On 16 July 2026, DentaQuest, which says it "works with health plans to provide dental and vision benefits", reported a breach to HHS as a health plan and listed 15,000,000 individuals, the largest health plan report on the HHS breach portal in 2026. Its notice, first posted on 26 May, says unauthorized individuals accessed data on its network in an incident that ran from 17 May to 20 May 2026, involving names, Social Security numbers, member identification numbers, "Medicaid number and Medicare number", and dental or vision diagnosis, treatment and billing information. Clever Care Health Plan, a Medicare Advantage plan, posted its own notice because DentaQuest provided its members' dental benefits in 2025.
DentaQuest's report is one of 68 that health plans filed with HHS in 2026 through 21 September, covering 17.3 million people; 46 were hacking or IT incidents and 35 involved a business associate, as filers reported them on the portal's open and archived lists, which cover breaches of 500 or more people (read 13 October 2026; figures can change). In New York, the Department of Financial Services (DFS) fined two Delta Dental companies US$2.25 million in April 2026 over a 2023 breach of the file transfer servers used to move files "including eligibility- and claims-related files"; threat actors took about 60,000 files (consent order).
This ranking is for mid-market and enterprise payers: health insurers, Medicare Advantage and Medicaid managed care plans, third-party administrators (TPAs), benefits administrators, pharmacy benefit managers (PBMs) and dental and vision benefit managers. For the Security Rule in depth, see our HIPAA penetration testing requirements guide; for carriers' insurance rules, our insurance requirements guide.
Quick answer. The best penetration testing companies for health plans, payers and benefits administrators in 2026 are Stingrai, Coalfire, NetSPI, Tevora, Kroll, Schellman, Protiviti, NCC Group, GuidePoint Security and TrustedSec. Stingrai ranks first: a CREST-accredited, Toronto-headquartered firm whose named penetration testers test member, provider and broker portals role by role, FHIR APIs, file transfer servers, Active Directory and cloud, with retesting included and an attestation letter with every human-led and hybrid report, as a one-time annual test or a continuous program. Coalfire suits plans that also face CMS's ARC-AMPE or Enhanced Direct Enrollment audits, and NetSPI suits the largest payers with mainframe estates.
What drives a penetration test at a health plan
Rule | Who it reaches | Verb | What the text says | What it means for the test |
|---|---|---|---|---|
HIPAA 164.308(a)(1)(ii)(A) | Health plans and business associates | must | "Conduct an accurate and thorough assessment of the potential risks and vulnerabilities" to ePHI | Testing shows the analysis looked at real systems |
HIPAA 164.308(a)(8) | Same | must | "Perform a periodic technical and nontechnical evaluation" | A dated report and retest |
Proposed 164.312(h)(2)(iii) | Same, if finalized | proposed | "Penetration testing must be performed at least once every 12 months" | Not law on 13 October 2026 |
23 NYCRR 500.5(a)(1) | New York-licensed insurers, HMOs, PBMs, agents and adjusters, unless exempt under 500.19 | shall | Testing "from both inside and outside the information systems' boundaries by a qualified internal or external party at least annually" | Separate internal and external components |
NAIC Model #668, 4D(2)(h) | Insurance licensees in adopting states | shall determine | "Regularly test and monitor systems and procedures to detect actual and attempted attacks", where the risk assessment calls for it | No penetration test named |
ARC-AMPE CA-08 | Exchanges, state Medicaid and CHIP agencies | must | "Conduct penetration testing at least every one (1) year", by "an independent assessor or assessor team" | Annual independent test of the system boundary |
CMS EDE guidelines | EDE issuers and web-brokers, under their EDE agreements | must | The test "must include the EDE environment and must include tests based on" the OWASP Top 10 | Annual application test, results to CMS |
CMS-0057-F | MA organizations, Medicaid and CHIP programs and plans, FFE issuers | required | Provider Access, Payer-to-Payer and Prior Authorization APIs, generally by 1 January 2027 | No test mandate, new API surface |
HIPAA today, and the proposal. A health plan is a covered entity under 45 CFR 160.103, whose business associate definition covers "claims processing or administration", "benefit management" and "repricing", the work of TPAs, PBMs and benefits administrators. The current rule never names a penetration test; the risk analysis and evaluation are the duties a test evidences, and documentation is kept "for 6 years" (164.316(b)(2)(i)). The January 2025 proposed rule (90 FR 898) would add an annual test "by a qualified person" and scans "at least once every six months". On 13 October 2026 the Federal Register listed only that proposal under RIN 0945-AA22, the Unified Agenda placed it among "Long-Term Actions" with final action "07/00/2027", and HHS's fact sheet says "the current Security Rule remains in effect."
