How does a pentesting engagement change under HIPAA?

Question

I am a intermediate pentester who will soon be conducting a engagement with a hospice. This is my first engagement with a network where HIPAA is involved, and I am researching how this may affect my statement of work. My research so far has only turned up Google-SEO-optimized copywriting garbage, but I will keep looking. How is the workflow different from a pentest with no HIPAA-protected information?

• Can I still use tools such as nmap or popular Github scripts such as WinPEAS/LinPEAS? These are technically third party scripts that I haven't read the source code of (even though I trust them).
• Are there certain common actions I am forbidden from doing? Are there extra actions I need to make sure I do?
• Is there any important changes in operation that I haven't described here?

I know this isn't official legal advice.

Answer 1

:::Not Legal Advice:::

HIPAA does not specify a pen test requirement, although it's generally understood to be part of the regular technical security assessment requirements. HIPAA does not dictate how a pen test is conducted.

Your client should have had you sign a non-disclosure agreement (NDA) and Business Associates Agreement (BAA) before you began testing. This should cover both of you, if sensitive information is disclosed in your testing.

Your scope of work (SOW) should cover your rules of engagement, including your actions if you uncover sensitive information.

The SOW may cover the tools you can use in the environment, but I would quickly point out to a client that threat actors won't adhere to a limited set of tools.

I have not been part of pen test that altered its methods because of governance or standards used.