By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Penetration (Penetration Testing)
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
In information security, a penetration is an event, or a set of related events, in which an outsider gets into a system or one of its resources, or tries to, without permission. That makes it a security incident.
The HIMSS Dictionary defines penetration as that unauthorized event. The practice most people mean when they say “pen test” is related but different: penetration testing is an authorized, planned attempt to break into systems, using the same techniques an attacker might, to find weaknesses before a real attacker does.
| Activity | What It Does | Typical Output |
|---|---|---|
| Penetration (Event) | Unauthorized access or attempt | Incident record and response |
| Penetration Testing | Authorized simulated attack that tries to exploit weaknesses | Findings showing what could be reached |
| Vulnerability Scanning | Automated search for known weaknesses | List of weaknesses, often without proof of exploit |
| Risk Analysis | Broader assessment of threats, vulnerabilities, and impact | Prioritized risks and treatment plan |
| Red Team Exercise | Extended, goal-based adversary simulation | Insight into detection and response |
| Tabletop Exercise | Discussion of a scenario with no live testing | Gaps in plans and roles |
⚠️ Exam Alert: A penetration is an unauthorized access event. Penetration testing is authorized and scoped, with written rules of engagement. Vulnerability scanning finds weaknesses, while penetration testing tries to exploit them to show real impact. Neither replaces a HIPAA risk analysis, which is a required, broader process.
🌐 Why It Matters: Real-World Healthcare IT Context
Hospitals present a large attack surface: web portals, remote access, cloud services, thousands of endpoints, legacy clinical systems, and connected medical devices. Controls such as firewalls, access management, and patching look sound on paper, but their combined effect is hard to judge without trying to defeat them. Penetration testing gives evidence of what an attacker could actually reach.
NIST’s technical guide to information security testing and assessment, SP 800-115, describes how to plan and conduct testing, analyze findings, and develop mitigation strategies. Common phases include planning and scoping, discovery, attempted exploitation, and reporting. Testers may work from outside the organization, from inside the network, or with partial knowledge, and their targets may include networks, applications, wireless systems, and social engineering such as phishing exercises.
The HIPAA Security Rule requires a risk analysis and ongoing evaluation of safeguards, but it does not currently name penetration testing as a mandatory activity. HHS published a notice of proposed rulemaking in January 2025 that would change this by requiring vulnerability scanning at least every six months and penetration testing at least once every 12 months, performed by qualified people and more often when the risk analysis indicates. That proposal was not final when this post was written, so organizations should check the current status. Many organizations already test because their cyber insurance, contracts, customers, or internal risk analysis call for it.
Scope matters in health care. A test that disrupts a production system can harm patients. Rules of engagement should state which systems are in scope, which are excluded or tested only in a lab, when testing may occur, how testers communicate with the security operations team, and what stops a test immediately. Clinical engineering and clinical leaders should know when testing occurs so unusual traffic is not mistaken for a real attack, and so a real attack is not mistaken for a test.
Medical devices need special care. Many run old operating systems that cannot be patched and may behave unpredictably under scanning or exploit attempts. Organizations often test devices in a lab or in cooperation with manufacturers, and the FDA expects manufacturers to address cybersecurity throughout a device’s life.
Results only help if they lead to action. Findings should be rated by risk, assigned to owners, fixed or formally accepted, and retested. Reports contain sensitive information about weaknesses and must be protected.
Penetration testing is also a source of lessons for incident response. Watching whether security monitoring detects the test, how fast, and who responds shows whether the response plan works.
Common penetration testing problems:
- Treating a vulnerability scan as a full penetration test
- Poorly defined scope or rules of engagement
- Testing production clinical systems without safeguards
- Findings never remediated or retested
- Testing once and assuming the results last
- Insufficient coordination with clinical staff
What supports effective testing:
- Written scope, authorization, and rules of engagement
- Qualified testers with healthcare experience
- Lab or coordinated testing for fragile devices
- Prioritized findings with owners and deadlines
- Retesting after fixes and after major changes
- Use of results to improve detection and response
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses are rarely involved in testing directly, but testing and its findings affect their work, and unusual events during a test can look like real problems.
At the Bedside
Advance notice from IT or clinical engineering about scheduled testing helps, particularly if devices or systems might behave oddly. If a monitor, pump, or workstation acts strangely, nurses should follow the usual process: keep the patient safe, use backup procedures, and report the issue, without assuming it is a test.
Reporting suspicious activity matters in both directions. A call about unusual pop-ups or odd system behavior should reach security quickly, since it could be a real intrusion.
In Clinical Workflow
Social engineering tests, such as simulated phishing emails, are the part of penetration testing most staff see. Reporting a simulated phishing message using the approved button reinforces the habit that will matter when a real one arrives.
Clinical leaders sometimes sit on committees that approve test scope and timing. Their input on unit schedules, patient acuity, and high-risk periods helps protect care.
Nurse informaticists help translate findings that affect clinical systems into practical changes, such as session settings, access rules, or device network placement, and ensure fixes do not create unsafe workarounds.
In EHR Implementation (Go-Live Perspective)
An Epic Go-Live is a time of heightened attention, with new accounts, interfaces, and devices. Security teams often test new access paths and applications before or soon after launch, and change freezes help avoid conflicts with clinical readiness.
At-the-elbow support analysts help staff recognize and report suspicious activity during go-live, when everything feels unfamiliar and unusual behavior is easy to dismiss.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
Penetration appears in security assessment and compliance questions:
| CAHIMS Domain | How Penetration Appears |
|---|---|
| Healthcare & Technology Environments | Threat landscape, HIPAA Security Rule, proposed rule changes |
| Clinical Informatics | Patient safety implications of testing and incidents |
| Healthcare Information & Systems Management | Testing methods, scanning versus testing, remediation |
| Management & Leadership | Risk analysis, scoping, vendor selection, reporting to leadership |
Key Terms to Know Alongside Penetration
- Penetration Testing — authorized simulated attack used to find exploitable weaknesses
- Vulnerability Scanning — automated detection of known weaknesses
- Rules of Engagement — written limits and procedures governing a test
- Red Team — group that simulates a determined adversary over an extended exercise
- Risk Analysis — required assessment of threats and vulnerabilities to ePHI
- Security Incident — attempted or successful unauthorized access or interference with systems
HIMSS Organizational Position
HIMSS supports healthcare cybersecurity through its Healthcare Cybersecurity Community, education, and research. Members can find related resources through the HIMSS Resource Center.
🔗 Explore Further: External References
- NIST — SP 800-115, Technical Guide to Information Security Testing and Assessment https://csrc.nist.gov/pubs/sp/800/115/final
- Federal Register — HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (Proposed Rule, January 6, 2025) https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information
- HHS — Guidance on Risk Analysis Requirements Under the HIPAA Security Rule https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html
- FDA — Cybersecurity in Medical Devices https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity
- NIST — SP 800-30 Rev. 1, Guide for Conducting Risk Assessments https://csrc.nist.gov/pubs/sp/800/30/r1/final
- HHS 405(d) — Health Industry Cybersecurity Practices https://405d.hhs.gov/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply