Not by name. The current HIPAA Security Rule never says "vulnerability scan" or "penetration test." It does require an accurate and thorough assessment of the risks and vulnerabilities to your ePHI, and a scan is the most practical proof of the technical half of that. A 2025 proposal would make scans every six months mandatory. It is not final.
Research current as of October 28, 2026. This is education, not legal advice. Chuck is not an attorney and One Guy Consulting is not a law firm; take your own facts to a healthcare attorney before relying on any conclusion here.
So the honest answer is "not yet, but you already need what a scan gives you." This article covers what the rule says today, what the proposed rule would add, what a scan actually checks, and what to keep on file when someone asks.
What a Vulnerability Scan Is, in Plain English
A vulnerability scan is an automated check of your computers and network against public lists of known security flaws. It looks for:
- Software that is missing updates
- Programs old enough that the maker no longer fixes them
- Network doors (ports) that are open and should not be
- Weak settings, such as old encryption or default passwords
A scan does not break in. It does not fix anything. It produces a list, ranked by severity, of what is wrong and where. What you do with that list is the part that matters.
Scan, Penetration Test and Risk Analysis Are Different Jobs
These three get mixed up constantly, including by vendors.
| Vulnerability scan | Penetration test | Security risk analysis | |
|---|---|---|---|
| What it is | Automated check for known flaws | A person tries to break in, with permission | A review of every risk to ePHI: people, process, technology, facilities |
| What you get | A ranked list of technical weaknesses | Proof of which weaknesses can actually be used | A risk register and a plan |
| Who does it | Software, set up by someone who knows it | A qualified tester | The practice, usually with help |
| Required today | Not by name | Not by name | Yes, 45 CFR 164.308(a)(1)(ii)(A) |
| Proposed rule | At least every 6 months | At least every 12 months | Kept, with more detail |
A scan feeds the risk analysis. It does not replace it. A practice with a clean scan and no risk analysis is still out of compliance.
What the Current HIPAA Security Rule Says
Three requirements do the work today.
Risk analysis, 45 CFR 164.308(a)(1)(ii)(A): "Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate."
Note the word "vulnerabilities." You cannot assess the vulnerabilities on a computer you have never checked.
Risk management, 45 CFR 164.308(a)(1)(ii)(B): "Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level." Finding the flaws is half of it. Fixing them, or recording why you accepted the risk, is the other half.
Documentation, 45 CFR 164.316(b)(2)(i): "Retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later."
The rule leaves the method to you. That flexibility is real, but it cuts both ways: when OCR asks how you assessed your technical vulnerabilities, "we did not check" is not a method.
What the 2025 Proposed Rule Would Add
On January 6, 2025, HHS published a proposed overhaul of the Security Rule (90 FR 898). It would add a new standard, "Vulnerability management," at 45 CFR 164.312(h). The parts that matter here:
- Vulnerability scanning: automated scans "at least every six months," or more often if your risk analysis calls for it.
- Scanner check: review and test the scanning tool itself at least once every 12 months, or after a big change.
- Monitoring: watch authoritative sources for known vulnerabilities on an ongoing basis and fix them through your patch management program.
- Penetration testing: "at least once every 12 months," or more often per your risk analysis, performed "by a qualified person."
Status: proposed, not final. The comment period closed March 7, 2025. HHS's target for a final rule has moved from May 2026 to July 2027, and OCR is not enforcing any of this today. We cover the delay in HHS delays its decision on the final Security Rule.
If it becomes final as written, the guessing ends. Six months for scans, twelve for a pen test, in writing.
What Gets Scanned in a Small Practice
The proposed rule says "relevant electronic information systems." In a small practice that usually means:
- Front desk and exam room computers, and any laptop that leaves the office
- The server or shared storage, if you have one
- The router, firewall and Wi-Fi
- Anything facing the internet: your website, patient portal, remote access
- Printers, scanners and fax machines on the network
What is usually not yours to scan: your EHR vendor's servers, Microsoft 365 or Google Workspace data centers, and other cloud systems. Never scan a vendor's systems without written permission. Check your own settings and connections, and ask the vendor for its security evidence. That conversation belongs in your vendor management records.
Start with an inventory. You cannot scan what you do not know you have.
How to Read a Scan Report
Most reports rate each finding with a CVSS score from 0 to 10, published by NIST's National Vulnerability Database:
- Critical: 9.0 to 10.0
- High: 7.0 to 8.9
- Medium: 4.0 to 6.9
- Low: 0.1 to 3.9
Three rules for the first read:
- Fix what attackers are already using first. CISA keeps a Known Exploited Vulnerabilities catalog. A "High" on that list outranks a "Critical" that nobody is using.
