Healthcare
Hospitals, payers and digital-health companies hold the most sensitive data there is, on systems that cannot simply go offline. We test the platforms patients and clinicians use, prepare the cryptography that protects records for decades, and secure the AI now working alongside clinicians.
Book a ConsultationCare runs on software — and so do the attacks
Electronic health records, patient portals, telehealth and digital-health apps, imaging and lab systems, claims platforms, and the identity and remote access that tie them together are where care now happens. An outage can delay treatment, and a stolen health record cannot be reissued like a payment card.
The rules are tightening. In the US, HHS has proposed rewriting the HIPAA Security Rule to require penetration testing at least every 12 months and vulnerability scanning every six; in the EU, NIS2 puts healthcare providers in its sectors of high criticality and the European Health Data Space sets security requirements for electronic health record systems; and in England, NHS trusts now assess themselves against the Cyber Assessment Framework.
Health records stay sensitive for a lifetime, so data recorded in transit today is a harvest-now, decrypt-later target long before most systems are migrated to post-quantum cryptography. And AI is arriving in the exam room — writing notes, summarising records and answering patients — with access to exactly the data attackers want.
Three services, tuned to care
Artificial Intelligence Security (AI-BOM)
Ambient documentation and clinical assistants, AI over patient records, and agents that touch scheduling, coding or claims. We test whether patient data leaks across sessions, whether instructions hidden in a document can steer the AI, and what an agent can change on a patient’s behalf.
Learn more →Post-Quantum Cryptography Readiness (CBOM)
A cryptographic inventory across records, clinical interfaces, identity and backups, ranked by how long the data must stay confidential — which for health records is often a lifetime. Delivered as a CBOM, with a roadmap that fits clinical change windows.
Learn more →Product Penetration Testing
Patient portals, telehealth and digital-health apps, EHR integrations and FHIR and HL7 interfaces, claims and member platforms, and the identity, remote access and cloud behind them. We test what one patient — or one compromised clinician account — can reach, and for hospitals, how well clinical networks and devices are segmented.
Learn more →Built for clinical environments, not adapted from IT
Patient-level access, tested
Can one patient see another’s records? Can a clinician reach records outside their care relationship, or a support account reach everything? We test access at the level of the individual record, not just the login page.
Emergency access stays open
Clinicians need break-glass access in an emergency. Every access-control recommendation is checked against it before we write it — security that locks out a clinician is a defect in the recommendation.
Fix what you can fix
Most findings against devices you did not build are not yours to fix. For clinical networks we deliver segmentation, compensating controls and procurement leverage — not a list of flaws nobody on site can patch. Device-level work is covered on our Medical Devices page.
Evidence for your obligations
Scope, methods and results documented so they feed your risk analysis, your auditors and your board. Under HITECH, HHS must weigh twelve months of recognized security practices when it sets penalties — documented testing helps you show them.
Where the rules stand, market by market
Healthcare security rules are tightening on both sides of the Atlantic — some in force, some still proposed. Current as of October 2026.
| Market | Instrument | What it means for you |
|---|---|---|
| United States | HIPAA Security and Breach Notification Rules — 45 CFR Parts 160 and 164 | The Security Rule requires a risk analysis but does not explicitly require penetration testing; HHS’s enforcement initiative on risk analysis has continued in 2026. Under the Breach Notification Rule, breaches affecting 500 or more people must be reported to HHS without unreasonable delay and no later than 60 days after discovery. |
| United States | HITECH Act (2009), as amended in 2021 | Extended HIPAA security obligations and penalties to business associates and created breach notification. Since 2021, HHS must consider whether you had recognized security practices — such as those developed under the NIST Act or the HHS 405(d) programme — in place for at least the previous 12 months when setting fines, audit outcomes and settlement terms. |
| United States (proposed) | HIPAA Security Rule update — proposed January 2025 | Would require vulnerability scanning at least every six months, penetration testing at least every 12 months, multi-factor authentication, encryption, and an asset inventory and network map. Still a proposal: HHS has moved it to its long-term agenda and projects a final rule in July 2027. Separately, the Health Care Cybersecurity and Resiliency Act (S. 3315), passed by the Senate on 30 September 2026, would direct HHS to require multi-factor authentication, encryption and monitoring that includes penetration testing; it has not passed the House and is not law. |
| United States | FTC Health Breach Notification Rule — 16 CFR Part 318 | Covers health apps and personal health record vendors outside HIPAA, as amended with effect from 29 July 2024. |
| United States | HHS Cybersecurity Performance Goals (2024) | Ten essential and ten enhanced goals, still voluntary. In April 2026 CMS asked for comment on whether cybersecurity practices should become requirements within its purview. |
| United States | Section 1557 — 45 CFR 92.210 | Since 1 May 2025, covered entities must make reasonable efforts to identify patient-care decision support tools — AI included — that use race, colour, national origin, sex, age or disability as inputs, and to mitigate the risk of discrimination from them. The 2025 court vacatur of parts of the 2024 rule did not include § 92.210. |
| European Union | NIS2 — Directive (EU) 2022/2555 | Health is a sector of high criticality: healthcare providers, EU reference laboratories, medicinal-product research and development, pharmaceutical manufacturing and makers of devices critical in a public-health emergency are covered — generally if medium-sized or larger — with risk-management and incident-reporting duties under national transposing law. A January 2026 Commission proposal would exclude long-term care from the healthcare-provider entry; it is still before Parliament and not adopted. |
| European Union | European Health Data Space — Reg (EU) 2025/327 | Applies generally from 26 March 2027, with its rules for electronic health record systems phased in from 2029 and 2031. EHR systems must meet security and logging requirements — authentication of health professionals and a record of who accessed which patient’s data — under a mandatory self-assessment and CE marking. |
| European Union | AI Act — Reg (EU) 2024/1689, as amended by Reg (EU) 2026/1744 | AI used for emergency patient triage, for eligibility for public healthcare services, or for risk assessment and pricing in health insurance is high-risk from 2 December 2027; AI that is a medical device, or a safety component of one, and needs notified-body assessment follows from 2 August 2028. |
| United Kingdom | NHS Data Security and Protection Toolkit NIS Regulations 2018 | NHS trusts in England have assessed against the Cyber Assessment Framework version of the Toolkit since 2024–25, and NHS trusts and health boards across the UK are operators of essential services. The Cyber Security and Resilience (Network and Information Systems) Bill, which would amend and extend the NIS Regulations, is in the House of Lords and not yet law. |
| Post-quantum | No health-specific requirement | No health regulator has issued post-quantum requirements; the Health Sector Coordinating Council’s voluntary 2026 AI governance guidance only says vendors should develop or have plans for post-quantum encryption. The general timelines on our PQC page are the reference points — and health data’s lifetime brings the real deadline earlier. |
What you get
- Findings report — patient-to-patient and role-based access results, with reproduction steps and concrete fixes, ranked by what an attacker could reach
- Clinical network assessment — for providers: how clinical systems and devices are segmented, with compensating controls and the security requirements to put to vendors at procurement
- Evidence for your risk analysis — scope, methods and results in a form your compliance team, auditors and board can use
- Cryptographic and AI bills of materials — record, interface and identity cryptography, and the AI in your clinical and patient workflows, in CycloneDX format
- Retest of fixes — evidence that remediation landed
Protect the records that last a lifetime.
A healthcare engagement starts with your systems, your clinical workflows, and the obligations you report against.
Get in Touch