I am preparing a test plan for the security penetration testing of a software solution that manages patient information (HIPAA compliance) and allow the user to access to it from the web. Does anyone happen to know if there is any security standard for HIPAA that I can refer to as a blueprint for building the test plan?



I'll assume you're in the U.S., and are a Covered Entity, since you refer to HIPAA and are storing patient information.

First off, note that the HITECH act and related federal guidance put significantly more detailed guidance on the table; much more than the "reasonable effort" HIPAA guidance, and involving much more serious action in the case of a breach.

If you can afford it, get a consultant who specializes in the area. You'll need a lawyer who knows the area whether you have a consultant or not.

For official HIPAA/HITECH guidance, as a bare minimum, start with HHS (Health and Human Services), NIST (National Institute of Standards and Technology), and FIPS (Federal Information Processing Standards) - I've outlined a few high points below - this list is in no way complete nor comprehensive - it's merely a starting point!

HHS.gov Health Information Privacy

HHS.gov Security Rule Guidance Material

HHS.gov Understanding Health Information Privacy

HHS.gov Breach Notification Rule - this is one of the most critical pages, as it links to important Federal Register articles.

Other NIST Special Publications of interest include, but are not limited to:

FIPS 140-2 Annex A: Approved Security Functions for FIPS PUB 140-2, Security Requirements for Cryptographic Modules is specifically mentioned in 74 FR 19006.

  • Note that DSA/ElGamal GPG and PGP keys do not qualify as FIPS 140-2 compliant - not only is ElGamal not listed, the DSA keys are almost always 1024 bit, which is too short per NIST SP 800-131A (above).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.