NYDFS for New York-licensed payers. Part 500 reaches anyone operating under a license under the Insurance Law (500.1(e)). DFS's FAQ says "Both HMOs and CCRCs are Covered Entities", and its adopted PBM rule, 11 NYCRR 454.2, states: "A pharmacy benefit manager is a covered entity under 23 NYCRR Part 500." In August 2025 DFS fined Healthplex, which provides "dental insurance management services" and is licensed as an independent adjuster and agent, US$2 million after a phishing email gave an attacker an employee's Office 365 mailbox through Outlook Web Access, which did not require multi-factor authentication (consent order); neither DFS order cited 500.5. Records behind the annual certification are kept five years (500.17(b)(3)); our NYDFS ranking covers the test.
State insurance data security laws. The NAIC's Summer 2026 state page lists 28 jurisdictions, one in part, that have adopted the Insurance Data Security Model Law (#668). The model never uses the word "penetration": its one explicit testing item, 4D(2)(h), is risk-based, section 4C(5) requires an assessment "no less than annually" of "the effectiveness of the safeguards' key controls", and a licensee that keeps a HIPAA information security program and certifies compliance "will be considered to meet the requirements of Section 4" (9A(2)). We read 16 of the 28 enactments on legislature sites on 13 October 2026; none mentions penetration testing either. For a health insurer, the model and those 16 laws add no test.
CMS. CMS's ARC-AMPE framework, with a compliance date of 4 March 2026, binds "ACA Administering Entities" (exchanges, state Medicaid and CHIP agencies and Basic Health Programs) and certain partner entities, including direct enrollment sites run by QHP issuers. In the overlay for Administering Entities, control CA-08 requires a yearly test of "the documented system and its full boundary" by "an independent assessor or assessor team", with raw results to CMS "in unaltered format". Medium and large healthcare organizations that support Medicaid sit in its non-mandatory table ("It is strongly recommended"), unless a contract makes the controls mandatory. CMS's EDE auditor guidelines of 10 April 2026, binding through the EDE agreements, require an annual test of the EDE environment, with results to CMS "prior to last business day in June". ARC-AMPE's user types do not name Medicare Advantage plans. CMS-0057-F sets no test, but its new APIs open claims and clinical data to providers and other plans, and it extends the app-facing Patient Access API; an April 2026 proposed rule "would not change those compliance dates".
Vendors and HITRUST. Every business associate contract "must provide that the business associate will" comply with the Security Rule (164.314(a)(2)(i)). For vendors asked for HITRUST certification, see our HITRUST ranking. Health systems that also run a plan answer to 10 NYCRR 405.46 for their New York hospitals.
What mid-market and enterprise payers need from a vendor
The 2026 reports point at where to test: 35 of the 68 health plan reports involved a business associate, 49 listed a network server, and DentaQuest's report holds 15.0 million of the 17.3 million people. Business associates filed 83 more, including Navia Benefit Solutions at 2,151,330 people.
Every role in every portal. Members, providers, brokers and employer groups reach different data through the same applications; test each role against the others' (why API scanners miss BOLA and IDOR).
The 2027 APIs. Scope the authorization flows and attribution logic of the new Provider Access, Payer-to-Payer and Prior Authorization APIs and the extended Patient Access API.
File transfer and EDI. Eligibility and claims files move through managed file transfer servers and EDI gateways; Delta Dental's breach came through one.
Inside the boundary. Internal network, Active Directory and cloud from an assumed-breach position, including a vendor or TPA account.
The help desk. Healthplex's breach began with a phishing email; add phishing and vishing aimed at the help desk and contact center.
Multi-entity reporting and data handling. Reports that map to each licensed entity; a business associate agreement where counsel requires one; records kept six years under HIPAA and five under Part 500.
Annual or continuous. A one-time annual test timed to the certification year suits most plans; a continuous program suits portals and APIs that ship monthly.
