Penetration testing aligned to the HIPAA Security Rule (164.312), with PHI exfiltration testing built in. BAA signed before any engagement that touches protected health information.
The HIPAA Security Rule requires a risk analysis and evaluation of technical safeguards protecting electronic PHI. Penetration testing is the practical way to evaluate those safeguards — and the 2026 NPRM proposes making it explicit.
Technical safeguards: access control, audit controls, integrity, and transmission security for electronic PHI. Penetration testing evaluates whether they actually hold.
Annually as part of the required evaluation — and the proposed 2026 rule update moves toward making periodic penetration testing mandatory.
Covered entities, business associates, and healthtech handling PHI — especially those answering customer security questionnaires.
5–10 days · from $15,000 · retests for HIGH and CRITICAL findings included.
We sign a Business Associate Agreement before any engagement that touches PHI. Scoping is built around protecting protected health information.
We test the paths that actually expose PHI — broken authorization, debug endpoints, and data exposure — not just a generic vuln sweep.
Every finding ties back to the specific Security Rule safeguard it affects, so your assessment maps cleanly to the report.
Final scope depends on the number of in-scope applications, the roles and data flows involving PHI, and your infrastructure footprint. We set final scope and price on a 30-minute call — no obligation.
Yes. For any engagement that touches PHI, we sign a Business Associate Agreement before testing begins.
The Security Rule requires evaluation of your technical safeguards; penetration testing is the standard way to satisfy that. The proposed 2026 rule update moves toward making periodic pentesting explicit.
Under a signed BAA, with scope and data-handling agreed up front. Sensitive data is described in the report, never reproduced. Hoot can run inside your network so PHI never leaves your infrastructure.
The number of in-scope applications, the roles and data flows involving PHI, and your infrastructure footprint. Engagements start at $15,000.
Book a 30-minute scoping call. We'll confirm scope, timeline, and price — and how the report maps to your HIPAA requirements.
Book a scoping call