Healthcare testing, NIS2, GDPR and HIPAA

Applicability comes before the label

Healthcare security requirements depend on entity, location and processing. For EU organisations, assess NIS2 scope and national implementation alongside GDPR security obligations. For US covered entities and business associates, consider HIPAA separately. A pentest contributes technical evidence; it does not determine legal applicability or certify compliance.

Record the legal entity, services, jurisdictions, data categories and contractual commitments. Confirm the current official text and authority guidance with the responsible legal or compliance team. The same technology may support organisations with different obligations.

What a technical test can contribute

Scoped observations can support security-risk decisions and demonstrate whether selected controls work as expected. Evidence needs dates, systems, identities and limitations. A finding register helps connect remediation to accountable owners; it does not assess every governance, contractual or organisational duty.

Use the relevant primary sources

• NIS2 Directive (EU) 2022/2555
• GDPR: Regulation (EU) 2016/679
• HHS: HIPAA Security Rule and guidance
• European healthcare cybersecurity action plan
• OWASP API Security Top 10
• NIST SP 800-115: security testing and assessment

NIS2 national implementation and entity scope require jurisdiction-specific review. GDPR security measures are risk-based. HIPAA is a separate US framework for covered entities and business associates; proposed changes should not be treated as current requirements.

Keep assurance boundaries explicit

Report what was tested, what was not tested and what relied on a supplied starting point. If authority coordination, an independent assessment or a formal attestation is required, treat it as its own process. The sample report is educational evidence of format, not evidence that a real organisation complies.