HIPAA penetration testing for Indian healthtech serving US customers
HIPAA does not name penetration testing, but its Security Rule asks covered entities and their business associates for a risk analysis and a periodic technical evaluation, and US customers commonly ask Indian vendors for a recent test as evidence. From Hyderabad, BERRY9 tests by hand the portals, APIs, mobile apps and cloud services that store or move patient data, and every finding is backed by a proof of concept, scored with CVSS 3.1 and paired with a fix your developers can track in a remediation matrix.
- Tests start from
- INR 27,000 + 18% GST
- What we test
- Systems holding ePHI
- Our role
- Testing, not auditing
- Delivery
- Remote from Hyderabad
Last reviewed
| Function | Clinician | Front desk | Billing |
|---|---|---|---|
| Open a chart in your clinic | Allowed, as designed | Refused, as designed | Refused, as designed |
| Open a chart in another clinic | Finding: allowed, but should be refused | Refused, as designed | Refused, as designed |
| Book an appointment | Allowed, as designed | Allowed, as designed | Refused, as designed |
| Change a prescription | Allowed, as designed | Refused, as designed | Refused, as designed |
| Export a claims file | Refused, as designed | Refused, as designed | Allowed, as designed |
| Download full chart history | Allowed, as designed | Refused, as designed | Finding: allowed, but should be refused |
- ClinicianOpen a chart in another clinic: allowed, but should be refused
- BillingDownload full chart history: allowed, but should be refused
01 / What HIPAA asks
Does HIPAA require penetration testing?
Not by name. The HIPAA Security Rule asks covered entities and business associates to analyze the risks to electronic protected health information, manage them and evaluate their safeguards from time to time, and it leaves the method to each organization, scaled to its size and risks.
Risk analysis, 164.308(a)(1)(ii)(A)
The Rule asks for an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of the electronic protected health information you hold. A penetration test feeds it one kind of input: weaknesses that were found and exploited, not only assumed.
Risk management, 164.308(a)(1)(ii)(B)
The risks that analysis turns up are then reduced to a reasonable and appropriate level with security measures. Fixing what a test finds, and checking the fixes, is part of that work.
Evaluation, 164.308(a)(8)
The Rule asks for a periodic technical and nontechnical evaluation of how well your security policies and procedures meet its requirements, first against its standards and later in response to environmental or operational changes that affect the security of that information. An independent test is one form of technical evaluation.
Technical safeguards, 164.312
Five standards cover access control, audit controls, integrity, person or entity authentication, and transmission security. A test shows how those controls behave under attack in the systems you put in scope.
The Security Rule does not name penetration testing as a required test, and it does not say how often to evaluate. HHS has proposed changes to the Rule that would add penetration testing; a proposed rule is not in force, so ask your counsel whether a final rule has been published and what it asks of you.
What BERRY9 is, and is not. BERRY9 is a testing firm. We are not a HIPAA auditor, and we do not give legal advice. Nor can anyone sell you an official HIPAA certificate: HHS does not endorse or recognize private organizations' HIPAA certifications, so a test report is evidence for your own program, not a pass.
02 / How HIPAA reaches you
How HIPAA reaches an Indian healthtech vendor
HIPAA's privacy and security rules are written for health plans, health care clearinghouses and health care providers that conduct certain transactions electronically, which HIPAA calls covered entities. An Indian company usually meets those rules through a customer: once your software or service handles a covered entity's patient data, the contract and the customer's security review bring the Security Rule's expectations with them.
Step 1
You become a business associate
A business associate is a person or company that creates, receives, maintains or transmits protected health information on behalf of a covered entity. A subcontractor doing the same for a business associate is one too.
Step 2
The agreement arrives
Before a business associate handles that information, HIPAA calls for a written business associate agreement. Among other terms, it commits you to safeguard electronic protected health information as the Security Rule requires and to report security incidents to your customer.
Step 3
The questionnaire follows
Your customer's security team sends a questionnaire or vendor review. Many ask when your systems were last tested by someone independent, and for the report.
Step 4
You test what holds their data
The systems that store or move their patients' records go into scope, and the test report becomes one input to your own risk analysis and evaluation.
Step 5
You fix, recheck and answer
Findings are fixed in order of risk and checked again, and the record of what was closed goes back to the customer with your answers.
Business associates must meet the Security Rule themselves, not only through the contract. Whether US law reaches a company in India directly is a question for US counsel; in practice, the duties usually arrive through the business associate agreement and the customer's review.
Business associate agreements with BERRY9: Whether a business associate agreement is needed is a question to raise at scoping, so it can be agreed in writing before work starts.
03 / Evidence map
What a penetration test adds to your HIPAA risk analysis
The table pairs the five technical safeguard standards in 164.312, and the risk analysis they feed, with the checks a BERRY9 test runs, what its report records and how far a test can reach. Treat it as a planning aid for your own analysis, not as a finding that any safeguard is compliant.
