Penetration testing for healthcare and healthtech
A breach in healthcare exposes diagnoses and invoices, and an outage reaches the bedside. BERRY9 engineers test patient records and who can open them, portals and apps, the lab and billing connections, and the hospital network, using fictional data and safety rules agreed in writing.
- Typical duration
- 5 to 10 working days
- Testing
- Manual, by engineers
- Report
- Executive + engineering
- Delivery
- Remote, on-site by arrangement
Last reviewed
01 / Where attackers look
What attackers go after in healthcare systems
Healthcare holds the most personal kind of data, often in systems assembled over many years from several vendors.
Patient records and access
Who may open which record is the central question. We test role boundaries between doctors, nurses, front desk, billing and lab staff, and whether a patient can reach anyone's record but their own.
Patient apps and portals
Appointment booking, report downloads and payment screens hold names, phone numbers, diagnoses and invoices. We check sign-in, recovery, one-time passcodes, report links and what the mobile app stores.
Lab, billing and insurer integrations
Hospital software swaps data with labs, pharmacies, billing teams and insurance intermediaries through APIs, shared files and portals. Every connection is a possible way in, so each is tested for who may use it.
Reports and shared files
Lab results, discharge summaries and images travel as files and links. We test whether links can be guessed, whether they expire and whether a file shared with one person can be opened by another.
Hospital network and connected devices
Flat networks let a single infected PC reach the records server. Connected devices are tested from the network side, and the IoT and firmware page covers testing a device itself.
Backups and recovery
Ransomware is the clinical risk with the most obvious effect: records unavailable at the bedside. We test how far an intruder could get toward the servers and the backups that your recovery depends on.
02 / Scope
What a healthcare penetration test covers
A hospital engagement normally joins its applications and integrations to the network that carries them.
| System | What we examine | Covered by |
|---|---|---|
| Hospital and clinic applications | Role-based access to records, billing, appointment and pharmacy modules, and the logic that separates one patient's data from another's | Web application testing |
| Patient apps and portals | Sign-in and recovery, report downloads, stored data on the phone, links and the API behind each screen | Mobile app testing and Web application testing |
| Integration APIs | Who may make each call between the hospital system, labs, billing and partners, and which fields come back | API security testing |
| Internal network and identity | Segmentation between clinical and office networks, Active Directory attack paths and reachability of the records and backup servers | Network penetration testing and Active Directory testing |
| Connected devices | Services and credentials on devices that sit on the network, and firmware testing where a device itself is in scope | IoT and firmware testing |
| Staff awareness | Phishing and phone-call exercises for reception, billing and clinical staff, with results shown as numbers and not as names | Social engineering assessment |
03 / Common flaws
Flaws that recur in healthcare software
We meet these in very different hospital and healthtech products, and each can be tried on purpose.
Show details for Flaws that recur in healthcare software
Healthcare software has often grown over years, with modules added by different vendors, so the same patient can be reachable in several ways. A tester looks for the gaps between those ways.
- Record access by identifier. A patient or visit number in a web address or request that opens another patient's record when changed. See our article on broken object-level authorization.
- Roles that are wider than the job. A front-desk account that can open clinical notes, or a billing account that can edit them.
- Report links that never expire. A lab result sent as a link that works for anyone, forever.
- Default and shared credentials. Shared logins on workstations, devices and vendor portals that nobody owns.
- Remote access for vendors. Support tools left open to the internet and protected by a single password.
- Flat networks. A guest or office device that can reach the records server directly.
Our article on internal vs external network testing shows how the network side of a hospital is covered, and our Active Directory article explains the staff-login paths that ransomware groups use.
04 / Rules
The DPDP Act, HIPAA and healthcare rules
Patient data is personal data, and several rules may apply at once. The report is evidence for the people who decide.
Show details for The DPDP Act, HIPAA and healthcare rules
Under India's DPDP Act a patient record counts as personal data, and the rules published in November 2025 add security-safeguard and breach-notification duties that begin in 2027. Our DPDP checklist and the DPDP Act testing page explain how testing supports them. Healthtech companies serving US customers are frequently asked about HIPAA; see the HIPAA testing page.
