Penetration Testing Services for Healthcare: Strengthen Security and Protect Patient Data
Penetration testing for healthcare is authorised testing of the systems that hold or reach patient data, such as networks, patient portals, APIs, wireless networks and connected devices, to find weaknesses before attackers do. It does not remove the risk of a breach, and in a clinical setting it has to be planned so that care is never put at risk. This guide explains what to test, how to test safely, which Australian and US rules are relevant, and how to choose a provider.
Hospitals, clinics, aged care providers, pathology labs and health software companies all hold information that is personal, sensitive and hard to replace. A penetration test is a simulated, agreed attack carried out by a qualified tester. It shows which weaknesses could be used in practice, so they can be fixed in order of importance.
This page is general guidance. It is not legal advice, and it does not tell you how any particular rule applies to your organisation. Always check the current text of any law or regulation you rely on.
Why Healthcare Is a Target
Health records combine identity details, medical history and contact information. The Office of the Australian Information Commissioner (OAIC) reported 595 data breach notifications between 1 July and 31 December 2024. Health service providers made 121 of them (20%), the highest of any sector, and malicious or criminal attacks caused 404 (69%).
Sensitive data
Australian privacy guidance lists health information as a type of sensitive information, and says mishandling it can lead to discrimination, humiliation or loss of dignity.
Many connected systems
Records systems, patient portals, booking tools, imaging, laboratory systems and connected devices all need to work together, which gives attackers more places to look.
Care cannot stop
Systems often need to stay available around the clock, so some fixes and updates must be scheduled carefully.
Third parties
Suppliers, billing services and device makers can all hold or reach patient data, so their access needs testing and review too.
A test does not make an organisation immune. It reduces the chance that a known weakness is left open, and it gives you evidence to prioritise fixes.
What to Test in a Healthcare Environment
Scope should follow where patient data lives and how it moves. Established references include the NIST SP 800-115 technical guide to security testing and the OWASP Web Security Testing Guide for web applications. Ask a provider which one it follows and why.
Network and infrastructure
Internal and external networks, servers, remote access and segmentation, including whether a compromised office device can reach clinical systems.
Patient portals and web applications
Login, session handling, access control and the handling of records, so one patient cannot see another’s data.
APIs and integrations
The interfaces that connect records systems, apps and partners, where access control mistakes are common.
Mobile apps
Apps used by patients or clinicians, including what they store on the device and how they talk to the server.
Wireless networks
Staff, guest and device networks, and whether guest access is kept apart from internal systems.
Medical and IoT devices
Connected devices, tested only with the manufacturer’s involvement and a safe method agreed beforehand.
Cloud services
Configuration of storage, identity and access in the cloud platforms that hold health data.
People and process
Phishing simulations and awareness checks, run with management approval and clear rules for how results are used.
Agree in writing what is in scope, what is out of scope and who can stop the test. Testing should be a vulnerability assessment first, followed by manual testing to confirm which findings can really be used.
Testing Safely in Clinical Settings
Testing can disrupt systems. NIST SP 800-115 warns that testing can damage systems and that crafted network traffic can cause denial of service. In a hospital or clinic, that is a patient safety issue as well as an IT issue. The US Food and Drug Administration says on its medical device cybersecurity page that unpatched or unmitigated vulnerabilities in medical devices may potentially lead to patient harm.
Test only systems you own or have written permission to test. For hosted systems, devices owned by a manufacturer, or shared infrastructure, get the owner’s agreement before any work starts.
On devices, the Australian Therapeutic Goods Administration (TGA) guidance for industry recommends penetration testing scaled to the device’s risk, by a qualified party independent of the development team. It also recommends a twin test system where production systems cannot be tested. It places the assessment and management of device cyber security risk with manufacturers, and says healthcare providers may ask manufacturers about cyber security during procurement.
| Safeguard | What to agree before testing |
|---|---|
| Testing windows | Dates and times that avoid peak clinical activity, with a named contact available throughout. |
| Test environments | Whether a copy or twin of the system can be tested instead of the live one, especially for devices. |
| Stop rules | Who can pause testing, and what signs of trouble trigger a pause. |
| Data handling | How any patient data seen during testing is protected, and what is kept in the report. |
| Rollback plans | Backups and recovery steps in case a system fails during the test. |
A provider that cannot explain how it will keep testing safe for clinical systems is not ready for your environment.
Rules and Frameworks
Rules differ by country, and none of the sources below sets a single mandatory test schedule for every provider. Use this as a starting point and check the current text with your legal adviser.
Australia
| Requirement | What the source says |
|---|---|
| Privacy Act, APP 11 | Entities must take reasonable steps to protect information from misuse, interference and loss. The OAIC guide to securing personal information says that, depending on the situation, you may wish to consider penetration or vulnerability testing, and that testing should happen during development and regularly once systems are operational. |
| Notifiable Data Breaches scheme | An organisation that must comply with Australian privacy law has 30 days, generally, to assess whether a breach is likely to result in serious harm, and must notify affected people and the regulator where it is. See the OAIC explanation. |
| My Health Record | Under Rule 42 of the My Health Records Rule 2016, providers must have a written security and access policy that they communicate and enforce, as explained by the Australian Digital Health Agency. |
| Medical devices | The TGA says devices must meet the Essential Principles, and software-based devices must protect against unauthorised access and known vulnerabilities. See the TGA guidance. |
United States
| Requirement | What the source says |
|---|---|
| HIPAA Security Rule | Protects electronic protected health information and applies to covered entities and their business associates. It requires an accurate and thorough assessment of risks and vulnerabilities, and a periodic technical and non-technical evaluation. The HHS summary does not mention penetration testing. |
| Proposed update | On 27 December 2024 the HHS Office for Civil Rights issued a proposed rule that would require penetration testing at least every 12 months and vulnerability scanning at least every six months. HHS says it is proposed, not final, and the current Security Rule remains in effect. Check the HHS page for its current status. |
In both countries, a penetration test is one input to a wider risk assessment. It does not replace policies, staff training, patient consent processes or incident response planning. It also does not by itself make an organisation compliant with any law.
