For HIPAA programs

HIPAA compliance, made boring.

Continuous monitoring for the web surfaces that touch ePHI. Audit-ready exports, evidence for Security Rule safeguards, and production-safe scans you can point at live patient portals.

Get free report See pricing

HIPAA Security Rule

What the rule actually asks of your web tier.

Technical Safeguards

Controls protecting ePHI

Continuous checks for access control, transmission encryption (TLS), and audit logging surfaces on the web tier that handles electronic protected health information.

Patient Portals

Portal & web app security

Targeted scans for patient portals and healthcare web apps. Headers, cookies, auth surfaces, and common web hygiene get checked against the Security Rule expectations.

Breach Notification

Early signal on incidents

Scheduled detection of misconfigurations and exposures that could trigger Breach Notification Rule obligations, so you find them before regulators or patients do.

Pentest evidence

Testing evidence for HIPAA.

The Security Rule asks for a risk analysis (§164.308(a)(1)) and periodic technical evaluation (§164.308(a)(8)). A penetration test of your patient portals is the clearest input to both, and HHS's proposed 2025 update to the rule would make yearly penetration testing explicit. Barrion's AI pentest produces that report. Monitoring watches the §164.312 safeguards between tests.

Report

Mapped to OWASP WSTG

Each AI pentest report comes as PDF, XLSX and JSON with an OWASP WSTG coverage matrix. Your auditor sees what was tested, not only what was found.

Review

A security engineer reviews

From Standard up a security engineer reviews the findings. Deeper tests come with a report signed off by that engineer.

Retest

Free retests show the fix

Retesting the issues a pentest found costs nothing. The evidence then shows the finding and the fix, which is the part auditors ask about next.

Continuous

Testing that keeps running

The pentest reruns on a schedule or on demand. Each run labels earlier findings as new, still open, resolved or regressed.

Findings are checked against your live app before they're reported. Confirmed ones come with the request and response, and unconfirmed ones are kept as lower-confidence leads. The monitoring below is the second layer: it keeps a timestamped record between tests.

See AI pentesting Sample pentest report

How Barrion helps

How Barrion supports HIPAA compliance.

Security Rule

Evidence for the Security Rule

Findings cover the web-tier technical safeguards and carry a CVSS severity you can cite against the Security Rule, so audit prep takes less translation.

Healthcare web

Built for healthcare surfaces

Production-safe passive scans that you can point at patient portals and ePHI-adjacent web apps. Default scans don't submit forms or touch state-changing routes.

Audit exports

Audit-ready reports

One-click PDF and CSV exports built as evidence for your auditor. Scan history sticks around as evidence of continuous monitoring.

Always-on evidence

Continuous, not one-off

Weekly or daily cadence depending on plan. You get a trail of scans across time, not a single point-in-time report that's stale the day after you signed it.

How it runs

Evidence, on a cadence auditors recognise.

HIPAA audits aren't looking for a single hero report. They want to see that controls are operating over time, that someone is watching the web surfaces handling ePHI, and that issues get caught and closed. Barrion is built around that cadence.

Every scan produces a dated PDF and CSV export you can cite against the relevant Security Rule safeguards. Findings carry remediation steps your engineers can act on without translation, and the scan history sticks around as continuous evidence you can hand to an auditor or to a customer running a vendor review.

✓Production-safe passive scans you can point at live patient portals
✓Evidence for HIPAA Security Rule technical safeguards
✓Weekly or daily scans, depending on plan, with full history
✓PDF and CSV exports built as evidence for auditors and customer security teams
✓Plain-language remediation steps for each finding

Evidence example

A Security Rule mapping, from a single scan.

How Barrion's checks line up with HIPAA Security Rule controls. Exports don't carry control tags (pentest reports list CWE, OWASP WSTG and CVSS per finding), so use this as a guide when you cite the evidence:

{
  "portal_access_control": "164.312(a)(1)",
  "audit_logging_surface": "164.312(b)",
  "ephi_integrity_headers": "164.312(c)(1)",
  "session_authentication": "164.312(d)",
  "tls_transmission_security": "164.312(e)(1)",
  "encryption_in_transit": "164.312(e)(2)(ii)"
}

FAQ

HIPAA on Barrion, answered.

Do we need a penetration test for HIPAA?

The current Security Rule doesn't name one, but the risk analysis in §164.308(a)(1) and the evaluation in §164.308(a)(8) are hard to support without testing, and HHS's proposed 2025 update would require yearly penetration testing. Barrion's AI pentest tests patient portals and ePHI-handling apps the way an attacker would, safely. You get a WSTG-mapped report, reviewed by a security engineer from Standard up, and free retests of what you fix.

Does Barrion cover the full HIPAA Security Rule?

Barrion covers the technical safeguards that live on your web tier: TLS and transport security, security headers, cookie flags, CORS, DNS and email auth on patient portals and ePHI-handling web apps, plus AI pentest findings when you run one. It does not replace your administrative and physical safeguards, BAAs, or workforce training. Healthcare teams can use Barrion as the continuous evidence layer for §164.312 controls and pair it with a GRC tool for the rest.

Will the reports hold up in a HIPAA audit?

They produce evidence that supports it. Exports include the scan timestamp, scope, finding severity and remediation status. Auditors look for evidence that controls keep operating, and a date-stamped trail of scans shows that. Whether it's enough for a given safeguard is your auditor's call.

How often does monitoring actually run?

Cadence depends on plan. Essential runs weekly, Business runs daily, and you can trigger ad-hoc rescans whenever you ship a meaningful change. Each scan is treated as fresh evidence with its own export, so you can show an auditor the progression rather than a single snapshot.

Is it safe to run this against production patient portals?

Yes. Default scans are read-only: they don't submit forms, don't touch state-changing routes, and don't attempt to authenticate as a patient. That's specifically so healthcare teams can monitor live ePHI-handling surfaces without risking a real breach during the assessment. Active testing is a separate AI pentest that you start yourself and pay for in credits.

Recommended tools for HIPAA

Tools that cover ePHI web surfaces.

Compliance

Start your HIPAA evidence trail.

Run an AI pentest on the app that handles ePHI and keep the report for your Security Rule evidence. Or start with a free passive scan.

Start an AI pentest Run a free passive scan