Annual penetration testing became a mandatory HIPAA Security Rule requirement in 2026, and many home health administrators are encountering the requirement for the first time during their current compliance review cycle. The most common questions I receive: What exactly is a penetration test? Is it the same as a vulnerability scan? How disruptive is it to clinical operations? What do I get in the report, and what am I supposed to do with it? How do I know if the firm I am considering is actually qualified? And what does the pen test result do for my cyber insurance situation?
This article provides direct, operational answers to every one of those questions — so that home health administrators can meet the requirement correctly, select the right firm, and extract maximum value from the exercise.
Penetration Testing vs. Vulnerability Scanning: The Critical Distinction
The 2026 HIPAA update requires both biannual vulnerability scanning and annual penetration testing — these are distinct requirements for distinct activities that produce different information and serve different compliance purposes. Confusing them — or substituting one for the other — creates a documented HIPAA compliance gap.
Vulnerability scanning is an automated process that identifies known software weaknesses — unpatched operating systems, misconfigured services, outdated application versions — by comparing your systems against a database of known vulnerabilities. It is comprehensive, relatively fast, and produces a list of technical weaknesses for remediation. A vulnerability scan tells you what weaknesses exist.
Penetration testing is a simulated attack conducted by a qualified security professional who actively attempts to exploit those weaknesses — and others that automated scanning may not detect — to gain unauthorised access to your systems and data. A penetration test tells you what an attacker could actually accomplish with your weaknesses. The distinction matters because some vulnerabilities that appear severe on a scan report are not exploitable in practice given your specific configuration, while some vulnerabilities that score as low-severity on a scan are easily chained together to achieve significant access. Only a penetration test reveals the real exploitability of your environment.
One substitution that is specifically not acceptable under the proposed 2026 HIPAA standard: an internal IT staff member running an automated vulnerability scanning tool and presenting the results as a penetration test. The regulation specifies testing by a "qualified party" — which OCR guidance interprets to mean an individual or firm with verifiable penetration testing credentials and demonstrated methodology, not an internal staff member using commercial scanning software.
What a Penetration Test for a Home Health Agency Covers
External Penetration Testing
External penetration testing examines your organisation's external attack surface — the systems, services, and interfaces that are accessible from the public internet. For a home health agency, this includes: the public-facing website and any web applications; email servers and the email domain configuration (DMARC, DKIM, SPF and whether they are exploitable); remote access services (VPN endpoints, RDP services, any systems accessible from outside the agency's network); and cloud services that are accessible from the internet with the credentials of agency staff.
The external test simulates an attacker who has no inside knowledge of the agency's environment and is attempting to gain initial access from the internet. The tester uses the same publicly available information sources that a real attacker would use — the agency website, LinkedIn, job postings, the HHS breach portal, DNS records — to build a reconnaissance profile before attempting exploitation. The findings from the external test directly address the OSINT attack surface discussed in our reconnaissance article: a competent external pen test will identify the same information gaps and exploitable configurations that a criminal attacker would target.
Internal Penetration Testing
Internal penetration testing simulates an attacker who has already gained access to the agency's internal network — through a phishing credential theft, a compromised employee device, or a rogue insider. The internal test examines how far an attacker with initial access could move through the environment, what systems they could reach, and what data they could access or exfiltrate.
For home health agencies, the internal test typically focuses on: the clinical network (EHR access, patient data systems, scheduling platforms); the administrative network (billing and financial systems, Microsoft 365 or Google Workspace); and the path between them — because segregating these networks is a critical control that is frequently absent. An internal test that finds the tester can move from a compromised field nurse device credential to billing system administrator access has identified a lateral movement pathway that real ransomware groups exploit.
Social Engineering Component
Many penetration testing engagements for healthcare organisations include a social engineering component — simulated phishing campaigns and phone-based pretexting that test whether staff can be manipulated into revealing credentials or granting access. For home health agencies where phishing is the primary initial access vector, the social engineering component of a pen test provides the most operationally relevant finding: exactly how susceptible are your specific staff members to the specific phishing techniques being used against home health agencies in 2026. This component is typically optional and adds cost, but for agencies that want to know their real human vulnerability rather than just their technical vulnerability, it is worth including.
What a Penetration Test Costs — and What Drives the Price
For a home health agency in the 50–200 employee size range, a combined external and internal penetration test from a qualified firm typically costs between $8,000 and $18,000. The range reflects four factors that drive price variation:
• Scope: the number of IP addresses, systems, and applications included in the external test; the number of internal network segments and systems included in the internal test. A larger scope means more tester time and higher cost.
• Methodology depth: a box-check compliance pen test that runs automated tools and documents findings is at the low end of the price range. A manual penetration test that uses custom exploitation techniques, chains vulnerabilities together to demonstrate realistic attack paths, and provides detailed remediation guidance is at the high end.
• Firm reputation and credentials: established penetration testing firms with documented healthcare sector experience, OSCP-certified testers, and published methodology documentation command higher rates than generalist IT vendors who offer pen testing as one of many services.
• Report quality: the value of a penetration test is in the report — the documentation of findings, their exploitability, their business risk context, and the remediation guidance. Reports that provide actionable guidance specific to your environment are more expensive to produce than template reports with generic recommendations.
One important note on budget: the $8,000–$18,000 cost is a one-time annual expenditure that satisfies a mandatory HIPAA requirement, supports cyber insurance underwriting, and is an allowable cost under Medicare cost reporting. It is not a discretionary security enhancement — it is a compliance obligation with a defined and manageable cost.
How to Select a Qualified Penetration Testing Firm
The proposed 2026 HIPAA standard would specify that penetration testing must be conducted by a "qualified party" — and this is the area where home health agencies most consistently make errors that undermine the compliance value of the exercise. A vendor who calls their service "penetration testing" is not necessarily providing what the HIPAA standard requires. Here is how to distinguish qualified firms from inadequate ones.
The Credentials That Matter
The penetration testing credentials that are most broadly recognised and most directly relevant to the HIPAA qualified party standard:
• OSCP (Offensive Security Certified Professional): the gold standard for hands-on penetration testing certification. OSCP holders have demonstrated the ability to compromise systems through manual exploitation techniques under time pressure — not just to run automated tools. This is the credential that most directly demonstrates the capability that "penetration testing" is supposed to assess.