On 31 July 2025, Change Healthcare notified the U.S. Department of Health and Human Services Office for Civil Rights that approximately 192.7 million individuals had been impacted by the ransomware attack it had reported to OCR in July 2024, according to OCR's own Change Healthcare FAQ. OCR cited the attack's "unprecedented magnitude" and said its investigation interests extended to "those covered entities that have business associate relationships with Change Healthcare and UHG." An incident of that size started at a technology company serving covered entities, not inside a hospital.
A telehealth platform, an EMR add-on, a remote monitoring service or an AI scribe now meets a security review before it meets a clinician, and in two Canadian programs the penetration test is written into the rules: Quebec's TGV certification and Ontario Health's verification standard for virtual visit solutions. This ranking is written for that vendor, not the hospital: what Canadian and US customers and regulators require of a health technology company in October 2026, what the test has to cover, and which firms publish real work for this buyer. Hospitals buying testing for their own estate should use the US or Canadian healthcare rankings, and device makers the medical device ranking.
Quick answer. The best healthtech penetration testing companies in 2026 are Stingrai, Clearwater, Meditology Services, Cobalt, NetSPI, OKIOK, Blue Goat Cyber, NowSecure, Fortified Health Security and A-LIGN. Stingrai ranks first for health technology vendors: a CREST-accredited firm headquartered in Toronto that puts two named penetration testers on the product, tests every role and patient-scoped endpoint white box, the mode Quebec's certification bureau accepts in all cases, and includes retesting and an attestation letter, as a one-time annual test or a continuous program. Clearwater and Meditology Services follow for healthcare-only compliance and testing under one roof, and Cobalt for platform-delivered testing across many applications. The two hard requirements are TGV criterion S16.03 in Quebec and requirement 2.3.10 of Ontario Health's virtual visits standard.
What customers and regulators require of a healthtech vendor in 2026
Two instruments below require vendors to run penetration tests, one requires a testing policy, two device regimes ask for test evidence, and the rest create a duty to assess risk that a test usually evidences. Each is quoted from its own text.
Quebec: TGV certification and criterion S16.03
The certification bureau's About certification page makes TGV certification mandatory when a product handles health or social services information, is interfaced with a common-interest information asset that does, or will be deployed with web access in more than one Quebec health establishment. Preparation with the bureau can take 1 to 6 weeks and the verification by an external firm runs 30 business days. Santé Québec's TGV agreement with the supplier sets the fee at C$15,000 ("15 000 $") excluding applicable taxes.
The penetration test is a criterion in its own right. In the verification criteria list of 24 April 2026, which holds 382 criteria in seven domains, criterion S16.03 reads: "Soumettre votre application à un test d'intrusion administré par un prestataire indépendant et reconnu par Santé Québec" (submit your application to a penetration test administered by an independent provider recognized by Santé Québec). The bureau's penetration testing orientation sets the rules:
White box testing is accepted in all cases. Grey box is accepted only for certain non-sensitive products with no provincial deployment planned. Black box is not accepted.
Tests run in production or an equivalent environment, and every role is tested in its intended context, web-reachable or not.
The provider needs legally authorized representatives in Canada, certified testers with criminal background evidence, and the ability to give the bureau the report in French at no cost.
The report must carry eight elements, including a description of every test performed, "concluants ou non", and the vulnerabilities suspected but not exploited.
Certification does not end the obligation. Item 3 of the TGV attestation commits the supplier "à passer annuellement au moins un test d'intrusion auprès d'une firme indépendante", with results and proof of mitigation filed by the annual self-declaration; item 4 requires a critical vulnerability to be reported to the bureau and a mitigation plan presented within three business days. The certificate is valid for five years. AI products also meet the list's 69 artificial intelligence criteria, covered in the TGV guide for AI health tools; the TGV certification guide covers the whole process.
Ontario: Ontario Health's verification standards and the threat risk assessment
Of Ontario Health's provincial digital standards, the one with teeth for vendors is the Virtual Visits Solution Requirements, version 3.1, dated 15 September 2026, which sets the mandatory requirements a video or secure messaging solution must meet to be verified. The program is voluntary and free, verified solutions appear on Ontario Health's published list, and the standard defines Mandatory as "Solution Providers must support these requirements."
