PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

HIPAA and Pentesting: What You Need to Know

hackerone.com | blog | #pentesting | #compliance | #regulation | #healthcare | #data-breach | #hipaa | #phi
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Healthcare data is a prime target, with 725 large breaches exposing over 133 million records in 2023. The article explains HIPAA's core rules and how pentesting supports PHI protection and compliance.
Published
Collected

Related coverage

blog · netspi.com
Secure the Silver
X-ray films awaiting disposal are stolen for their silver content, forcing costly breach notifications. The author recommends securing storage rooms or digitizing and safely destroying films.
blog · netspi.com
EMR Security in the Cloud
A NetSPI analysis of HHS breach data argues there is not enough evidence to judge whether moving EMR records to the cloud raises HIPAA risk, noting Business Associates account for ~20% of incidents.
blog · netspi.com
Prioritization for Healthcare Executives
A NetSPI post notes healthcare executives rank HIE and funding above PHI breach concerns, even as OCR enforcement of HIPAA and HITECH topped $5 million in fines that year, urging reprioritization.
blog · netspi.com
HIPAA May not Protect Compulsive Liars
A NetSPI post uses an employee's fake cancer leave to explore PHI leaks via hospital inquiries: confirming whether a patient is admitted, or routing calls, can itself disclose protected information.
blog · netspi.com
Does DLP Help Solve HIPAA Concerns?
A NetSPI post argues DLP works well for structured data like PANs and SSNs but cannot enforce HIPAA compliance, since PHI is too diverse to pattern-match; training and access controls remain key.
blog · netspi.com
Healthcare Organizations and Tighter Security Requirements
Because of increasing threats, high-profile data breaches, and increased awareness of the damage they cause, we anticipate a substantial tightening of regulations and contractual requirements that will significantly impact information security in healthcare.
Back