How this ranking was built
Vendor facts come from each firm's website, CREST Marketplace profile or HITRUST's directory, checked on 13 October 2026. The first two criteria were gates; the others were weighed together.
Testing sold as a named service on the firm's own site, covering networks and applications.
CREST Penetration Testing accreditation for a Marketplace entity whose profile links to the firm's own website.
Payer and healthcare evidence on the firm's pages: health insurer segments or work, CMS program work, or External Assessor status in HITRUST's directory.
Delivery in the US and Canada.
Evidence a buyer can use: named testers, retests and reporting.
At a glance: penetration testing companies for health plans
Company | Head office | Payer and healthcare evidence | CREST entity | Best for |
|---|---|---|---|---|
1. Stingrai | Toronto, Canada | Healthcare among its regulated client sectors | Stingrai Inc | Portals, APIs and networks by named testers |
2. Coalfire | Chicago, USA | CMS and EDE audit credentials; health insurer work; HITRUST | Coalfire Systems (UK head office) | Exchanges, Medicaid agencies, EDE issuers |
3. NetSPI | Minneapolis, USA | Its CREST profile: four of the five largest healthcare companies | NetSPI | The largest payers, mainframes |
4. Tevora | Irvine, USA | Serves health insurers, including Medicare; HITRUST | Tevora Business Solutions Inc | HITRUST plus testing |
5. Kroll | New York, USA | Insurance and managed care in its firm-wide expertise list | Kroll LLC | Testing and incident response together |
6. Schellman | Tampa, USA | HITRUST; healthcare assessments | Schellman Compliance LLC | HITRUST beside SOC and PCI work |
7. Protiviti | Menlo Park, USA (release dateline) | Payer compliance research; HITRUST | Protiviti (UK head office) | Testing beside compliance consulting |
8. NCC Group | Manchester, UK | Healthcare sector services; HITRUST | NCC Group, ten accreditations | Multinational groups |
9. GuidePoint Security | Reston, USA | HIPAA readiness assessments | GuidePoint Security | Products and testing from one partner |
10. TrustedSec | Fairlawn, Ohio, USA | HIPAA readiness assessments | TrustedSec | A retest in the base engagement |
1. Stingrai (top rated for health plans and payers)
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
For a payer, the case is evidence that holds up to HIPAA, NYDFS and CMS review. Stingrai Inc, the company that signs the contract, holds the CREST Penetration Testing accreditation (Marketplace profile), one of a handful of CREST-accredited firms headquartered in Canada. Each human-led engagement is run by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, reviewed by the team lead and an engagement partner. The team has 18 published CVEs and Hall of Fame listings at Apple, Google, the US Department of Defense and the US Federal Reserve, and Stingrai is rated 5.0 out of 5 on Clutch (20 reviews).
Scope for a payer test
Portals and APIs: member, provider and broker web applications and APIs tested across every role for broken authorization and IDOR on member, claim and authorization identifiers, including FHIR APIs, plus mobile member apps.
Perimeter and inside: the external perimeter and remote access, the internal network and Active Directory from an assumed-breach position, including a vendor account, and the file transfer and EDI servers that carry eligibility and claims files.
Cloud and people: cloud data platforms, phishing and help desk vishing, and red teaming.
Delivery and evidence
Whether the engagement is a one-time annual test or a continuous program, every confirmed finding, at every severity, is posted to the PTaaS platform the same day it is confirmed, with a working proof of concept and prioritized remediation guidance. Retesting is included, and every human-led and hybrid report ships with an attestation letter: pentest evidence for your HIPAA, NYDFS, HITRUST and SOC 2 programs. From Toronto and its London, UK office, Stingrai serves US and Canadian payers remotely and on site where the scope calls for it.
Where Snipe fits
Snipe is Stingrai's autonomous AI agent for web applications and associated APIs only. Trained on more than 6,000 HackerOne Hacktivity reports, it hunts IDOR, broken authorization and business logic flaws and opens AutoFix pull requests. The Autonomous Pentest is Snipe alone, with no penetration testers; in the Hybrid Pentest, Snipe and penetration testers test together, with the testers directing its focus. Everything else is human-led.
