HIPAA Vulnerability Scanning Requirements

Vulnerability scanning for HIPAA

The HIPAA Security Rule requires a risk analysis and ongoing evaluation of the systems that hold electronic protected health information. Regulators and auditors treat regular vulnerability scanning as the practical way to meet that, and a proposed update to the rule would make scanning every six months an explicit requirement. This page explains the expectation today, what is coming, and how to get scanning running this week.

What HIPAA actually says

The Security Rule's administrative safeguards at 45 CFR 164.308 require a risk analysis, risk management, and periodic technical evaluation of security controls. The Department of Health and Human Services has long said that identifying technical vulnerabilities is part of a proper risk analysis. The proposed Security Rule update published in January 2025 would add an explicit requirement for vulnerability scanning at least every six months and penetration testing at least every twelve months. Covered entities and business associates that already scan on a schedule will have little to change.

What your auditor needs to see

A dated risk analysis that references scan results.
Scans of every system that stores, processes or transmits ePHI, internal and external.
Findings rated by severity with remediation dates.
Evidence that critical findings were fixed and rescanned.
A written cadence, at least twice a year and ideally monthly.

Getting it done this week

Clone Systems internal vulnerability scanning covers the servers, workstations and clinical systems that hold ePHI and is ready the moment you check out. Internal scanning is $1,095 a year for 128 IPs, $1,495 for 512, $2,295 for 2,048. Add external vulnerability scanning for your internet-facing systems such as patient portals and VPNs. External scanning is $595 a year for 10 IPs, $2,495 for 50, $5,985 for 150. Every package includes free rescans, and reports export mapped to HIPAA from the portal.

Why Clone Systems

PCI Approved Scanning Vendor since 2007, the same scanning engine tested every year under the PCI Council's ASV program, published prices, buy online. Switching from another scanner? See how it works.

Buy vulnerability scanning · Talk to our scanning team

Clone Systems is a PCI Security Standards Council Approved Scanning Vendor, listed since 2007. This page is general guidance, not legal or audit advice.