We prove HIPAA by breaking it.
AI-native penetration testing for healthcare — with every finding mapped to a specific 45 CFR Part 164 citation. 100% on the XBOW public benchmark. 463 proven attack patterns. Built for the compliance officer, the CISO, and the OCR investigator that never calls.
Mutual NDA signed before discovery · BAA available on request · Fixed-fee SOW
Cross-tenant read access to 152 organization records via mobile app Firebase backend
Android APK embeds Firebase config. Any anonymous authenticated user could read organization records including tax identifiers and write new documents to production.
Built for procurement, auditors, and OCR
Every finding speaks the Security Rule.
Our scan engine runs in parallel across recon, auth, access control, injection, audit, and BAA-scope stages. Every finding it emits carries a 45 CFR § citation and a Breach Notification Rule impact flag. This is a real trace, redacted.
A generic pentest won’t hold up in an OCR investigation.
OCR’s enforcement record is consistent: the violations that trigger resolution agreements are almost always Security Rule failures — insufficient risk analysis, inadequate audit controls, missing BAAs, and unpatched technical safeguards. We built HIPAA Shield to surface exactly those.
PHI-pattern aware scanning
The scan engine recognizes PHI patterns — MRN formats, DOB + name + diagnosis, HL7 v2 fields, FHIR Patient resources — and flags every place they can leak, not just generic SQLi or XSS.
Mapped to 45 CFR Part 164
Every finding cites a specific Security Rule standard. Reports are written to satisfy OCR evidence requirements, SOC 2 CC-series controls, and HITRUST CSF simultaneously.
BAA-ready evidence packs
Our deliverables are the format hospital procurement, payer VMS, and state HIE oversight teams actually accept — third-party attestation letter included.
The numbers are in Supabase.
Three pillars. 122 individual checks. One Security Rule.
Our scan engine exercises every subsection of the HIPAA Security Rule that is technically testable from a live environment. Controls that are procedural — like workforce training — are assessed via evidence review in the Administrative tier.
Administrative Safeguards
Risk analysis, workforce access management, security incident procedures, contingency planning, and evaluation.
Physical Safeguards
Facility access controls, workstation use and security, device and media controls — including disposal and re-use.
Technical Safeguards
Access control, audit controls, integrity, person-or-entity authentication, and transmission security. The section where most findings live.
The patterns that actually show up in healthcare SaaS.
We seeded our attack brain with healthcare-specific patterns: PHI detectors, FHIR misconfigurations, patient portal IDOR templates, BAA scope checks, and the mobile-app-backend asymmetries that let external attackers walk through the front door.
PHI exposure in mobile & web backends
Firebase, Supabase, DynamoDB, and S3 misconfigurations that expose patient records, payouts, EOBs, and lab results to unauthenticated or cross-tenant access.
Patient portal IDOR & cross-patient access
Horizontal privilege escalation where one patient can read another's encounters, messages, or prescriptions by changing a numeric ID.
Audit log gaps (Security Rule §164.312(b))
Missing or tamperable audit trails on ePHI access. OCR cites this in nearly every HIPAA enforcement action.
HL7 / FHIR endpoint misconfiguration
Unauthenticated FHIR R4 endpoints, overly permissive SMART on FHIR scopes, and HL7 v2 listeners exposed to the public internet.
Telehealth session & recording leakage
Twilio/Vonage/Zoom For Healthcare misconfigurations, unindexed recording buckets, WebRTC TURN misconfiguration leaking participant IPs.
BAA scope gaps & sub-processor leaks
ePHI flowing to sub-processors without executed BAAs — analytics, error tracking, LLM APIs, and marketing pixels are the usual suspects.
Where PHI flows. Where it leaks. Which § governs each step.
Every healthcare application pushes patient data across the same six-layer topology. Our scan engine probes each node and maps the finding to the Security Rule section that owns it. This is the signature — no other HIPAA vendor, and no generic pentest firm, produces this map.