Three mandatory requirements decide the testing scope:
2.3.10, Perform regular penetration tests: "Penetration tests are to be done, at a minimum, on an annual basis, or when there has been a major software release or change in architecture or infrastructure. Penetration tests must include the application and application infrastructure." For hosted environments, the hosting provider may need to submit its own results.
2.3.9, Perform regular vulnerability assessment scans: at a minimum quarterly, or after a major release or architecture change.
2.3.8, Meet security controls assurance requirements: a current SOC 2 Type 2 report, ISO 27001 certification, HITRUST r2 certification or OntarioMD Certified EMR status. Local solution providers can instead submit a threat risk assessment, and the standard requires that "Latest penetration test results are to be submitted with the TRA report." The TRA must be under two years old and performed by an assessor with five years of experience holding CISSP, CISM, CISA or CRISC.
The standard also requires a PIA summary (2.3.7) and Canadian hosting of all personal health information, data and backups (2.3.14), and Ontario Health's verification page adds an attestation letter and scenario-based validation testing within 12 months. The Online Appointment Booking Service Standard, version 2.0 of spring 2024, is softer: requirement 5.11 makes it mandatory to have a policy on penetration testing frequency, while its notes say tests "should be done, at a minimum, on an annual basis."
Ontario law: electronic service providers and network providers
O. Reg. 329/04 reaches vendors directly. Section 6(1) binds any person, other than the custodian's agent, who supplies services that let a custodian use electronic means to handle personal health information: it may not use that information except as necessary to provide the services, and may not disclose it. Section 6(3) goes further for a health information network provider, one serving two or more custodians primarily so they can disclose information to one another. Paragraph 5 requires it to "perform, and provide to each applicable health information custodian a written copy of the results of, an assessment of the services" with respect to "threats, vulnerabilities and risks to the security and integrity of the personal health information." The regulation does not name a penetration test, but a shared record or interoperability hub that meets the definition owes every customer a written threat and vulnerability assessment, and a penetration test report is strong evidence for it.
United States: HIPAA business associate obligations
A healthtech company that creates, receives, maintains or transmits protected health information on behalf of a covered entity is a business associate under 45 CFR 160.103, and the definition expressly includes data transmission services with routine access to PHI, a person offering a personal health record on a covered entity's behalf, and subcontractors. Under 45 CFR 164.302, "A covered entity or business associate must comply with the applicable standards" of the Security Rule. That includes the risk analysis at 164.308(a)(1)(ii)(A), "an accurate and thorough assessment of the potential risks and vulnerabilities" to ePHI, and the periodic technical and nontechnical evaluation at 164.308(a)(8).
The business associate agreement must provide, under 45 CFR 164.314(a)(2)(i), that the vendor will comply with the Security Rule, flow the same terms to its subcontractors, and report security incidents. HHS's fact sheet on direct liability lists "Failure to comply with the requirements of the Security Rule" among the violations for which business associates are directly liable since the HITECH Act. None of these provisions names a penetration test; they require the vendor to find and assess its own vulnerabilities, and a test report is the usual proof. The clause-by-clause treatment is in the HIPAA penetration testing requirements guide.
The HIPAA Security Rule proposal: where it stands in October 2026
OCR's proposed rule at 90 FR 898, published on 6 January 2025 under RIN 0945-AA22, would change the vendor picture in two ways. Proposed 164.312(h)(2)(iii) would require penetration testing "by a qualified person" that "must be performed at least once every 12 months or in accordance with the covered entity's or business associate's risk analysis ... whichever is more frequent." Proposed 164.308(b)(2)(ii) would require a covered entity to "Obtain written verification from the business associate at least once every 12 months that the business associate has deployed the technical safeguards," through a written analysis by a person with appropriate cybersecurity knowledge and experience and a written certification by someone authorized to act for the business associate.
It is still a proposal. As of 11 October 2026 the Federal Register lists exactly one document under RIN 0945-AA22, the proposed rule, and the most recent Unified Agenda on reginfo.gov, publication 202510, places the rulemaking under Long-Term Actions with a final action date of 07/00/2027. The Spring 2025 agenda had listed it at the Final Rule Stage for May 2026.