Choosing a Provider and Fixing Findings
Qualified testers
Ask who will do the work, what experience they have with clinical systems, and which accreditations or certifications they hold. Ask for proof of any you rely on.
A written scope
The scope, exclusions, test windows and stop rules should be in a signed document before work starts.
Manual testing
Ask how much is manual and how much relies on scanning tools, and whether findings are checked before they reach you.
Device experience
If devices are in scope, ask how the provider will work with the manufacturer and what method it will use safely.
A useful report
Look for plain-language findings, severity ratings with reasons, evidence, and clear steps to fix each issue.
Retest terms
Confirm in writing whether a retest is included and how long the retest window stays open.
Remediation and retest
The report is the start of the work, not the end. A practical order is:
| Step | What it involves |
|---|---|
| 1. Triage | Review each finding with the people who run the system. Severity scores such as CVSS describe severity, not the risk to your organisation, so consider patient impact and how exposed the system is. |
| 2. Assign | Give each fix an owner and a date. Fixes to clinical systems may need change approval and a quiet window. |
| 3. Mitigate | Where a fix cannot be applied quickly, such as on a device awaiting a manufacturer patch, record other controls like network isolation. |
| 4. Retest | Ask the tester to confirm that fixes work and have not created new issues. |
| 5. Record | Keep the report, fix evidence and decisions. They support risk assessments and any review by a regulator. |
How often to test depends on how much your systems change and on the rules that apply to you. The OAIC guide says testing should be regular, and the HIPAA Security Rule calls for periodic evaluation and a new one after major changes. Neither names a fixed interval, and the US proposal to require annual penetration testing is not final. Retest after major changes, such as new systems or significant upgrades.
Content Reviewed By
Ketki Tidke
Cyber Security and GRC Lead Auditor
ISO 27001 Lead Auditor
Ketki is a certified ISO 27001 Lead Auditor specialised in Governance, Risk and Compliance, with experience consulting public, private, and government clients. She evaluates threats, risk impacts, and regulatory requirements across multiple industry frameworks.
Healthcare Penetration Testing: Frequently Asked Questions
What is penetration testing in healthcare?
It is authorised, simulated attack testing of the systems that hold or reach patient data, such as networks, portals, APIs, wireless networks and connected devices. A qualified tester tries to find weaknesses that could be used in practice, and reports them with advice on how to fix them.
Does penetration testing prevent a data breach?
No. It reduces the chance that a known weakness is left open, but it cannot guarantee a breach will not happen. It works best alongside patching, access control, staff training, monitoring and an incident response plan.
How is it different from a vulnerability scan?
A scan uses tools to list possible weaknesses. A penetration test adds manual work to check which weaknesses can be used in practice and what an attacker could reach as a result.
Is penetration testing required by HIPAA?
The HHS summary of the HIPAA Security Rule requires a risk analysis and a periodic evaluation, but does not mention penetration testing. In December 2024 HHS proposed a rule that would require it at least every 12 months, and HHS describes that proposal as not final. Check the HHS page for current status.
Is it required in Australia?
The OAIC guide to securing personal information says that, depending on the situation, you may wish to consider penetration or vulnerability testing, and that testing should be regular once systems are operational. It describes this as one option for taking reasonable steps under APP 11, not as a fixed requirement.
How often should a healthcare organisation test?
The sources we reviewed give no single interval that applies to everyone. Test regularly, and after major changes such as new systems or significant upgrades. If you are subject to rules that set a schedule, follow those.
Can medical devices be tested?
Yes, but with care. The TGA recommends penetration testing scaled to device risk by a party independent of the manufacturer’s development team, and a twin test system where production systems cannot be tested. Involve the device manufacturer and agree a safe method first.
Will testing disrupt patient care?
It can if it is not planned. Agree testing windows, stop rules, test environments and rollback plans in writing, and keep a named contact available throughout. A provider should be able to explain how it keeps clinical systems safe.
Should we test in-house or use an outside provider?
An outside provider brings independence and fresh eyes, and some rules and contracts ask for it. Internal teams are well placed to run regular scans and to fix findings. Many organisations use both.
What should the report include?
Plain-language findings, severity ratings with reasons, evidence, the systems affected, and clear steps to fix each issue. Ask whether it also includes a summary for non-technical readers and whether a retest is part of the engagement.
How do we get started?
List the systems that hold or reach patient data, decide what is in and out of scope, choose safe testing windows, and ask providers for a written scope and quote. CyberSapiens can help you plan this.
Need Penetration Testing for a Healthcare Environment?
Talk to CyberSapiens about your systems, scope and goals. We will help you decide what to test first and how to plan it around clinical operations.
Email us
[email protected]Our head office
Lvl 1 206 Lorimer St, Port Melbourne, 3207
