HIPAA SECURITY RULE · 45 CFR § 164.308
HIPAA Risk Assessment and Technical Evaluation That Holds Up at Audit
If your audit window is approaching, or a covered entity partner has asked you to document your security posture, the question isn’t whether your organization is generally secure. It’s whether you have documented, structured evidence that meets the HIPAA Security Rule’s specific requirements.
Pentest Testing Corp delivers HIPAA risk assessments and technical evaluations that produce exactly that evidence. Not a generic security report. A documented analysis formatted for OCR review, assessor scrutiny, and legal defensibility.
Engagements start from $5,500. Scope confirmation and fixed-price quote within 24 hours.
What the HIPAA Security Rule Requires from Security Testing
The HIPAA Security Rule doesn’t just encourage security best practices, it mandates specific, documented activities under 45 CFR Part 164.
Under § 164.308(a)(1), covered entities and business associates must conduct a formal risk analysis: identifying threats and vulnerabilities to ePHI, assessing likelihood and impact, and documenting the current controls in place. This must be written, current, and auditable.
Under § 164.308(a)(8), you’re required to perform a periodic technical and nontechnical evaluation, triggered both by the passage of time and by environmental or operational changes (new systems, vendor changes, infrastructure migrations).
These two provisions together mean you need a structured, documented assessment that maps your systems, identifies technical vulnerabilities in PHI environments, and demonstrates you’ve acted on what you found. An annual scan report doesn’t satisfy this. A narrative risk analysis with findings, scores, and a remediation record does.
Why a Vulnerability Scanner Won’t Satisfy the Technical Evaluation Requirement
Automated scanners identify known CVEs. That’s useful, but it’s not what § 164.308(a)(8) is asking for, and it’s not what an OCR auditor or HIPAA assessor will accept as a technical evaluation.
Here’s what a scanner cannot do:
It produces no risk narrative. A list of vulnerabilities with CVSS scores doesn’t map to PHI systems, doesn’t assess likelihood in your specific environment, and doesn’t rate impact in terms of PHI confidentiality, integrity, or availability, the three dimensions HIPAA risk analysis explicitly requires.
It doesn’t cover administrative and physical safeguards. The Security Rule covers all three categories. A technical scan leaves two-thirds of the assessment completely unaddressed.
It generates no remediation evidence. Even if you fixed every finding on the report, there’s no dated log, no control mapping, and nothing an assessor can use to verify corrective action.
It can’t evaluate PHI data flows. Knowing a server has a vulnerability is different from knowing whether that server processes, stores, or transmits ePHI, and how. That context is what gives findings their regulatory weight.
Manual, documented assessment tied to your PHI environment is what the regulation demands. That’s what we deliver.
What Our Engagement Covers
Our HIPAA risk assessment and technical evaluation covers all three safeguard categories under the Security Rule.
On the technical side, our team conducts manual security testing of systems that store, process, or transmit ePHI, web portals, patient-facing applications, internal APIs, EHR integrations, and cloud environments. This includes authentication and access control testing, audit log configuration review, encryption verification across data at rest and in transit, and session management assessment. Our web application, API, and network testing capabilities all feed into this scope.
On the administrative side, we review your risk management program, workforce access policies, BAA inventory, and incident response documentation against Security Rule requirements, flagging gaps with specific remediation guidance.
On the physical side, we assess workstation and device controls relevant to ePHI access, particularly for telehealth providers, clinical environments, and multi-site organizations.
Every finding is rated by likelihood of exploitation and potential impact on PHI, giving you a prioritized risk register that’s directly mapped to regulatory exposure, not just technical severity scores.
Our team including Md. Shofiur Rahman, our CEO and lead assessor, holds certifications in Web Application Penetration Testing, API Security for PCI Compliance, Communication and Network Security, and ISO/IEC 27001, directly applicable to HIPAA’s technical safeguard requirements. We’ve completed security engagements for over 257 organizations across 30+ countries.
Your HIPAA Audit Evidence Package
When the engagement closes, you receive a complete documentation package ready for assessor submission, OCR review, or legal counsel. Here’s what’s included.
DELIVERABLE
HIPAA Risk Analysis Report
A formal written risk analysis satisfying § 164.308(a)(1)(ii)(A), covering asset inventory, threat and vulnerability identification, likelihood and impact scores per PHI dimension, and current control evaluation. Structured as a standalone document, not an appendix to a pentest report.
DELIVERABLE
Technical Evaluation Summary
Documents the scope, methodology, and findings of the technical and nontechnical evaluation per § 164.308(a)(8). Confirms what was tested, how, and when.
DELIVERABLE
PHI Data Flow Diagram
Maps ePHI movement across your systems, vendors, and transmission pathways. Used as scope evidence and assessor reference. Identifies where ePHI enters, moves, and exits your environment.
DELIVERABLE
Vulnerability Findings with HIPAA Safeguard Mapping
Each technical finding is cross-referenced to the specific Security Rule safeguard it impacts, administrative, physical, or technical. Not just CVE IDs. Regulatory context for every issue.
DELIVERABLE
Prioritized Remediation Roadmap
Ordered by PHI exposure risk, with implementation guidance for each finding. Paired with our remediation support services if you need hands-on fix assistance.
DELIVERABLE
BAA Gap Log
Identifies all vendors and business associates with PHI access, flags missing or inadequate agreements, and outlines corrective steps.
DELIVERABLE
Executive Summary
Written for presentation to leadership, legal counsel, or a third-party assessor. Non-technical framing of risk posture, key findings, and remediation status.
