How long does a healthcare penetration test take?

Scoping takes 24 hours. Depending on scope, testing takes from 2 business days for an external network to 5 business days for a web application, API or internal network, and the report follows within 10 business days.

Will a penetration test affect our production systems?

We agree rules of engagement before testing. Where possible we test a staging environment that mirrors production. Production testing is throttled and coordinated with your team, and denial-of-service testing is excluded unless you request it.

What happens if you find a critical vulnerability?

We notify you immediately, not at the end of the engagement. You fix it, we retest for free, and the final report shows the issue as closed.

Is it the same as HIPAA penetration testing?

They overlap. Healthcare penetration testing focuses on your product and industry context. HIPAA penetration testing focuses on the regulation. See our HIPAA penetration testing page.

Can you test FHIR and EHR integrations?

We test the APIs and integrations around your product, including FHIR-based APIs, for authorization and data exposure.

Do you test with real patient data?

No. We test in staging with synthetic data.

Why not rely on an automated scan?

Scanners often cannot pass MFA and cannot judge access control between patients and roles.

How often should health tech companies test?

At least annually and after major releases or new integrations.

Will hospitals accept the report?

Most want a recent independent test and evidence of remediation. Each organization decides what satisfies it.

Healthcare Penetration Testing Services

Q: What is healthcare penetration testing?

A manual security test of healthcare applications and infrastructure that handle PHI.

24 hours

To a fixed-price scope

From $4,000*

Web app and API pentest

BAA signed

Before testing starts

Free retest

Included in every engagement

*Final pricing is determined after scoping.

Why health tech companies need a penetration test

What is healthcare penetration testing? Healthcare penetration testing is a manual security test of healthcare applications, patient and clinician portals, APIs, mobile apps and cloud workloads that handle protected health information (PHI). It finds the flaws that expose patient records and produces evidence for HIPAA risk analysis and hospital partner reviews.

Hospital networks and payers require security evidence before they onboard a vendor. Patient portals hold appointments, messages, lab results and insurance details, and older modules often carry older flaws.

Hospitals ask for proof

Partner security teams want a recent independent test and written evidence of remediation.

Portals hold sensitive data

Appointments, messages, lab results and insurance details sit behind one login.

Legacy modules carry old flaws

Platforms built across several launches keep flaws in rarely touched modules.

Who asks

What they check

What you provide

Hospital security teams

Manual testing of patient-facing functions and access controls

Executive summary and retest letter

HIPAA risk analysis

Evidence of where ePHI is exposed

Risk-ranked report. See HIPAA penetration testing

Payers and enterprise customers

Independent proof of security and remediation

Customer-safe summary

Auditors

Independent testing evidence

Full report and retest evidence. See SOC 2 penetration testing

What hospital security teams expect from a healthcare pentest

Manual testing of patient-facing functions. Not only an automated scan.
Proof of access control. Evidence that one patient cannot see another patient's records.
Real roles. Patient, nurse, physician and administrator accounts.
Written evidence of remediation. Findings fixed and retested.
A signed BAA. In place before testing begins.
Safe data handling. Staging with synthetic patient data.

Requirements vary by hospital partner. Confirm yours before scoping, and we will align the test to them.

Healthcare pentest services

We scope to the products and systems that handle PHI, so the test supports your partner reviews and your budget is not spent outside them.

Patient portal and clinician dashboard

Registration, login, MFA, messaging, lab results, billing and patient search across all roles.

API and integrations

Patient, partner and integration APIs, including FHIR-based APIs. See our API penetration testing.

Mobile applications

Telehealth and patient apps, local storage and the APIs behind them.

Cloud environment

PHI workloads in AWS, Azure or GCP. See cloud penetration testing.

Internal and external network

Perimeter and internal paths to systems that hold PHI.

HIPAA alignment

Risk-ranked findings for your risk analysis. See HIPAA penetration testing.

Also building AI features or complying with frameworks? See AI penetration testing, SOC 2 and SaaS penetration testing penetration testing.

How much does healthcare penetration testing cost? A healthcare web application and API pentest starts from $4,000* at Redfox. External network testing starts from $1,600*, internal network testing from $4,000* and cloud testing from $2,400*.

