WORKING RESOURCE / SCOPE & PROCUREMENT

Build a healthcare pentest scoping brief

Describe the care service and information boundary you want to assess. Separate patient-facing access, clinical roles and supplier integrations so the test can answer a clear question.

Define the objective.
Set the boundaries.
Leave with a working brief.

No signup required
Copy, download or print
Your draft stays in this page

Keep it high level. Do not enter patient information, identifiable clinical records or production credentials. Scope and safety controls must be agreed before testing.

Your choices are processed in your browser. They are not sent, saved in browser storage or shared with AI. Copy or download your brief before leaving.

01 The decision you need

Assessment objective

Service setting

Use synthetic records and agree which clinical actions must never be triggered. A working test account alone does not authorise testing a connected provider.

02 The assessment boundary

Choose the areas you want to discuss. Final coverage is agreed during scoping.

Patient portals and mobile accessClinical applications and EHR/EMR rolesHealth-data APIs and integrationsIdentity, networks and supplier accessBackup and recovery management boundaries

Proposed environment

Operating constraints (optional)

For example: synthetic records only, no clinical messaging, vendor approval pending or restricted service windows.

03 Timing and permissions

Indicative timing

Supplier permissions

NDA preference

YOUR WORKING BRIEF

Ready for a better
scoping conversation.

0 of 7 planning points captured

Review and copy your draft

Healthcare penetration testing — initial scoping brief
DRAFT FOR DISCUSSION · not authorisation to test

Assessment objective: To be agreed
Primary context: To be agreed
Environment: To be agreed
Indicative timing: To be agreed
Supplier permissions: To be agreed
NDA preference: To be agreed
Assessment areas: To be agreed
Operating constraints: To be discussed

Questions to resolve:
- Assessment areas
- Assessment objective
- Primary context
- Environment
- Indicative timing
- Supplier permissions
- NDA preference

Next step: agree scope, named owners, safeguards, deliverables and commercial terms.
Do not include credentials, patient/customer records or confidential technical evidence.

Copy the brief into your enquiry message, or email it to sales@healthcarepentest.com. Nothing is sent automatically.

WHAT TO INCLUDE / Healthcare penetration testing

Scope choices that change the test.

Assessment area	What to describe	What useful evidence answers
Patient-facing services	Identify patient, clinician, administrator and delegated-user roles.	Proof that one role cannot read or change another person’s synthetic record.
Clinical integrations	Map source systems, interface engines and receiving applications.	The accepted action and downstream state, with data provenance and error handling.
Supplier and recovery access	Name service owners, remote-support paths and recovery controls.	Bounded access evidence and the independent controls protecting service continuity.

BEFORE THE SCOPING CALL

Bring the right context.

Care-service and data-flow owners
Synthetic identities with representative care relationships
Written permission for suppliers and connected platforms
Clinical safety restrictions and escalation contacts

Open the full readiness checklist ↗

THE NEXT DECISION

Connect security assurance to care continuity

Confirm synthetic data, clinical restrictions and supplier boundaries, then agree evidence that the relevant access controls work.

Coverage, environments, role combinations, supplier coordination and retesting affect effort. A brief helps expose those assumptions; it is not a price or delivery commitment.

See how the evidence is reported ↗

Method and source references

Read the scope guide · Evaluate a provider · How we publish our guidance