Does HIPAA require a penetration test? +
Not by name. The HIPAA Security Rule requires a risk analysis and a periodic technical and non-technical evaluation of your safeguards. It does not list penetration testing as a named, mandatory control. In practice, a penetration test is one of the strongest ways to satisfy the evaluation expectation and to inform an honest risk analysis — which is why most healthcare organizations and business associates run one. We'd rather be straight with you about that than imply a mandate that isn't in the regulation.
Will this report help with an OCR investigation or audit? +
Our reports use an evidence-oriented format that documents scope, the assets tested, findings, and the date of testing, plus a signed Compliance Attestation Letter. If OCR or an auditor asks how you evaluate your technical safeguards, a dated, defensible external pentest report is concrete evidence that you tested rather than assumed. It supports your risk analysis and evaluation file. The sample report above is the exact format you'll receive.
How long does a HIPAA pentest take? +
For a covered entity or business associate with a typical external attack surface, the testing window is one to three business days of active testing, plus reporting. Most customers have a final report in hand within two weeks of purchase. If a payer security review or BAA deadline is close, choose the ASAP option in the order form and we'll start almost immediately.
What's "in scope" for a HIPAA external pentest? +
Anything you list with a public IPv4 or IPv6 address — patient portals, scheduling and telehealth apps, APIs, mail, DNS, and your firewalls, VPNs, and remote-access gateways. We strongly recommend including your perimeter and remote-access devices: over the past two years we've seen a sharp uptick in attackers reaching into networks through exactly those devices, and they're a frequent path toward systems that touch ePHI.
Why are you cheaper than a boutique pentest firm? +
Most external network pentests are repeatable, well-defined work. They benefit from a senior tester following a rigorous process. They do not benefit from a sales process, a custom SOW, or a tiered platform. We removed the sales overhead, published the pricing, and pass the savings on. The testing itself is the same quality you'd get at a boutique — just without the procurement drag.
Do I need to schedule a call with sales? +
No. You select your scope from the published pricing table, complete checkout, and we begin. If you have a question that's actually blocking the order, email
hello@pentestexpress.com — but most teams move straight from pricing to purchase.
Can our compliance and procurement teams approve this without a custom SOW? +
Yes — that's the design. Pricing is fixed and published. The standard authorization and rules-of-engagement are in our
Terms of Service. For most healthcare organizations this is short enough that compliance and procurement can clear it in days, not weeks. A Business Associate Agreement can be put in place where the engagement requires one.
What if I need a retest after remediation? +
We retest everything from scratch, not just the listed findings. New issues that surfaced since the original engagement get reported too. Free retest within 14 days of report delivery. From day 15 through day 60, retest is 25% of the original test price. After 60 days, a full re-engagement is recommended because the environment has typically drifted enough that a fresh test is the honest answer.
What happens if you find something critical? +
We notify your designated emergency contact immediately and pause testing if appropriate. We don't bury critical findings until the final report — you'll know about anything urgent in real time, with enough detail to start remediation while testing continues. When ePHI exposure is on the line, that early warning matters.
