Healthcare security

HIPAA-aligned pentesting for the apps that touch patient data.

AI pentests of patient portals, telehealth platforms and clinician tools, continuously or on demand. Passive monitoring watches for configuration drift in between, with evidence that supports the HIPAA Technical Safeguards.

The healthcare reality

The constraints every healthcare team works under.

PHI

Patient data protection

Patient portals, telehealth platforms, and clinician tools handle PHI across the public surface. A single misconfigured header or DNS record can expose enough metadata to trigger an OCR investigation.
HIPAA

Continuous compliance evidence

HIPAA Technical Safeguards (§164.312) expect ongoing transmission security, audit controls, and integrity monitoring. One-off scans before a deadline don't satisfy auditors looking for a record of continuous coverage.
Uptime

Care continuity

Security testing has to be production-safe. Healthcare apps can't tolerate disruptive probes, mid-procedure outages, or data mutation. Barrion's passive checks are read-only, and its AI pentests are non-destructive and rate-limited.
AI pentesting

Test what a scan can't see.

The HIPAA Security Rule asks you to assess the risks to PHI, and a passive scan only covers the configuration side of that. Whether one patient can open another patient's records through your API is an access-control question, and only an active test answers it. Barrion's AI pentests test your patient portal and APIs the way an attacker would, looking for broken access control, IDOR and injection. They're non-destructive and scoped with you before any traffic is sent, and findings are checked against your live app before they're reported.

The pentest can rerun on a schedule or on demand. From Standard up a security engineer reviews the findings. More on AI pentesting and continuous pentesting.

Between pentests

Passive monitoring for PHI-handling surfaces.

Coverage

HIPAA-aligned web checks

Passive checks for TLS, security headers, cookies, CORS, DNS, email auth and more (35+ on paid plans), with evidence for §164.312 (a)(1) Access Control, (c)(1) Integrity, (e)(1) Transmission Security.
Evidence

Timestamped PDF and CSV exports

Every passive scan produces a timestamped report with severity-ranked findings and remediation status. Hand it to your auditor or attach it to an OCR response without scrambling.
Alerts

Drift detection

Scheduled monitoring catches it when a TLS cert expires, a header is dropped, or a third-party patient-portal vendor pushes a regression. Alerts route to Slack, Teams, or email.
Safe

Production-safe by default

Passive scans never submit forms, never log in, and never alter data. Safe to run against patient-facing production.
FAQ

Healthcare security, answered.

Do we need to sign a BAA to use Barrion?
Passive scans only read what your site already exposes publicly (TLS, headers, cookies, CORS, DNS and email authentication) and don't handle, store or transmit PHI. For an AI pentest with credentials, use test accounts with synthetic data, and talk to us before the run if the endpoints in scope handle PHI.
How does this fit with our 42 CFR Part 2 or HITECH obligations?
Barrion provides continuous evidence on the technical safeguards layer of your web tier, which is one piece of the broader HITECH and 42 CFR Part 2 picture. Date-stamped scan exports give evidence for HIPAA Security Rule safeguards and can be attached to your compliance evidence package. They do not replace the administrative, physical, or workforce-training controls those frameworks also require. Most healthcare teams pair Barrion with a GRC tool for the non-technical surface.
Can Barrion scan our FHIR or HL7 endpoints?
Yes for the HTTP transport layer: Barrion will check TLS, security headers, authentication surfaces, CORS, and other web-tier hygiene on FHIR REST endpoints. It does not parse FHIR resources or HL7 message payloads, we observe transport and headers, not the clinical data inside the response.
What about telehealth video endpoints?
We monitor the signalling and HTTP control surface around telehealth platforms, the web app, auth endpoints, session setup APIs, and TURN/STUN signalling endpoints exposed over HTTPS. We do not probe WebRTC media streams or attempt to join live calls. Media-plane testing belongs to specialised tooling, not a production-safe DAST.

Scope testing for your patient-facing apps.

Tell us which apps handle ePHI and how often you ship, and we'll scope AI pentesting that keeps your HIPAA evidence current.

Book a scoping callHIPAA monitoring details

A scan shows the surface. A pentest tests what gets in.

Passive scan

  • Reads what your app already exposes
  • Never logs in or submits a form
  • Cannot confirm what is exploitable

Active AI pentest

  • Tests your app the way an attacker would
  • Chains requests to confirm real exploits
  • Replays findings against your live app
  • Runs on a schedule or on demand, retests free

Probes for

  • SQL injection
  • Broken access control
  • IDOR
  • SSRF
  • Business-logic abuse

How AI pentesting works

Paid in credits. Free retests of found issues, and expert review from Standard up.