Cybersecurity for healthcare, tested from the patient portal to the EHR

Common threats in healthcare include ransomware reaching clinical networks, phishing of staff, patient portal account takeover, abuse of EHR and FHIR APIs, vulnerable connected medical devices, third-party and vendor access, legacy systems that cannot be patched quickly, and insecure health apps. Each reaches ePHI or clinical operations by a different route, and each needs a different test.

Not by name. The current HIPAA Security Rule requires a risk analysis (45 CFR 164.308(a)(1)(ii)(A)) and a periodic technical and nontechnical evaluation (164.308(a)(8)), and a penetration test is direct evidence for both. A proposed rule published in January 2025 would add penetration testing at least every 12 months; it has not been finalized. See HIPAA penetration testing.

Health Industry Cybersecurity Practices (HICP) is voluntary guidance from the HHS 405(d) program and the Health Sector Coordinating Council. It describes the most relevant threats to the sector and ten cybersecurity practices, including network management, vulnerability management and network connected medical devices, with separate technical volumes for small and for medium and large organizations.

Under the 2021 HITECH amendment (Public Law 116-321), HHS must consider whether a covered entity or business associate had recognized security practices, such as those developed under section 405(d) or by NIST, in place for at least the previous 12 months when deciding on fines, audits and remedies. Testing evidence helps show those practices are in place and working.

We call each API as every type of user, patient, clinician, administrator and integration partner, changing resource IDs, tokens and scopes to check that each caller reaches only the records they are entitled to. Findings are mapped to the OWASP API Security Top 10 (2023), where broken object level authorization is API1. See API security.

Yes. Device testing is done on test units or in lab environments agreed in the rules of engagement, and clinical network testing is planned with your teams to avoid interrupting care. Device manufacturers preparing a submission should see FDA 510(k) medical device testing.

A web application penetration test typically takes 1–2 weeks and a red team exercise typically 4–6 weeks, depending on scope. You receive a written scope and timeline before testing starts.