- Expect some false alarms. A scanner can flag a program by version number when the fix is already in place. Confirm before you spend money.
- Write down what you decide. Fixed, scheduled, or accepted with a reason. That record is your risk management evidence under 164.308(a)(1)(ii)(B). A remediation plan with an owner and a date is the format auditors expect.
How Often to Scan
- Today: as often as your risk analysis says. The rule sets no number.
- Under the proposed rule: at least every six months.
- Always: after a big change. A new server, a new office, a new EHR, a new remote access setup.
A practice that scans once a year and fixes what it finds is in better shape than one that scans monthly and files the reports unread.
What to Keep on File for an Audit
When OCR or an auditor asks, the paper trail is the answer. Keep:
- Each scan report, with its date and what was in scope
- The list of findings and what you did about each one, with dates
- Who ran the scan, and the tool used
- Any pen test report and its follow-up
- Your risk analysis, updated with what the scans found
Keep all of it for six years under 45 CFR 164.316(b)(2)(i).
Doing It on a Small Practice Budget
You have three realistic options.
Free, from the government. CISA's Cyber Hygiene Services are free and include scanning of your internet-facing systems. CISA offers them to "public and private sector critical infrastructure organizations," and healthcare is a critical infrastructure sector, so many practices can enroll. It only sees what faces the internet, not the computers inside your office.
Your IT person or MSP. Many already own a scanning tool. Ask for the report, not just the reassurance.
A paid scan. Prices run from a one-time check of one computer to managed scanning of the whole office.
Five questions to ask any scanning vendor:
- What exactly does the tool collect from our computers?
- Can the tool or your staff see ePHI? If yes, we need a business associate agreement.
- Where is the scan data stored, and when is it deleted?
- Do we get a written report we can keep for six years?
- Does the report say what to fix first, in plain English?
If a vendor cannot answer question 1 in one sentence, keep looking.
Where One Guy Consulting Fits
If you want to see what a scan finds before committing to anything, our sample vulnerability scan checks one office computer for $59. A small report-only program lists the installed software, we check it against published flaws, and you get a plain-English report within one business day. It never touches documents, email or patient records, and it removes itself after 3 days.
The scan covers the technical piece. The security risk assessment is where it gets recorded, and it is part of every plan on our pricing page. The Full-Scope plan adds 4 hours a month of 1:1 implementation calls with Chuck.
Not sure where you stand? Book a free 30-minute intro call. No obligation, no pressure.
Frequently Asked Questions
Does HIPAA require annual penetration testing?
Not today. The current Security Rule does not mention penetration testing. The 2025 proposed rule would require one at least every 12 months, or more often if your risk analysis calls for it. It is proposed, not final, and HHS's target date is July 2027.
Can my own IT person do the penetration test?
Under the proposed rule, the test must be done "by a qualified person." The proposal describes that as someone with appropriate knowledge of and experience with generally accepted cybersecurity principles. It does not require a specific certification, degree or license.
Is a vulnerability scan the same as a risk assessment?
No. A scan finds technical weaknesses in your computers and network. A security risk assessment covers every risk to ePHI, including people, processes and facilities. The scan is evidence that feeds the risk assessment; it does not replace it.
Does a scanning vendor need a business associate agreement?
If the vendor's tool or staff can create, receive, maintain or transmit ePHI, treat the vendor as a business associate and sign a BAA. A tool that only reads the list of installed software may not touch ePHI. When in doubt, ask the vendor in writing and talk to your attorney.
How long do I keep scan reports?
HIPAA requires security documentation to be kept for 6 years from the date it was created or last in effect, whichever is later, under 45 CFR 164.316(b)(2)(i). Keep the reports and the record of what you fixed.
Sources
- 45 CFR 164.308, Administrative safeguards (eCFR)
- 45 CFR 164.316, Policies and procedures and documentation requirements (eCFR)
- HHS, HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, proposed rule, 90 FR 898 (Federal Register, Jan 6, 2025)
- NIST SP 800-115, Technical Guide to Information Security Testing and Assessment
- NIST National Vulnerability Database, CVSS severity ratings
- CISA Known Exploited Vulnerabilities Catalog
- CISA Cyber Hygiene Services
Related Reading
This content is for educational and informational purposes only and should not be construed as legal advice.
Try three One Guy Consulting 3D staff training courses free →