Risk assessment vs penetration test
A HIPAA risk assessment is a guided review of how your practice identifies, documents, and manages security and privacy risk. A penetration test is a controlled attempt to find and exploit technical weaknesses in specific systems.
Two different questions
Our typical single-site HIPAA / 360 Risk Assessment is a fixed fee, scoped on a short call. Penetration testing is a separate engagement when you need it.
Many practices need a current risk assessment first, then decide whether a penetration test is useful.
We lead with assessment and annual program work. We explain the difference so you do not buy the wrong tool for the question you are answering.
Last updated September 7, 2026
What each one answers
Risk assessment answers
- Where are our meaningful risks across people, process, technology, and vendors?
- Do we have a current, defensible security risk analysis and a prioritized roadmap?
- What should leadership, our broker, or an auditor see when they ask for evidence of a risk analysis?
Penetration test answers
- Can a skilled tester break into or move through defined systems under agreed rules?
- Which technical findings are real today in that scoped environment?
- What should engineering or IT patch or redesign based on exploit evidence?
They are complementary. They are not substitutes.
When a practice usually needs which
- 1
Start with a risk assessment
If your analysis is missing, outdated, thin, or written only for a checkbox. Insurance renewals, OCR or auditor letters, and hospital or payer questionnaires often ask for a risk analysis, not a penetration test report.
- 2
Add a penetration test
When leadership, a customer, or a contract specifically requires one, or when the assessment roadmap shows technical validation would help prioritize fixes.
- 3
Do not assume a penetration test equals HIPAA compliance
A penetration test can inform risk. It does not replace a full risk analysis or ongoing governance.
Our two offers are the assessment and the Annual Security Program. Penetration tests and other catalog items are scoped separately when they are the right fit.
What each engagement runs
If a vendor sells you only a scan and calls it a HIPAA risk assessment, ask what risk analysis, documentation, and prioritization you actually receive.
Common questions
Will a penetration test satisfy our HIPAA risk analysis requirement?
Usually no by itself. HIPAA expects an accurate and thorough assessment of potential risks and vulnerabilities to ePHI. A penetration test may contribute technical findings. It does not automatically produce a complete risk analysis for the practice.
Can Harborline do both?
Our published lead offers are the flat-fee assessment and the Annual Security Program. Penetration testing can be discussed as separately scoped work when it is needed. The free scoping call is the place to sort order of operations.
Our MSP already runs vulnerability scans. Is that enough?
Scans and assessments are different. Scans list technical issues. A Harborline risk assessment produces an analysis led by a former healthcare CISO and a plain-English roadmap for the practice as a whole. Many practices use both: the MSP for day-to-day technology, Harborline for the risk analysis and annual rhythm.
Which one do cyber insurers ask for?
Carriers and brokers often ask for evidence of a risk analysis, MFA, EDR, backups, and documented plans. Some questionnaires also ask about penetration testing. Bring your renewal questions to the scoping call and we will map them to the right work.
How fast is the Harborline assessment?
Typical single-site delivery is 2 to 4 weeks after kickoff, depending on access to people and documents.
What should we book if we are unsure?
Book the scoping call. We will not pitch a penetration test if you need a risk assessment, and we will not pretend an assessment replaces a penetration test when a contract requires one.
Related pages
How much does a HIPAA risk assessment cost?
How the fixed fee is set, what affects the scope, and what you get in 2 to 4 weeks.
One-time assessment vs Annual Security Program
Report now, or a light year of continuity, fixed fee, scoped on a short call.
HIPAA risk assessment cost and requirements
What the Security Rule asks for and how the analysis is built.
HIPAA Security Rule risk assessment
Deliverables, timing, and how the engagement runs.
About Harborline
Led by senior healthcare security practitioners with former CISO experience.
Questions? Use our contact form.
Sort the order of operations
A 30-minute scoping call covers your setup, your deadlines, and what a fixed-fee engagement would look like.