HIPAA Security Rule
HIPAA is a law enforced by the HHS Office for Civil Rights.
VulnVerify provides the security testing and evidence your auditor asks for; the SOC 2 report, ISO 27001 certificate or PCI DSS assessment itself is issued by your CPA firm, certification body or assessor.
Who issues it and what you end up with
- Issued by
- Federal regulation enforced by the HHS Office for Civil Rights. No official certification exists.
- Summary
- The Security Rule in force does not use the words “penetration testing” or “vulnerability scanning” and sets no frequency; it requires risk analysis, risk management and periodic evaluation. NIST SP 800-66r2 (the implementation guide) places scanning and penetration testing within those standards “if reasonable and appropriate”. The proposed rule would make both explicit (scanning at least every six months, penetration testing at least every 12 months by a qualified person).
- Version
- 45 CFR Part 164, Subpart C (in force). Proposed update: NPRM published 6 Jan 2025 (90 FR 898) — proposed, not final as of October 2026; federal regulatory agenda targets final action in July 2027.
Where scanning and penetration testing appear
Each control the page maps, with what it asks and whether a scan or a penetration test is required by it, supports it or is not named in it.
| Control | What it asks | Scan | Pentest | Note |
|---|---|---|---|---|
| §164.308(a)(1)(ii)(A)Risk analysis | Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information. | Supports | Supports | |
| §164.308(a)(1)(ii)(B)Risk management | Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level. | Supports | Supports | |
| §164.308(a)(8)Evaluation | Perform a periodic technical and nontechnical evaluation, based initially on the standards implemented under the rule and subsequently in response to environmental or operational changes affecting the security of ePHI. | Supports | Supports | After changes |
| §164.306(e)Maintenance | Review and modify security measures as needed to continue reasonable and appropriate protection of ePHI. | Supports | Supports | Secondary |
| NIST SP 800-66r2 (guidance)Implementing the HIPAA Security Rule | Federal implementation guide (February 2024) that lists vulnerability scanning and penetration testing as activities supporting the risk-analysis and evaluation standards, to be conducted if reasonable and appropriate. | Supports | Supports | Guidance, not a rule |
| Proposed rule (2025 NPRM)Proposed explicit testing requirements | Proposed: vulnerability scanning at least once every six months; penetration testing at least once every 12 months by a qualified person; compliance audit at least every 12 months. | Required | Required | Proposed rule |
Minimum frequencies
The minimums the text sets, or that it sets none, and how weekly scanning compares.
- Scans
- Proposed rule (2025 NPRM): the rule would require scans at least every 6 months; it is proposed, not in force. VulnVerify scans weekly (every 7 days), more often than the proposed minimum.
- Penetration tests
- Proposed rule (2025 NPRM): the rule would require a penetration test at least every 12 months; it is proposed, not in force.
What VulnVerify provides and what you still need
Control by control: the evidence VulnVerify produces, and what still comes from you, your auditor or another provider.
What VulnVerify provides
- §164.308(a)(1)(ii)(A) Scan findings and pentest results as documented inputs to the risk analysis.
- §164.308(a)(1)(ii)(B) Remediation tracking, time-to-remediate, retest verification.
- §164.308(a)(8) Scheduled scans, scan-after-change, periodic penetration test as the technical evaluation.
- §164.306(e) Trend history showing measures reviewed and updated.
- NIST SP 800-66r2 (guidance) Reports aligned to the guide's activities.
- Proposed rule (2025 NPRM) Weekly scans already exceed the proposed six-month minimum; the annual penetration-test reminder covers the proposed 12-month minimum — both offered as preparation for the proposed rule.
What you still need
- §164.308(a)(1)(ii)(A) The risk-analysis document itself, asset inventory, policies.
Questions about HIPAA
Does HIPAA require penetration testing?
The rule in force does not name it or set a frequency; it requires risk analysis, risk management and periodic evaluation. A proposed rule (January 2025) would require scanning every six months and a penetration test every 12 months; it is not final as of October 2026.
Does SOC 2 require a penetration test?
No criterion mandates it. The CC4.1 point of focus names penetration testing as one of the evaluation types, and CC7.1 names vulnerability scans run periodically and after significant changes. Most auditors expect at least an annual test plus testing after major changes.
Can VulnVerify issue my SOC 2 report or ISO certificate?
No. Those come from a licensed CPA firm and an accredited certification body respectively. VulnVerify supplies the technical testing and evidence they review.
Sources
The texts this page reads from.
- 45 CFR §164.306 and §164.308 (HIPAA Security Rule)
- HHS OCR — Notice of Proposed Rulemaking, “HIPAA Security Rule to Strengthen the Cybersecurity of ePHI”, 90 FR 898 (6 Jan 2025)
- NIST SP 800-66 Rev. 2 — Implementing the HIPAA Security Rule (February 2024)
Your first report is free
Verify your domain and the first scan report is free. For a penetration test, contact sales.