Pricing and fit: The Autonomous Pentest is US$3,000 per assessment or US$650 per month on a 12-month plan, and the Hybrid Pentest is US$6,800 per assessment or US$1,275 per month; both cover one web application and associated APIs (pricing). Other scopes are quoted through get a quote. Best for: health plans, TPAs and PBMs that want named, certified testers from a CREST-accredited firm across portals, APIs, networks and vendor connections, with retests and an attestation letter, as a one-time annual test or a continuous program.
2. Coalfire
Coalfire's August 2026 release calls it "headquartered in Chicago, Ill." Its ARC-AMPE page lists team certifications including "CMS Auditor Regulatory and Compliance Standards" and "EDE Security and Privacy Audit Standards", and its healthcare page describes a cyber risk assessment for "A top-tier health insurance provider" that evaluated its cloud-based systems. It is a HITRUST External Assessor, and its pen testing page promises to show "How Attackers Could Get In". Its Marketplace entry, Coalfire Systems, lists Penetration Testing with a United Kingdom head office, so confirm which entity delivers your test.
Best for: exchanges, state Medicaid agencies and EDE issuers that want CMS audit experience and testing from one firm.
3. NetSPI
NetSPI lists Minneapolis as its headquarters and an office in Toronto (contact), and its home page dates it to 2001 with "350+ experts". Its Marketplace entry lists Penetration Testing and Threat Led Penetration Testing, and NetSPI's own text there says its clients include "four of the five largest healthcare companies". Its mainframe testing covers z/OS, CICS and IMS, systems it says are often "passed over during reviews". NetSPI has closed its merger with Synack.
Best for: the largest payers, including those running core systems on mainframes, that want testing on a PTaaS platform.
4. Tevora
An August 2026 release describes Tevora as "Founded in 2003" and "Based in Irvine, CA". Its healthcare page lists "Healthcare Insurance providers, including Medicare Providers" among the organizations it serves, and it is a HITRUST External Assessor. Its penetration testing page covers network, cloud, application, API, mobile and medical device testing, and states "Tevora is CREST accredited for our expert Pen Testing services", which its Marketplace entry, Tevora Business Solutions Inc, confirms.
Best for: health insurers and Medicare plans that want HITRUST assessment and CREST-accredited testing from one consultancy; confirm its testers did not implement or operate your controls in the prior 12 months (HITRUST Handbook 3.3.5).
5. Kroll
Kroll's About page says "Kroll Is Headquartered in New York", and its healthcare page lists "Insurance" and "Managed care" in its firm-wide "Our Expertise" list. Its penetration testing datasheet covers application, API, mobile, cloud and network testing, red teaming and AI/LLM testing. Its Marketplace entry, Kroll LLC, holds Incident Response, Penetration Testing and Security Operations Centre accreditations.
Best for: payers that want testing and incident response from one accredited New York entity.
6. Schellman
Schellman's site gives a Tampa address and says it "began as a SOC audit firm 20+ years ago"; it is a HITRUST External Assessor. Its penetration testing page covers application, network, mobile, cloud, social engineering and red team work and Active Directory services, says "all penetration testers have background checks performed", and that "a Penetration Tester will perform your assessment, hands-on-keyboard". The CREST accreditation sits with Schellman Compliance LLC, one of the two entities that practice under the Schellman brand.
Best for: plans and benefits administrators that combine HITRUST with SOC or PCI DSS work and want CREST-accredited testing in the same firm, with the same 3.3.5 check.
7. Protiviti
Protiviti datelines its releases from Menlo Park, California (October 2026 release). Its healthcare collection addresses "payer, provider, and life sciences leaders" and carries a paper on "Top Compliance Priorities for U.S. Healthcare Payer Organizations in 2026", and it is a HITRUST External Assessor. Its attack and penetration page covers red teaming, application security, network penetration testing and social engineering, with a methodology that includes "exploitation, privilege escalation and lateral movement". Its Marketplace entry lists Penetration Testing with a United Kingdom head office, so confirm the delivering entity.
Best for: payers that want testing beside compliance consulting.
8. NCC Group
NCC Group, "Founded in 1999" (about), lists a Manchester global headquarters, a Chicago regional headquarters and a Waterloo, Ontario office (offices). Its health sector page assigns "consultants with sector-specific experience" to HITRUST CSF work "from e1 assessments, to i1 and r2", and it is a HITRUST External Assessor. Its Marketplace entry holds ten CREST accreditations, including Penetration Testing and Threat Led Penetration Testing.
