Your Patient Portal Just Failed Its Security Rule Audit

The Security Rule requires a risk analysis under §164.308(a)(1) and a technical evaluation under §164.308(a)(8). The phrase "penetration test" never appears in the regulation, but OCR guidance and NIST SP 800-66 make clear that simulated attacks against technical safeguards are the expected way to demonstrate compliance. Most auditors expect it, and the ones who don't will still want proof you've done something equivalent.

Yes -- any engagement where we might encounter ePHI requires a BAA, and we execute one before testing begins. Our methodology is designed to minimize ePHI exposure. Wherever feasible, we validate that access is possible without actually exfiltrating real patient data.

A vulnerability scan runs automated tools to find known weaknesses. A penetration test goes further. We manually exploit vulnerabilities, chain them together, and show you real-world impact. Scanners miss logic flaws, broken access controls, and authentication bypasses -- which happen to be exactly the issues that matter most for ePHI protection under §164.312.

At minimum, test annually and after any significant change to your ePHI environment -- a new patient portal, cloud migration, major code release, or infrastructure overhaul. Had a breach or a close call? Test immediately. OCR expects your risk analysis to be ongoing, not something you did once in 2019.

We design rules of engagement specifically to prevent disruption. Denial-of-service testing stays out of scope unless you explicitly request it against a staging environment. High-risk tests get scheduled during maintenance windows, and we stay in constant contact with your team throughout. In 12+ years, we've never caused unplanned downtime.

You get an executive summary, a full technical report with every finding mapped to §164.312 provisions, CVSS scores, proof-of-concept screenshots, step-by-step reproduction instructions, and prioritized remediation guidance. Once you've remediated, we retest and issue an updated attestation letter you can actually hand to an OCR investigator.