Hospitals and clinics may also have duties set by state regulators, accreditation bodies, insurers and the government health programs they join. Those decide what is required of you, and we do not. We deliver the test and a report that your compliance team, auditor or partner can use. Incident reporting has its own clock: see CERT-In reporting and log rules.
05 / How it runs
How a healthcare engagement runs safely
Allow 5 to 10 working days, and expect safety rules to come before the schedule.
Show details for How a healthcare engagement runs safely
Before day 1
Scope and safety rules
We agree what is in scope and what stays out. We advise excluding any device attached to a patient and running heavy checks away from clinical peak hours; both go into the rules of engagement.
Day 1
Roles and fictional patients
You provide test accounts for each clinical and administrative role and a demo or test environment populated with made-up patients, never real records.
Days 2 to 7
Testing
Applications, integrations and the network are tested by hand, and we tell you at once if anything exposes patient data.
OutputFindings with proof, shown on fictional data
Days 8 to 9
Reports and walkthrough
Management and auditors receive an executive report; your IT team and vendors receive an engineering report. A call goes through both.
After your fixes
Retest
We try each fixed finding again and mark it closed or open.
06 / Preparation
What to prepare before the test
Fictional patients and clear exclusions let us test thoroughly without touching live care.
Show details for What to prepare before the test
- A test or demo environment filled with fictional patients; we never ask for real patient records.
- Accounts for each role: doctor, nurse, front desk, billing, laboratory and administrator.
- A list of systems that must not be touched, such as devices connected to patients, and the clinical hours to avoid.
- Contact details for the vendors who run the hospital information system, laboratory and billing software.
- For network testing, a VPN account or a device we can place on the clinical or office network.
- A named contact for questions, and an out-of-hours number for emergencies, during the test.
For backups and the other general preparations, follow our preparation guide. Our checklist as a PDF can be printed and shared with clinical and IT leads.
07 / Price and timing
Cost and timing for a healthcare test
Show details for Cost and timing for a healthcare test
A hospital or healthtech product is not a starter scope: Every other test starts from INR 27,000 + 18% GST, growing with the count of applications, integrations and network segments. A single clinic website may be small enough to qualify as one, while a group with several applications and a network is priced by what is in scope. See the VAPT cost guide.
The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.
08 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
Do you need real patient records to test?
No, we ask for a demo or test setup with fictional patients. Should a finding be demonstrable only in production, the written rules limit what may be viewed, and anything resembling real patient data is reported and not copied. See the section on What to prepare before the test above.
Will testing disrupt clinical systems?
That is what the written rules prevent: they list what is excluded and when heavy checks may run. We advise keeping patient-connected devices out of scope and staying clear of clinical peak hours. See the section on How a healthcare engagement runs safely above.
Can you test patient apps and portals?
Yes. We test sign-in, recovery, one-time passcodes, report downloads and the data stored on the phone, then test the API behind each screen directly, with and without a login. See the section on What attackers go after in healthcare systems above.
Do you test laboratory and billing integrations?
Yes. We check who may call each integration API, what each response returns and how shared files and report links are protected. We need contact details for the vendors that operate those systems. See the section on What a healthcare penetration test covers above.
Does the DPDP Act require a penetration test?
The Act and its rules ask for reasonable security safeguards and for breach notification; they do not name a penetration test. A test is a direct check that safeguards work, and it leaves dated evidence of what you did. See the section on The DPDP Act, HIPAA and healthcare rules above.
Can you help with HIPAA for a healthtech with US customers?
We test the systems in scope, and the report is evidence for your assessor or customer. HIPAA compliance is not something we certify; the assessor or covered entity decides. See the section on The DPDP Act, HIPAA and healthcare rules above.
How long does a healthcare penetration test take?
Between five and ten working days, counting from the kickoff call to the delivered report. A hospital group with many applications and networks needs longer, and the proposal lists the dates. See the section on How a healthcare engagement runs safely above.
Will a test affect patient care systems?
We plan so that it cannot: devices attached to patients stay out of scope unless you ask otherwise, heavy checks avoid clinical peaks, and the rules say when we stop and phone you. See the section on How a healthcare engagement runs safely above.
Plan your next security test
Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.
- +91 86868 92922
- contact@berry9.com
- H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073, Telangana