Best for: multinational insurance and health groups that want HITRUST support and threat-led testing credentials in North America and the UK.
9. GuidePoint Security
GuidePoint lists its headquarters in Reston, Virginia, and an office in New York (contact). Its penetration testing page covers "internal or external networks, applications, cloud, ICS, security awareness or facilities", and it sells a HIPAA compliance readiness assessment. Its Marketplace entry lists Penetration Testing.
Best for: large payers that buy security products and services from one partner.
10. TrustedSec
TrustedSec was "Founded by innovator David Kennedy in 2012" (home page) and is based in Fairlawn, Ohio (contact). Its penetration testing page includes "Validation Testing": "we retest to confirm they've been successfully mitigated", and it offers HIPAA scoping and readiness assessments. Its Marketplace entry lists Penetration Testing and healthcare among its target sectors.
Best for: mid-market TPAs and benefits administrators that want a retest in the base engagement.
Also considered
Three healthcare specialists serving health plans sell penetration testing but had no CREST Marketplace entry on 13 October 2026: Clearwater (Nashville), which lists Health Plans among its segments and offers assume-breach internal penetration testing (technical testing); Meditology Services (Atlanta), which works with "providers, payers, and suppliers" and offers network penetration testing; and Fortified Health Security (Brentwood, Tennessee), which lists Health Plans and "Advanced Penetration Testing" (home page). Optiv's Marketplace entry, Optiv Services LLC, links to a different website, so we could not match it to the firm.
What a health plan penetration test costs
No rule sets a price, so cost follows the scope above and the retest. Stingrai's fixed packages are the Autonomous Pentest at US$3,000 and the Hybrid Pentest at US$6,800 per assessment, each for one web application and associated APIs (pricing); a payer scope is quoted. For benchmarks, see the cost guide, the cost calculator and how to compare quotes.
RFP questions for a health plan penetration test
[ ] Which legal entity signs, which delivers the test, and does the CREST-accredited entity match?
[ ] Will testers use accounts for every member, provider, broker and employer role and try each against the others' identifiers?
[ ] Are the FHIR APIs, including third-party app authorization, in scope?
[ ] Are file transfer servers, EDI gateways, vendor connections, an assumed-breach scenario from a vendor account and help desk vishing in scope?
[ ] Who are the named testers, is a written retest included, and can we keep the records six years?
[ ] For ARC-AMPE or EDE work: is the tester independent, will the rules of engagement be co-signed, and will raw results be delivered unaltered?
[ ] Where will PHI and evidence be stored, and will you sign our business associate agreement?
Our penetration testing RFP template turns these into a document.
Frequently Asked Questions
Who are the best penetration testing companies for health plans and payers in 2026?
The best penetration testing companies for health plans, payers and benefits administrators in 2026 are Stingrai, Coalfire, NetSPI, Tevora, Kroll, Schellman, Protiviti, NCC Group, GuidePoint Security and TrustedSec. For a payer whose risk sits in portals, FHIR APIs and vendor connections, Stingrai is the strongest fit: named, certified penetration testers from a CREST-accredited firm, retests included and an attestation letter with every human-led and hybrid report, as a one-time annual test or a continuous program.
Does HIPAA require health plans to perform penetration testing?
Not by name. The Security Rule requires an "accurate and thorough" risk analysis (164.308(a)(1)(ii)(A)) and a "periodic technical and nontechnical evaluation" (164.308(a)(8)), and a penetration test is a common way to evidence both. The January 2025 proposed rule would require a test "at least once every 12 months", but it is not final.
Is the HIPAA annual penetration testing rule final?
No. On 13 October 2026 the Federal Register listed only the January 2025 proposed rule under RIN 0945-AA22, and the current Unified Agenda lists it among Long-Term Actions with final action dated 07/00/2027. HHS says the current Security Rule remains in effect.
Does NYDFS require penetration testing for health insurers and PBMs?
Yes, for those licensed in New York, unless exempt under 500.19. Section 500.5(a)(1) requires annual testing "from both inside and outside the information systems' boundaries by a qualified internal or external party"; DFS treats HMOs as covered entities, and 11 NYCRR 454.2 says "A pharmacy benefit manager is a covered entity under 23 NYCRR Part 500."
