Does HIPAA require penetration testing?

The HIPAA Security Rule requires a risk analysis and regular technical evaluation of safeguards, but it does not name penetration testing outright. Most covered entities and business associates use a penetration test as the evidence that their technical safeguards work.

Is a hospital network pen test the same as a medical device pen test?

No. A hospital test looks at the organization's networks, applications, and cloud services. A medical device test looks at one product, including its hardware, firmware, wireless interfaces, companion apps, and cloud backend, and produces a report the FDA can review in a premarket submission.

How often should a healthcare organization run a penetration test?

At least once a year, and again after major changes such as a new EHR integration, a network redesign, or a new patient-facing app. Your risk analysis should set the actual schedule.

What do medical device makers need for the FDA?

Under Section 524B and the FDA's February 3, 2026 premarket cybersecurity guidance, cyber device submissions need security testing evidence, including penetration testing, tied to the threat model and security risk assessment.

Do you also do V&V or general software testing?

No. Blue Goat Cyber performs penetration and security testing only.

Healthcare penetration testing

Penetration testing built for healthcare.

Two kinds of healthcare teams need pen testing, and they need different scopes. Find yours below.

For hospitals, health systems, and business associates

Your risk is ransomware and patient data exposure. Testing looks at the paths an attacker would use to reach ePHI: internet-facing systems, the internal network, cloud tenants, patient portals, and APIs. The report maps findings to HIPAA safeguards so it supports your risk analysis.

HIPAA penetration testing
Testing scoped to HIPAA Security Rule safeguards, with ePHI data-flow mapping.
Medical device penetration testing
Device, cloud, mobile, and network testing traced to your threat model.
PHI cloud backend testing
Cloud services that store or move patient data.
Web application testing
Patient portals, front ends, back ends, and APIs.

For medical device makers

Your risk is a device that can be attacked in the field, plus an FDA submission that needs security testing evidence. Testing covers hardware and debug ports, firmware, Bluetooth and radio interfaces, companion apps and the cloud backend. Findings tie back to your threat model, and you get a signed Letter of Attestation covering tester independence, scope, methods, and results.

Medical device penetration testing
Device, firmware, app, and cloud testing with FDA-ready reports.
BLE and RF testing
Bluetooth, Wi-Fi, Zigbee, NFC, and proprietary radio.
Firmware testing
Extraction, reverse engineering, and exploitation.
Full-service FDA premarket
Pen testing plus threat modeling, SBOM, and eSTAR documentation.

How the two scopes differ

	Healthcare organization	Medical device maker
Target	Networks, cloud, apps	One device and its ecosystem
Main rule	HIPAA Security Rule	FD&C Act Section 524B
Report reader	Security team, auditors	Engineering team, FDA reviewers
Typical timing	Yearly and after major changes	Before submission, and after security-relevant changes

For a deeper look at device testing, read the medical device penetration testing guide.

How a healthcare penetration test runs

Scoping call. We agree on what is in bounds: which networks, cloud accounts, applications or device builds, and what is off limits, such as live clinical systems during patient hours.
Rules of engagement. Testing windows, contacts, and a stop procedure are written down before anyone touches a system, so a test never gets in the way of patient care.
Testing. Our engineers work through the scope by hand, backed by tools, and flag any critical finding to you right away instead of waiting for the report.
Report and readout. Every finding comes with its evidence, a severity rating, and a clear fix. Device makers also receive a signed Letter of Attestation for the FDA.
Retest. After you fix the findings, we retest them and update the report.

Request a healthcare penetration test

Tell us what you need tested. A senior engineer replies within one business day to set up a scoping call.

Talk to a medical device cyber expert

Tell us about your device. We'll reply within one business day with a clear next step.

FAQ

Ready when you are

Get FDA cleared without the cybersecurity headaches.

30-minute strategy session. No cost, no commitment - just answers from people who've shipped 275+ devices supported.

Book strategy session Explore services