To Protect Your Medical Records, Hospitals Are Paying People to Break In

Somewhere on a hospital network tonight, someone is trying to steal patient records. In a growing number of cases, the hospital hired them to do it.

The practice is called penetration testing. In plain terms, it is an authorized, simulated cyberattack on the systems that hold patient data: skilled specialists try to break in the way a criminal would, then hand over a map of every weakness they find so it can be fixed before anyone else does. In American healthcare it has moved from a niche technical chore to a central defense for some of the most sensitive information a person owns.

It is a strange arrangement, and an increasingly common one. Medical records are prized by criminals precisely because they cannot be reset. A stolen bank card can be canceled in minutes; a diagnosis, a prescription history, or a genetic result cannot be canceled and reissued. The cost of getting security wrong, measured in dollars and in exposed lives, has pushed hospitals, device makers, and health technology startups toward a counterintuitive conclusion: the surest way to learn whether your defenses hold is to attack them yourself.

A crime that pays

For criminals, healthcare is a rich and reliable target. The IBM Cost of a Data Breach Report 2026 put the average healthcare breach at 6.64 million dollars. That is down about 10 percent from the year before, and healthcare was the only sector whose costs fell, yet it remains the most expensive industry to breach, a distinction it has held for well over a decade. The report, which studied 602 organizations hit between March 2025 and February 2026, found the global average across all industries at 4.99 million.

Two cautions keep those numbers honest. They are global averages, and in the United States, where this story unfolds, breach costs run far higher and rose again this year. The healthcare figure also rests on a small slice of the organizations studied. Still, the direction is unmistakable, and the stakes stay abstract only until you remember what sits inside the records. The same information readers come to DiseaseFix to understand, whether they are researching a heart condition like pericarditis, cancer, or kidney disease, is exactly what a breach spills into the open. Healthcare is also routinely the slowest sector to detect and contain an intrusion, often taking the better part of a year. Once that data is loose, it stays loose.

The rule that never says “penetration test”

The law at the center of all this is the Health Insurance Portability and Accountability Act, passed in 1996 and known to nearly everyone as HIPAA. Its Security Rule requires any organization handling electronic protected health information, shortened to ePHI, to protect that data’s confidentiality, integrity, and availability. Tucked into the regulation, at 45 CFR 164.308(a)(1)(ii)(A), is a requirement that sounds mundane and turns out to be the crux of the matter: a thorough risk analysis, meaning a documented study of where patient data could be exposed and how badly.

Here is the catch. HIPAA never uses the words penetration test. It describes the destination, not the route. It tells organizations to understand where patient data could be exposed and leaves the method to them. That gap, between what the law demands and how an organization proves it has delivered, is where the testers make their living.

Breaking in, on purpose

A penetration test is a controlled, authorized rehearsal of a real attack. That is the premise behind hipaa penetration testing, work that narrows the search to the systems that create, store, or move patient data and ties every finding back to the Security Rule so it feeds the risk analysis the law requires. Web applications are measured against the OWASP Top 10, the widely used catalog of the most critical web security flaws maintained by the Open Worldwide Application Security Project. Testers chase down business logic errors and places where records could leak, and, crucially, they return after the fixes to confirm the holes are truly closed.

The work follows a familiar arc: scope the systems that touch ePHI, map the attack surface the way an outsider would, attempt controlled exploitation, separate the real risks from the theoretical ones, and deliver a prioritized report. A test, practitioners are quick to stress, is a snapshot. It captures one moment, in one scope, and the ground keeps shifting as new devices and applications come online.

What the regulators are watching

Washington has made its expectations clear, and the message is that filing the right paperwork is not the same as being secure. The Department of Health and Human Services enforces HIPAA through its Office for Civil Rights, which in 2024 opened a Risk Analysis Initiative aimed squarely at that one requirement. The pattern it keeps finding, across case after case, is the same: organizations that never performed a risk analysis, did not repeat it often enough, or left it incomplete.

The initiative’s first financial penalty put the stakes in plain view. After a 2021 ransomware attack encrypted files holding the records of 14,273 patients, the Bryan County Ambulance Authority in Oklahoma paid 90,000 dollars and agreed to a corrective action plan, with regulators citing a failure to conduct an accurate and thorough risk analysis. More settlements along the same lines have followed.

The office’s risk analysis guidance, first issued in 2010, is pointed but not prescriptive. No single method guarantees compliance, it says, and it steers organizations toward the resources of the National Institute of Standards and Technology. It sets no fixed schedule either, telling organizations to repeat the work whenever their systems or circumstances change. In practice, that has nudged many toward testing at least once a year, and again after any significant change.

Why none of this reaches the patient

For the people whose records are at stake, the entire enterprise is meant to be invisible. A security program that works produces no headlines, no breach notice in the mail, no sleepless night. The silence is the product.

The stakes behind that silence are not abstract. A breach can spill mental health histories, HIV status, and genetic results, the kind of detail that cannot be taken back once it is loose. Readers can browse the full list of diseases and conditions to see just how personal those records can be. And the responsibility, security professionals have long argued, no longer sits with a lone technician in a back office. It runs through clinicians, administrators, and the outside vendors who touch the data, right down to the single reused password that can unlock thousands of files.

Which is why, somewhere on a hospital network tonight, a hired stranger is still probing the locks, hoping to fail in the only way that counts: by finding the open door first.

Questions readers ask

What is HIPAA penetration testing?

HIPAA penetration testing is an authorized, simulated cyberattack on the systems that store or transmit electronic protected health information. Ethical testers try to breach those systems the way a criminal would, then report every weakness so it can be fixed and documented in the risk analysis the HIPAA Security Rule requires.

Does HIPAA require penetration testing?

Not by name. HIPAA requires a documented risk analysis under 45 CFR 164.308(a)(1)(ii)(A), but it does not list penetration testing as a mandatory step. A test is one of the clearest ways to satisfy and strengthen that risk analysis, not a separate legal mandate.

How often should a healthcare organization run a penetration test?

There is no fixed legal frequency. Office for Civil Rights guidance says to repeat the risk analysis whenever systems or circumstances change. Many organizations settle on at least once a year, and again after any major change such as a new application or device.

How much does HIPAA penetration testing cost?

There is no standard price. The cost depends on how many systems, applications, and devices fall in scope, and whether the work covers networks, web applications, or connected medical devices. A single application test and a full health system assessment are very different jobs, so reputable providers price only after scoping the environment.

What is the difference between a penetration test and a vulnerability scan?

A vulnerability scan is automated. It checks systems against a database of known weaknesses and produces a list. A penetration test goes further: a human tester tries to exploit those weaknesses to confirm which are genuinely dangerous and how far a real attacker could get.

Who is qualified to run the test?

Authorized security professionals, whether an internal team or a specialist outside firm. What matters is explicit authorization, healthcare specific scoping of the systems that hold ePHI, and a report that maps each finding back to the HIPAA Security Rule.