See a real deliverable before you commit: Download Sample Report.
What OCR and Third-Party Assessors Actually Examine
Whether you’re facing an OCR desk audit, a breach investigation, or a security review from a covered entity partner, here’s what they’ll ask for.
A complete, written risk analysis. Not a scan output, a narrative document covering threats, vulnerabilities, likelihood, impact, and current controls. This is the single most commonly cited gap in OCR audit findings.
Evidence of corrective action. A remediation log with dates, assigned ownership, and outcome. Finding vulnerabilities isn’t enough. You need to show you addressed them.
Access control documentation. Who has access to ePHI, under what authorization, and how that access is reviewed and revoked.
Audit log configuration. Demonstrable evidence that PHI access is being tracked and that logs are protected and retained.
Transmission security. Verification that ePHI is encrypted in transit across all pathways, including third-party integrations and API connections.
BAA coverage. Signed, current agreements with every vendor that touches PHI.
We build the engagement around producing exactly these items. Nothing gets left as an internal working document.
Engagement Timeline
Most HIPAA risk assessment and technical evaluation engagements run three to five weeks, depending on the number of PHI systems in scope, vendor relationships, and existing documentation maturity.
- Week 1: Scoping confirmation, PHI asset inventory, data flow mapping, and documentation intake.
- Weeks 2–3: Manual technical testing of PHI systems and administrative safeguard review.
- Week 4: HIPAA-mapped findings documentation, risk scoring, and remediation roadmap development.
- Week 5 (where needed): BAA gap log, executive summary, final deliverables package.
If your audit date or contract deadline is tighter than this, tell us upfront. We can scope an accelerated engagement for organizations with clean existing infrastructure and partial documentation in place. View our pricing page for scope-based options.
Who This Engagement Is For
Hospitals, outpatient clinics, and multi-site health systems. Telehealth and digital health platforms. Healthcare SaaS companies and EHR vendors. Medical billing and revenue cycle management firms. Business associates and managed IT service providers with PHI in their environment.
If your organization stores, processes, transmits, or accesses ePHI, or if your enterprise customers do, you’re in scope for the Security Rule’s technical evaluation requirement. That applies to cloud platforms, mobile applications, and third-party integrations, not just on-premise clinical systems.
Pricing
| Tier | Starting price | Best for | Key inclusions |
|---|---|---|---|
| HIPAA Gap Check | From $3,500 | No prior risk analysis; pre-engagement scoping or early-stage compliance | PHI system inventory · BAA touchpoint review · Gap log · Prioritized remediation list, no active testing |
| Starter | From $5,500 | 3–6 months from audit; need a documented risk analysis and evidence pack | Risk analysis report · Technical evaluation summary · PHI data flow diagram · Evidence documentation outline |
| Professional | From $9,500 | Active assessment required; OCR audit or covered entity contract within 8–12 weeks | Everything in Starter, plus: manual PHI system testing · policy and procedure updates · safeguards implementation guidance · follow-up validation call |
| Enterprise | From $15,000 | Multi-site health systems; complex vendor environments; ongoing compliance program | Everything in Professional, plus: expanded BAA and vendor review · monthly compliance check-ins · stakeholder audit support · assigned-owner remediation roadmap |
Every engagement includes a fixed-price quote confirmed before work begins. Pricing depends on PHI systems in scope, vendor and BAA count, and existing documentation status.
Frequently Asked Questions
Does HIPAA require penetration testing specifically?
The Security Rule doesn’t use the term “penetration testing,” but § 164.308(a)(8) requires a technical and nontechnical evaluation of your security controls. For organizations with web portals, APIs, EHR integrations, or cloud infrastructure processing ePHI, manual security testing is the only credible way to satisfy that requirement. OCR’s own audit protocol references testing methodology and evidence of corrective action, a scan report alone doesn’t address that.
Can a vulnerability scanner satisfy the HIPAA Security Rule’s technical evaluation requirement?
No. Scanners identify known vulnerabilities but produce no risk narrative, no PHI system mapping, and no likelihood or impact scoring in HIPAA’s required dimensions. They also leave administrative and physical safeguards entirely unaddressed. An OCR auditor requesting documentation of your technical evaluation will need a structured written assessment, not a CSV export from a scanning tool.
What format does a HIPAA risk analysis need to be in?
HHS doesn’t mandate a specific template, but OCR guidance is clear on required elements: scope definition, data collection on threats and vulnerabilities, current control assessment, likelihood and impact determination, risk level assignment, and documentation of the entire process. Our Risk Analysis Report is structured around these elements specifically so it holds up to direct scrutiny.
How long does a HIPAA risk assessment engagement take?
Typically three to five weeks from scoping confirmation to final deliverables. The main variables are how many PHI systems are in scope, the number of vendors and BAA relationships, and how much policy documentation already exists. Organizations with clean infrastructure and partial documentation in place often run closer to three weeks.
We already have policies in place. Do we still need a risk assessment?
Yes. Policies satisfy the administrative safeguard requirements around written procedures, they don’t replace the risk analysis or technical evaluation. Having an acceptable use policy or a sanctions policy doesn’t document what threats exist in your environment, how likely they are, or what you’ve done about them. Both are required. Most organizations that already have policies are missing the technical evaluation piece, which is where we typically focus.
Tell us where you are in your HIPAA cycle
Whether you need a standalone risk assessment, a full documentation package, or urgent audit prep, we’ll scope what’s needed and quote it within 24 hours.