Healthcare pentest methodology

Manual testing by senior consultants, aligned to OWASP WSTG, OWASP API Security Top 10, PTES and NIST SP 800-115. Not automated scanning.

01 / BAA and scope in 24 hours

We sign the BAA, confirm synthetic data, set up roles and test accounts and agree rules of engagement. You receive a fixed-price quote.

02 / Mapping

We crawl the application, fingerprint technology and map authentication, session flows and integrations.

03 / Access control, injection and logic testing

We test login, MFA, password reset, session handling, horizontal and vertical access, injection, scripting and business logic. Critical findings are reported to you immediately.

04 / Reporting and readout call

You receive a report with risk ratings and reproduction steps and a walkthrough with the engineers who tested.

05 / Free retest

After you fix findings, we retest and issue evidence for your hospital partners.

What a healthcare pentest typically finds

These are the issues we most often find in patient portals and health technology platforms, and the ones that matter most to hospital security teams.

SQL injection in legacy modules

Search functions that build queries from user input and expose patient records.

Insecure direct object references

Lab results and documents readable by changing an ID.

Stored cross-site scripting

Messaging content that runs script in a clinician's browser.

MFA bypass

Password reset flows that skip multi-factor authentication.

Sessions that do not expire

Tokens that stay valid after logout or a password change.

Missing hardening

Missing security headers and outdated JavaScript libraries.

How to prepare for a healthcare penetration test

When should we schedule it? Book the test at least 6 weeks before a hospital partner deadline. A test, a fix window and a retest together need about six weeks of runway.

01 / Sign the BAA

We sign a Business Associate Agreement before testing begins.

02 / Prepare a staging environment

Use staging with synthetic patient data only.

03 / Create test accounts

One for each role, with MFA seeded.

04 / Share documentation

API specs, integration lists and a contact for critical findings. Keep legacy modules in scope.

05 / Reserve time to fix and retest

Plan engineering time so the free retest lands before your deadline.

The healthcare pentest report

Reports designed to support your hospital and partner evidence. We test security. Your partners and compliance team decide what satisfies their requirements. Reports are delivered as PDF, ready to upload as evidence to your compliance platform.

Document

What it contains

Who uses it

Executive summary

Plain-language scope, results and remediation status, without sensitive technical detail

Hospital partners, leadership

Full technical report

Risk ratings, evidence, reproduction steps and fix guidance for every finding

Engineering and compliance teams

Methodology and appendices

Scope, approach and evidence, with strict QA on every report

Security reviewers

Retest report

Verified fixes and a clean closing report

Hospital partners and auditors

Case study: patient portal pentest before a hospital partnership

Illustrative scenario. This example shows the kind of result this engagement delivers. It is not a named client.

The situation

A US digital health provider (Series C, 320 employees) with a patient portal serving more than 400,000 patients was onboarding its first hospital network partner.

What we tested

The patient portal and clinician dashboard in staging with synthetic patient data, across patient, nurse, physician and administrator roles. 7 days of testing.

What we found

1 critical, 3 high and 5 medium findings. A critical SQL injection in the patient search, an insecure direct object reference on lab results and stored cross-site scripting in messaging.

The result

The critical flaw was patched in 48 hours. The retest confirmed all critical and high findings closed, and the hospital integration stayed on schedule.

Download the full case study (PDF)

See the scope, approach, findings and retest results. Enter your details to get the PDF.

Download case study (PDF)

Oops! Something went wrong while submitting the form.

Why health tech companies choose Redfox

Black Hat USA 2026 trainers

Official training provider for Advanced Adversary Tactics and Evasion at Mandalay Bay, Las Vegas. The tradecraft we teach is what we use on your systems.

16+ years in offensive security

Manual, exploit-driven testing, not scanner output.

5,000+ engagements

Delivered for 2,000+ clients worldwide, including SaaS, fintech and healthcare technology companies.

Free retest in every engagement

We verify your fixes and issue a clean report you can share with customers, partners and auditors.

Their detailed findings and remediation guidance help our clients address security gaps and prepare supporting evidence for their compliance processes.

ClearPath Compliance

Last updated October 2026.

Healthcare penetration testing FAQ

Get your healthcare pentest quote

A senior consultant replies within one business day with a fixed-price quote. Not sure what is in scope? Ask for a free 30-minute scope review.

Thank you! Your submission has been received!