Show details for What a penetration test adds to your HIPAA risk analysis
| Security Rule standard | What we test | What the report records | Where the test stops |
|---|---|---|---|
| Access control, 164.312(a)(1) | Whether each role, clinic and patient account reaches only the records it should, including by changing record IDs in requests and API calls | Each broken access rule with the request that proved it, the records exposed and the fix | Roles, tenants and records left out of scope |
| Audit controls, 164.312(b) | Sign-ins, record views, exports and admin changes made during the test, for your team to look for in its activity logs | Reproduction steps your team can match against what the logs captured | How long logs are kept, who reviews them, and your incident response |
| Integrity, 164.312(c)(1) | Whether a user can alter or delete clinical, billing or lab records they should only read, through tampered parameters, forms or uploads | The changed field, the request used and the control that would have stopped it | Backups, replication and data that never passes through the tested interfaces |
| Person or entity authentication, 164.312(d) | Sign-in, password reset, multi-factor prompts, session tokens and API keys, for ways to act as someone else | Each bypass or weak point, scored with CVSS 3.1, with the fix | Identity providers and single sign-on run by others, unless they agree to testing |
| Transmission security, 164.312(e)(1) | Whether data moving between web, API, mobile and integration endpoints is encrypted, any channel that still sends it in cleartext, and whether the mobile app validates the server's certificate | Weak or missing protection listed per endpoint | Links the test cannot reach, such as private connections to a hospital |
| Risk analysis input, 164.308(a)(1)(ii)(A) | Real attack paths through the systems in scope, chained where one flaw leads to another | Findings ranked by severity, to set against the risks your analysis already lists | Risks outside technology, such as staffing, physical security or vendor contracts |
A row with no findings means the test found no issue there in the scope and time it had. Whether your safeguards meet the Security Rule is your decision, made with your counsel.
04 / Scoping
Scope the test around protected health information
List every place a US patient's information is collected, shown, stored or sent, then decide which of those the test covers. Patient data rarely sits in one system: it moves between the app, its APIs, partner integrations and cloud storage.
Show details for Scope the test around protected health information
Web portals
Patient, clinician and admin portals where charts, appointments, lab reports and invoices are opened and changed.
APIs and integrations
The endpoints behind your apps and the links to hospitals, labs and billing partners, including interfaces built on standards such as HL7 or FHIR.
Mobile apps
Telehealth and patient apps that keep reports, prescriptions or messages on the phone, and the traffic they send home.
Cloud services
Storage, snapshots, backups and file shares holding scans, reports or exports, and the account permissions that decide who reads them.
Teams in India
Support, coding and billing staff who open US patient records through internal tools, remote desktops or virtual desktops.
Test data, not patient data
A security test can prove an access flaw with made-up records in test accounts. Load test patients into the environment in scope before testing starts, so no finding depends on a real record.
Have these ready before scoping:
- Your customer's requirement. The questionnaire, contract clause or vendor review that asked for a test, so the scope answers it.
- Where the patient data goes. A data flow diagram, or a short list of the apps, APIs, integrations and storage that hold or move US patients' records.
- Two accounts per role and tenant. One clinic's user is tried against another's, which is how cross-tenant leaks show up.
- Test patients. Made-up records loaded into the environment in scope, covering charts, lab results and invoices.
- Your current risk analysis. Or just its list of systems and risks, so the test adds to it instead of repeating it.
- Third-party permission. Written consent from any hosting provider or vendor whose systems are in scope.
If a test reaches real patient records: How that is handled is agreed at scoping, before any test starts.
05 / Deliverables
What you can hand your US customer after the test
All five items are standard in any BERRY9 test. Each piece is written for a reader: your engineers, your leadership, and the customer's security reviewer who asked for evidence.
Show details for What you can hand your US customer after the test
- An executive report in plain language for your leadership and your customer's reviewer: the systems tested, the weaknesses found and the risk each one poses to patient data.
- An engineering report that gives your developers, for every finding, the steps to reproduce it, its proof of concept and the fix we recommend.
- CVSS 3.1 severity on each finding, weighed against the patient records the flaw exposes.
- A remediation matrix listing each finding beside its fix and status, which doubles as your record of the risk management that followed the test.
- Retest terms, which the price section explains.
Customers that also ask for SOC 2 or ISO 27001 evidence can sometimes be answered from one test, if each auditor accepts its scope: our ISO 27001 penetration testing and SOC 2 penetration testing pages explain when one test can serve both. If your platform also holds personal data of patients in India, read DPDP Act security testing.
The work follows the five phases set out on our VAPT methodology page, and our sample VAPT report shows how findings are laid out for engineers and reviewers.
06 / Who it fits
Indian healthtech teams this testing fits
The fit is closest for Indian companies that build or run software and services holding US patients' records. A HIPAA gap assessment, policies or a compliance program is compliance consulting, separate from a penetration test.
