pentest makes us HIPAA compliant." Compliance covers policy, training, risk analysis, access control, breach response and more.

What does a defensible record look like today?#

Auditors and customers read your records, not the proposal. Under the current rule, a defensible record has five parts:

1. A dated risk analysis that names web and API risks to ePHI.
2. A documented decision on technical evaluation methods, including pentesting and vulnerability scanning.
3. A pentest report with scope, method, findings and tester details.
4. Fix tickets and a retest result.
5. A review of the results by the person who owns security.

If a final rule arrives, update the interval and the "qualified person" definition. The records stay useful.

What should you watch?#

Watch these three sources:

• The Federal Register entry for RIN 0945-AA22, for any new proposed or final rule document.
• The Reginfo.gov agenda entry for the same RIN, for the stage and date.
• HHS Office for Civil Rights guidance pages, for enforcement notes.

A move out of "Long-Term Actions" is the signal to start a plan. A published final rule document starts a compliance clock that its own text defines.

Questions to take to counsel or your compliance lead#

• Does our risk analysis name pentesting as an evaluation method?
• Do our customers' contracts set a pentest interval?
• Is the tester a business associate in our setup?
• How do we keep ePHI out of the test?
• Who owns the decision if the rule is finalized with a short compliance window?

For a sister topic, see does SOC 2 require penetration testing.