Proposed HIPAA Update Makes Yearly Pen Testing Mandatory

In January of this year, significant changes to the HIPAA Security Rule were proposed by the Office of Civil Rights for the Department of Health and Human Services (OCR). The proposed update to the HIPAA Security Rule, published on January 6, 2025, introduces a significant new requirement: all covered entities and business associates must conduct penetration testing of their electronic information systems at least once every 12 months. This new pen testing requirement is in addition to over a dozen other proposed changes to healthcare cybersecurity as outlined in the HIPAA Security Rule…