Penetration testing for healthcare is a controlled attempt to break into the systems that hold patient data, using the same tools and techniques a real attacker would. The aim is to find weaknesses before someone else does, then give you a ranked list of fixes. For GP surgeries, clinics, care providers and the companies that supply them, it is one of the few checks that shows how your defences hold up under pressure.
This guide explains what a test covers, why healthcare organisations are asked to do one, and how to get a useful result. It is written for practice managers, IT leads and directors, not specialists.
Table of Contents
Why does healthcare need penetration testing?
Health and care organisations hold some of the most sensitive records there are. A stolen patient file is hard to replace and easy to misuse. The systems around it are also busy and varied. Clinical software, medical devices, booking portals and staff laptops all connect, often through years of patches and workarounds.
The law adds its own pressure. Article 32 of the UK GDPR requires “appropriate technical and organisational measures” to keep personal data secure. The Information Commissioner’s Office says that includes a process for regularly testing and evaluating how well those measures work. It names vulnerability scanning and penetration testing as ways to do that. It does not set a fixed schedule, so you have to decide what is reasonable for your size and risk.
Breach reporting makes the stakes plain. If a breach puts people at risk, you must tell the ICO within 72 hours of becoming aware of it, according to the ICO’s guide to personal data breaches. Finding a hole yourself costs far less than explaining one to a regulator.
What does a healthcare penetration test actually involve?
The National Cyber Security Centre describes penetration testing as a method for gaining assurance in the security of an IT system. Testers try to get in, then report what they managed to reach and how. The NCSC compares it to an outside audit of your own checks.
In practice, penetration testing for healthcare usually includes some mix of these parts:
- External network test: probes everything reachable from the internet, such as remote access gateways, email servers and patient portals.
- Internal network test: starts from inside, as if a laptop were already infected, and checks how far an intruder could move.
- Web application test: examines booking systems, patient apps and clinician dashboards for flaws in login, access control and data handling.
- Wi-Fi and device checks: look at guest networks, staff wireless and connected equipment where it is safe to do so.
- Social engineering: sends realistic phishing messages to see whether staff spot them.
Our penetration testing service can be scoped around any of these, depending on what you run.
How is it different from a vulnerability scan?
A scan is automated. It matches your systems against a list of known flaws and produces a long report. A penetration test adds a person who chains weaknesses together, tries them in practice and judges which ones matter. The NCSC says testing should support your vulnerability management, not replace it. You need both, run at different rhythms: scans often, tests at set points.
Is penetration testing mandatory for NHS suppliers?
It depends on who you are, and on what kind of penetration testing for healthcare your contracts call for. The Data Security and Protection Toolkit (DSPT) is the self-assessment that organisations use to show they handle NHS patient data safely. According to NHS England’s DSPT audit page, one mandatory evidence item for the independent audit is assertion 9.2: “A penetration test has been scoped and undertaken”. That audit applies to IT suppliers and independent providers designated as operators of essential services.
If you sit outside that group, the toolkit may not demand a test by name. Contracts, commissioners and insurers often ask for one anyway. We cover the supplier side in more detail in our guide to NHS DSPT penetration testing, and in a separate piece on what evidence auditors expect to see.
Whatever your status, check the current toolkit wording for your organisation type. Assertion numbers and scope change between versions.
How do you scope a test for a clinical environment?
Scoping decides whether penetration testing for healthcare is useful or merely busy. The NCSC advises involving risk owners, technical staff and someone from the test team. Share your latest vulnerability assessment so the testers can judge how complete it is. The result should be a plan that sets technical boundaries, test types, timeframes, effort and reporting needs.
Healthcare adds a few questions of its own:
- Which systems are too fragile to test live, such as older medical equipment or clinical systems with no test copy?
- When can testing run without affecting appointments or on-call services?
- Who should the testers call if something stops working?
- Which environments hold real patient data, and how will the testers handle anything they see?
Agree the answers in writing before work starts. A good tester will raise these points without being asked.
What should you look for in a testing provider?
Quality depends heavily on the people doing the work, so choosing who carries out penetration testing for healthcare matters. The NCSC says testers must be qualified and experienced, and it recommends CHECK-scheme testers and companies for central government bodies. For healthcare, ask the following:
- Can they show recent work on clinical or regulated environments?
- Will named, qualified individuals do the testing, or will juniors do it unsupervised?
- Do they agree a safe approach for fragile systems?
- Will the report suit your auditor as well as your engineers?
Do not pick on price alone. A cheap test that is really a scan with a cover page will not satisfy an auditor, and it will not find the problems that matter.
What happens after the test?
The report is where the value sits. The NCSC says a good one covers the issues found, their risk levels, how to resolve them, and an opinion on your own vulnerability assessment. Each finding should be rated high, medium, low or informational, so you know where to start.
The NCSC is also blunt about responsibility: risk assessment and decisions on fixes remain yours. Work through the high-rated items first, record what you fixed and what you accepted, and keep that record. A retest of the fixed issues then confirms that the repairs worked. Without it, you only know the problems were reported, not removed.
One test is a snapshot
The NCSC warns that a test shows only that systems resisted known issues on the day. Gaps of a year or more between tests are common, so it should not be your only check. New software, a new supplier or a major change to your network is a good reason to test again sooner. Our article on penetration test frequency explains how to decide.
Frequently asked questions
How long does a healthcare penetration test take?
It depends on scope. The NCSC says effort is usually planned in resource days, so a single web application takes far less time than a multi-site network. Your provider should give you a figure once the scope is agreed.
Will testing disrupt patient services?
It should not. Testers agree boundaries and timings beforehand, and risky actions against fragile systems are discussed first or left out.
Do small practices need one?
Article 32 applies to organisations of every size, and the ICO expects testing that suits your risk. A small practice may need a narrower test than a hospital supplier, but it still holds patient data.
Who sees the report?
Treat it as confidential, because it maps your weak points. Share it only with people who need it, such as your IT team, your board and your auditor.
What if we only want to tick a compliance box?
A test done only for the paperwork tends to be shallow and soon forgotten. Aim for one you would still value if nobody asked for the certificate.
Getting expert help
If you want a test scoped around your own clinical systems, get in touch with Aardwolf Security and we will talk through what makes sense. Even if you never do, the questions above should help you judge any quote you receive.
Subscribe to our newsletter
Honest updates, straight to your inbox. Unsubscribe any time.
