Does HIPAA Require Vulnerability Scanning? (2026)

Short answer: the current HIPAA Security Rule does not name vulnerability scanning, but it does require you to identify and reduce vulnerabilities to patient data and to periodically check that your safeguards work. Regular scanning is the standard way to do that. HHS has also proposed a rule that would require scans at least every six months.

Take the free risk assessment →Talk to an analyst

What the current rule says

Risk analysis (45 CFR 164.308(a)(1)(ii)(A)): an accurate and thorough assessment of the potential risks and vulnerabilities to ePHI.
Risk management (164.308(a)(1)(ii)(B)): security measures that reduce those risks and vulnerabilities to a reasonable and appropriate level.
Evaluation (164.308(a)(8)): periodic technical and nontechnical evaluation of your safeguards.

It is hard to show you found and reduced technical vulnerabilities without scanning for them.

What the proposed update would add

In January 2025, HHS proposed the biggest update to the Security Rule in two decades. As of November 2026 it has not been finalized, and HHS's target date has slipped more than once. Even so, it is a clear signal of what OCR expects a reasonable security program to look like.

Vulnerability scans at least every six months.
A penetration test at least every 12 months.
A written technology asset inventory and network map.

What a practice should do

Scan both your internet-facing systems and your internal network.
Fix the highest-risk findings first and re-scan to confirm.
Keep the reports. They are evidence for your risk analysis.
Add a penetration test at least once a year.

Cytek's vulnerability scanning does this inside Safeguard™, with reports in plain language.

FAQ

Frequently asked questions

How often should a medical or dental practice scan?

At least quarterly is a good baseline. The proposed HHS rule would set a minimum of every six months.

Is a vulnerability scan the same as a penetration test?

No. A scan is an automated check for known weaknesses. A penetration test is a hands-on attempt to break in. The proposed rule would require both.

Does a vulnerability scan count as a HIPAA risk assessment?

No. It is one technical input. A risk assessment also covers policies, people, vendors and physical security.

Sources: 45 CFR 164.308, administrative safeguards · HHS fact sheet on the proposed Security Rule update. This page is general information, not legal advice.

Need vulnerability scanning?

Safeguard scans your network and tells you what to fix, in plain language.