“A generic pentest produces CVSS scores. OCR calls those audit findings. HIPAA Shield produces both.”
Four paths, priced for healthcare procurement.
Every engagement is scoped on a discovery call and priced against a fixed SOW — no hourly rates, no surprise add-ons.
HIPAA Security Risk Assessment
The formal Risk Analysis that the Security Rule requires every covered entity and business associate to conduct. Scoped, documented, and defensible.
- Asset & ePHI flow inventory
- Threat and vulnerability assessment
- Likelihood and impact rating
- Remediation roadmap + evidence pack
Annual HIPAA Pentest
External + authenticated testing against the production environment. Evidence-grade report suitable for auditors, BAA counterparties, and the board.
- 10-agent AI swarm + human reviewer
- Authenticated multi-role testing
- Every finding mapped to a Security Rule citation
- Retest included for remediated findings
Continuous Monitoring
Monthly scans, quarterly reports, and an incident response retainer. Designed for covered entities and BAs with active PHI workflows and frequent change.
- 12 scheduled scans per year
- Quarterly executive briefings
- Incident response retainer (8hr SLA)
- Slack/Teams integration for findings
BAA-Ready Assessment
Formal assessment for Business Associates who need to satisfy covered entity diligence — including enterprise health systems, payers, and MSOs.
- Covered entity-facing evidence pack
- Third-party attestation letter
- Compliance gap remediation plan
- Optional HITRUST readiness add-on
463 proven attack patterns. Healthcare-hardened.
HIPAA Shield shares the same compound-learning scan engine that powers VibeArmor, our SaaS security product. That engine scored 100% on the public XBOW benchmark — the only public measurement of AI pentesting capability today.
For HIPAA Shield, the brain is layered with healthcare-specific beliefs: PHI detection patterns, FHIR/HL7 misconfiguration templates, patient portal IDOR sequences, and BAA scope gap checks. Every engagement adds new beliefs that compound across the practice.
- Total proven patterns
- 463
- XBOW benchmark score
- 100%
- Attack agent specialists
- 10
- Healthcare-specific beliefs
- 12+
- Framework coverage
- FHIR / HL7 / Epic / Cerner
Three readers. One deliverable each gets exactly what they need.
The same engagement produces three audience-tuned outputs. Your CCO gets the Risk Analysis artifact. Your CISO gets the technical remediation roadmap. Your BAA counterparty gets the attestation letter. One scan, three procurement conversations closed.
Chief Compliance Officer
The buyer who gets the OCR letter
Needs audit-defensible evidence that satisfies § 164.308(a)(1)(ii)(A) Risk Analysis.
- Formal Risk Analysis document
- Every finding mapped to a CFR §
- Breach Notification Rule impact
- Third-party attestation letter
CISO / VP of Security
The buyer who gets the exploit
Needs to see the actual vulnerabilities and remediation guidance engineering can ship.
- CVSS 4.0 + CWE mapping per finding
- Reproduction steps & curl receipts
- Prioritized remediation roadmap
- Retest on remediated findings
Hospital Procurement / BAA counterparty
The buyer who signs your BAA
Needs third-party evidence before executing a Business Associate Agreement.
- BAA-ready evidence pack
- Sub-processor + BAA map
- Policy evidence review
- Up to 10h procurement support
Questions healthcare buyers actually ask.
Is this a HIPAA Security Risk Assessment or a penetration test?
Do you sign a Business Associate Agreement?
What states' privacy laws do you cover?
How do you avoid touching real PHI during testing?
Can you produce evidence a hospital procurement team will accept?
How is this different from a generic SaaS pentest?
A single PHI breach averages $10.93M.
Find them first.
Schedule a 30-minute scoping call. We’ll map your architecture to the Security Rule, identify which tier makes sense for your footprint, and provide a fixed-fee SOW within 48 hours.
Mutual NDA signed before discovery • BAA available on request • Fixed-fee SOW