Do state insurance data security laws require penetration testing?
No. The NAIC model adopted in 28 jurisdictions asks licensees to "Regularly test and monitor systems and procedures" where their risk assessment calls for it and to assess key controls at least annually, but never mentions penetration testing, and neither do the 16 enactments we read. A licensee with a HIPAA information security program that certifies compliance is considered to meet the model's section 4.
Which CMS rules require penetration testing?
ARC-AMPE binds ACA Administering Entities, meaning exchanges and state Medicaid and CHIP agencies, and certain partner entities; its Administering Entity overlay requires an independent test at least every year (control CA-08). CMS's Enhanced Direct Enrollment guidelines require an annual test of the EDE environment. CMS-0057-F requires new payer APIs, generally by 1 January 2027, but sets no test.
What should a health plan penetration test cover?
Portals tested role by role, the FHIR APIs, file transfer and EDI endpoints, the internal network and Active Directory from an assumed-breach position, cloud, vendor connections and the help desk, at the depth the risk analysis sets.
How much does a penetration test for a health plan cost?
No rule sets a price, so cost follows scope. Stingrai's fixed packages are US$3,000 (Autonomous) and US$6,800 (Hybrid) per assessment for one web application and associated APIs; a full payer scope is quoted.
Related reading
References
eCFR, 45 CFR 160.103, 164.308, 164.314 and 164.316. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308
HHS, HIPAA Security Rule proposed rule, 90 FR 898, 6 January 2025. https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information
Reginfo.gov, Unified Agenda entry, RIN 0945-AA22 (2026 agenda). https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0945-AA22
HHS, HIPAA Security Rule NPRM fact sheet. https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet/index.html
DFS, Second Amendment to 23 NYCRR 500 (adopted text). https://www.dfs.ny.gov/system/files/documents/2023/10/rf_fs_2amend23NYCRR500_text_20231101.pdf
DFS, Cybersecurity FAQs. https://www.dfs.ny.gov/cybersecurity/faqs
DFS, 11 NYCRR 454 (PBM rule), adopted text. https://www.dfs.ny.gov/system/files/documents/2023/10/rf_ins_a2reg219_new_223_224_225_text.pdf
DFS, Consent Order, Healthplex (August 2025), https://www.dfs.ny.gov/system/files/documents/2025/08/Healthplex-Consent-Order_FINAL.pdf, and Consent Order, Delta Dental (April 2026), https://www.dfs.ny.gov/system/files/documents/2026/04/Delta-Dental-Consent-Order.pdf
NAIC, Insurance Data Security Model Law (#668) and State Page, Summer 2026. https://content.naic.org/sites/default/files/model-law-668.pdf
CMS, ARC-AMPE Volume I (Version 1.02), https://www.cms.gov/files/document/arc-ampe-vol-1-v102-508-5cr-04112025.pdf, and ACA Administering Entities Volume II overlay (CA-08), https://www.cms.gov/files/document/arc-ampevol2sspp-aca-aev102-50803212025.xlsx
CMS, Enhanced Direct Enrollment auditor guidelines, 10 April 2026. https://www.cms.gov/files/document/guidelines-enhanced-direct-enrollment-audits-year-9-final.pdf
CMS, CMS-0057-F fact sheet. https://www.cms.gov/newsroom/fact-sheets/cms-interoperability-and-prior-authorization-final-rule-cms-0057-f
HHS Office for Civil Rights, Breach Portal, open and archived lists exported 13 October 2026. https://ocrportal.hhs.gov/ocr/breach/breach_report_hip.jsf
DentaQuest, Notice of Data Breach, 16 July 2026. https://www.dentaquest.com/en/notice-of-data-breach
CREST Marketplace profiles, HITRUST's directory and the vendor pages linked in each entry, read 13 October 2026. https://marketplace.crest.org/
Talk to Stingrai
Bring your risk analysis, your portal and API inventory and last year's report. Stingrai will scope the systems above, name the penetration testers, post every confirmed finding the same day, retest the fixes and close human-led and hybrid engagements with an attestation letter, as a one-time annual test timed to your certification year or a continuous program. Get a quote or see the published packages on the pricing page.