Show details for Indian healthtech teams this testing fits
Telehealth platforms
Video visit, messaging and e-prescription apps used by US clinics, where a session or access flaw exposes consultations.
EHR and practice software
Charting, scheduling and practice management systems built in India for US providers, often shared by many clinics.
Medical billing and coding
Revenue cycle teams and their tools, handling claims, insurance details and diagnosis codes for US providers.
Clinical-trial technology
Trial management, data capture and patient-reported outcome software that can hold health data from US sites.
Health data and AI
Analytics, imaging and AI products that receive records or scans from US customers to process.
Device companion apps
Mobile and cloud apps paired with connected medical or wellness devices that send readings to a care team.
We deliver testing remotely from our single office in Hyderabad, and on-site work is possible by arrangement. Teams near the office can read about VAPT services in Hyderabad.
07 / Price
What a HIPAA penetration test costs
A HIPAA penetration test with BERRY9 starts from INR 27,000 + 18% GST. Bigger scopes cost more, and a written proposal after scoping sets the figure for yours, once it is clear which systems hold patient data and how many roles and integrations they have.
HIPAA penetration test
Starts fromINR 27,000 + 18% GST
Starting price for a manual test of the portals, APIs, mobile apps or cloud services that hold US patients' records. The final figure follows the systems, roles and integrations in scope.
- Executive and engineering reports
- A proof of concept for every finding
- CVSS 3.1 scores and a remediation matrix
What sets the figure
Priced byScope
Three things move the price of a HIPAA test:
- Systems that hold or move PHI
- Roles, clinics and tenants to test as
- Integrations with hospitals, labs or payers
The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.
Our VAPT cost guide for India walks through how a starting price becomes a final figure, and all offensive security services lists every test we run.
08 / Inquiry
Send us your customer's security requirement
Share the questionnaire or contract clause that asked for a test, the systems that hold US patients' records, and the date your customer needs the report. From those, we write a proposal that sets out the scope and the timeline.
Prefer to talk it through? Call +91 86868 92922 or write to contact@berry9.com.
09 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
Does HIPAA require penetration testing?
Not by name. The Security Rule asks covered entities and business associates for a risk analysis, risk management and a periodic technical and nontechnical evaluation of their safeguards, and it leaves the methods to each organization. Penetration testing is a widely used source of technical evidence for that analysis and evaluation. HHS has proposed changes that would add penetration testing to the Rule, so ask your counsel whether a final rule has been published. See the section on Does HIPAA require penetration testing? above.
Can BERRY9 make us HIPAA certified?
No. HHS does not endorse or recognize private organizations' HIPAA certifications, so no testing firm or auditor can issue one with official standing. BERRY9 gives you a test report, the fixes for each finding and the record of what was closed, which you can use as evidence in your own risk analysis and in answers to customers.
Does HIPAA apply to an Indian company?
It can reach one through its customers. HIPAA treats a company that creates, receives, maintains or transmits protected health information for a covered entity, or for one of its business associates, as a business associate, and such a company usually signs a business associate agreement. Whether and how US law applies to your company directly is a question for US counsel. See the section on How HIPAA reaches an Indian healthtech vendor above.
What is the difference between a HIPAA risk analysis and a penetration test?
A risk analysis, required by 164.308(a)(1)(ii)(A), assesses risks and vulnerabilities to electronic protected health information across the whole organization, including people, processes and physical security. A penetration test looks at a defined set of systems and shows which technical weaknesses can actually be exploited. The test feeds the analysis; it does not replace it. See the section on What a penetration test adds to your HIPAA risk analysis above.
Do you need access to real patient data to run the test?
Real patient records are not needed to show access-control, authentication or encryption flaws: made-up records in test accounts prove them just as well. Ask your team to load test patients into the environment in scope before testing begins, and keep production records out of the test where you can. See the section on Scope the test around protected health information above.
Which systems should a HIPAA penetration test cover?
Every system that stores or moves US patients' records: patient and clinician portals, the APIs behind them, integrations with hospitals, labs and payers, mobile apps, and the cloud storage, backups and exports that hold records or scans. Systems a vendor runs for you need that vendor's written permission before they can be tested. See the section on Scope the test around protected health information above.
Will our US customer accept your report?
Your customer decides what evidence it accepts. Send us its questionnaire, contract clause or vendor review before scoping, so the test covers what it asks about. BERRY9 cannot promise that any customer, auditor or regulator will accept a report.
How much does a HIPAA penetration test cost?
A HIPAA penetration test with BERRY9 starts from INR 27,000 + 18% GST. Your exact price depends on which systems hold patient data, the roles and tenants we test as and the integrations in scope, and a written proposal after scoping confirms it. See the section on What a HIPAA penetration test costs above.