Start with a vulnerability scan. A scan is automated and tells you which known flaws sit on your computers and network. A penetration test is a person trying to break in, with your written permission, to prove which of those flaws can actually be used. Most small practices need the scan first and the pen test later.
They are not competing products. One finds the problems. The other shows you how bad they are. This article covers what each one is, what you get at the end, what it asks of your office, and how to choose.
Vulnerability Scan vs Penetration Test: What Each One Is
A vulnerability scan is software that checks your systems against public lists of known security flaws. It looks for missing updates, software too old to get fixes, open network doors (ports), and weak settings.
A scan does not try to break in. It reports what it sees, ranks it by severity, and stops.
Two choices change what a scan can see:
- External or internal. An external scan looks at your office from the internet, the way an attacker would first see it: your router, website, patient portal and remote access. An internal scan runs inside your network and sees the computers at the front desk and in the exam rooms.
- Unauthenticated or authenticated. An unauthenticated scan looks from the outside of each machine. An authenticated scan logs in (or runs a small agent on the computer) and reads exactly what is installed. Authenticated scans find far more, because they do not have to guess.
What a Penetration Test Is
A penetration test, or pen test, is a qualified person using real attack techniques against your systems, with permission, inside agreed limits. The tester takes what a scan would find and asks the next question: can I actually use this to get in, and how far can I get once I am in.
NIST's Technical Guide to Information Security Testing and Assessment (SP 800-115) describes the standard phases: planning, discovery, attack, and reporting. A good tester follows something close to it and tells you which method they use.
A scan says "this door has a weak lock." A pen test says "I opened it, walked to the server, and here is what I could read."
What You Get at the End
From a scan: a list of findings, each with a severity score, the affected computer or device, and usually a fix (update this program, close this port, change this setting). It is a to-do list. Its value depends entirely on whether someone works through it.
From a pen test: a written report that tells a story. How the tester got in, which weaknesses they chained together, what data or systems they reached, and what to fix to break that chain. A good report has a short summary for the owner and a technical section for whoever does the fixing.
Both belong in your records. Both feed your security risk assessment, and what you fix afterward belongs in a remediation plan.
What Each One Asks of Your Office
A scan asks for very little. Someone sets it up, it runs, and a report comes back. Most scans of a small office finish in minutes to hours. Your staff keeps working.
A pen test asks for more. Expect:
- A scoping call to agree on what is in bounds: which addresses, which computers, which buildings, which techniques are allowed (for example, whether phishing your staff is in scope).
- A signed authorization before any testing starts. Testing someone's systems without written permission can be a crime. The authorization names the systems, the dates and times, and who to call if something goes wrong. This is often called the rules of engagement.
- A testing window chosen around patient hours. Active testing can slow a network or knock over a fragile device. Schedule it when a crash would not stop check-in or e-prescribing.
- Backups first. Confirm you have a recent, tested backup before testing starts. A careful tester will ask. If they do not, you ask.
- Report time afterward, and a follow-up conversation to walk through it.
What HIPAA Says, Briefly
Today's Security Rule names neither scans nor pen tests. It does require an accurate and thorough assessment of risks and vulnerabilities to ePHI, and both kinds of testing are evidence for that. A 2025 proposed rule would require scans at least every six months and a pen test at least every 12 months. It is proposed, not final; HHS's target for a final rule is July 2027. The full breakdown, with the regulation quoted, is in Does HIPAA Require Vulnerability Scanning.
On who may do the pen test, the proposed rule says it must be "by a qualified person," and defines that as "a person with appropriate knowledge of and experience with generally accepted cybersecurity principles and methods for ensuring the confidentiality, integrity, and availability of electronic protected health information." It names no specific certification, degree or license.
Which One a Small Practice Should Do
Do a scan first if:
- You have never had one
- You are not sure every computer is getting updates
- You have no IT person, or your IT person has never shown you a report
There is no point paying someone to break in through flaws a scan would have listed for a fraction of the effort. Fix the scan findings, then think about a pen test.
Add a pen test when:
- Your scans come back mostly clean and you want to know what a determined attacker could still do
- You have internet-facing systems that matter: a patient portal, remote access for staff, a self-hosted server
- A payer, partner or cyber insurance application asks for one
- You have had a big change: a new office network, a new server, a merger of two practices
Keep scanning after a pen test. A pen test is a snapshot of one week. New flaws are published every day. The scan is what catches the ones that appear next month.
Questions to Ask a Pen Tester
- What method do you follow, and can I see a sample report with the client details removed?
- Who exactly will do the testing, and what is their experience with healthcare offices?
- What is in scope and out of scope, and is that written into the authorization?
- What will you do if you find patient data or cause an outage during testing?
- Will you or your tools be able to see ePHI? If yes, we need a business associate agreement before you start.
- Does the price include a retest after we fix what you find?
Question 5 matters more than it looks. A tester who reaches your EHR or file server can see patient records. That access is the point of the test, and it is also why the paperwork has to be right. Track the vendor in your vendor management records like any other.
Where One Guy Consulting Fits
We do not sell penetration tests. If you need one, use the questions above to choose a tester.
What we do offer is a way to see what a scan finds before you commit to anything. Our sample vulnerability scan checks one office computer for $59. A small report-only program lists the installed software, we check every program against published flaws, and you get a plain-English report within one business day. It never touches documents, email or patient records, and it removes itself after 3 days.
FAQ
What is the difference between a vulnerability scan and a penetration test?
A vulnerability scan is automated software that lists known flaws on your computers and network. A penetration test is a qualified person using real attack techniques, with written permission, to prove which of those flaws can actually be used and how far an attacker could get.
Should a small practice do a scan or a pen test first?
A scan first. It finds the known flaws for far less time and effort. Fix those, then consider a pen test, especially if you have a patient portal, remote access or a self-hosted server facing the internet.
Does HIPAA require a penetration test?
Not today. The current Security Rule does not mention one. A 2025 proposed rule would require a pen test at least every 12 months by a qualified person. It is proposed, not final, and HHS's target date is July 2027.
Can a penetration test disrupt my office?
It can. Active testing can slow a network or crash a fragile device. Schedule testing outside patient hours, confirm a recent tested backup first, and make sure the signed authorization names who to call if something goes wrong.
Does a penetration tester need a business associate agreement?
If the tester or their tools can create, receive, maintain or transmit ePHI, treat them as a business associate and sign a BAA before testing starts. A tester who reaches your EHR or file server can see patient records.
Conclusion
A vulnerability scan and a penetration test answer different questions. The scan tells you what is out of date; the pen test tells you what an attacker could actually do with it. For most small practices the order is a scan first, fixes second, and a pen test once the basics are in place.
Want help putting this in place? The Full-Scope plan from One Guy Consulting pairs the compliance software with 4 hours a month of 1:1 implementation calls with Chuck Weiselberg, C.H.P., with no per-user fees. Book a free 30-minute intro call. No obligation, no pressure.
Sources
- NIST SP 800-115, Technical Guide to Information Security Testing and Assessment
- CISA Known Exploited Vulnerabilities Catalog
- CISA Cyber Hygiene Services
- HHS, HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, proposed rule, 90 FR 898 (Federal Register, Jan 6, 2025)
Related Reading