HITRUST
Ontario Health accepts HITRUST r2 under requirement 2.3.8, with i1 accepted provisionally for up to 12 months. HITRUST's assessment portfolio lists the e1 with 43 core controls and the i1 with 182 control requirements, each valid for one year, and the r2, valid for two years. HITRUST's public documents set no fixed penetration testing frequency; the requirement statements themselves are delivered through its licensed MyCSF platform. What HITRUST does publish, in the Assessment Handbook version 1.2, is an independence rule that lets assessor personnel perform "Penetration testing (excluding remediation activities that involve implementation or operation of a control)".
SOC 2
SOC 2 is one of the assurance documents Ontario Health accepts under 2.3.8, and the AICPA's criteria do not require a penetration test. The 2017 Trust Services Criteria with revised points of focus (2022) mention penetration testing in a point of focus under CC4.1, where risk and control evaluations "may include" internal audit assessments, "vulnerability scans, security assessment, penetration testing, and third-party assessments", and the introduction states that use of the criteria "does not require an assessment of whether each point of focus is addressed." Where a vendor uses the SOC 2 route, Ontario Health's 2.3.8 requires a Type 2 report completed within the last year by an AICPA-certified third party, with a Type 1 accepted provisionally if the Type 2 follows within six months. The SOC 2 penetration testing guide covers audit timing.
FDA and Health Canada: only when the software is a medical device
Most healthtech products are not medical devices: section 520(o)(1) of the Federal Food, Drug, and Cosmetic Act, at 21 U.S.C. 360j(o), excludes from the device definition software for administrative support of a health care facility (including appointment schedules and practice management), software for maintaining a healthy lifestyle, certain electronic patient record functions, software that transfers, stores or displays device data without interpreting it, and clinical decision support that lets a professional independently review the basis of its recommendations. FDA's current interpretation of that last exclusion is the Clinical Decision Support Software guidance, finalized in January 2026.
For a medical device with cybersecurity considerations, including software as a medical device, FDA's guidance Cybersecurity in Medical Devices, issued on 3 February 2026, names the test and its report; section 524B adds statutory requirements for cyber devices: "Penetration test reports should be provided and include the following elements: Independence and technical expertise of testers; Scope of testing; Duration of testing; Testing methods employed; and Test results, findings, and observations." In Canada, Health Canada's Pre-market Requirements for Medical Device Cybersecurity, effective 26 June 2019, lists structured penetration testing among the types of cybersecurity testing and asks for a detailed summary of security testing for Class III and IV devices and test reports for Class IV.
Hospital vendor security reviews and questionnaires
Much of the pressure comes through procurement. HHS's voluntary Healthcare and Public Health Cybersecurity Performance Goals include an essential goal on Vendor/Supplier Cybersecurity Requirements, to "Identify, assess, and mitigate risks associated with third party products and services", and an enhanced Cybersecurity Testing goal built on "vulnerabilities in assets discovered through penetration testing and attack simulations." Clearwater's digital health page puts the vendor experience plainly: "Your first covered entity wants a signed HIPAA risk analysis. Your first enterprise client needs a security questionnaire answered before procurement will move." Expect questions on the date of the last independent test, who ran it, its scope, whether critical and high findings were retested, and whether a summary or letter can be shared; completion letter versus full report explains the difference.
Instrument | Names penetration testing? | Cadence | What the vendor submits |
|---|---|---|---|
Quebec TGV, criterion S16.03 and attestation item 3 | Yes | Before certification, then at least once a year | Report with eight elements; yearly results and mitigation proof |
Ontario Health Virtual Visits Solution Requirements v3.1, 2.3.10 | Yes, mandatory | At least annually and after a major release or architecture change | Results on request; with the TRA if that route is used |
Ontario Health Online Appointment Booking v2.0, 5.11 | A policy is mandatory | Notes say "should" be at least annual | The testing policy |
O. Reg. 329/04, s. 6(3) para. 5 | No; a threat, vulnerability and risk assessment | None set | Written results to each custodian |
HIPAA Security Rule, business associates | No | None set | Risk analysis and evaluation evidence |
HIPAA proposed rule, 90 FR 898 | Would, at 164.312(h)(2)(iii) | Would be at least every 12 months | Yearly written verification to each covered entity |
HITRUST e1, i1, r2 | No public cadence | Certification cycle | Assessed control evidence |
SOC 2 (2017 TSC, 2022 points of focus) | Point of focus only | None set | SOC 2 Type 2 report |
FDA premarket guidance of 3 February 2026 and section 524B | Yes, for devices with cybersecurity considerations (524B for cyber devices) | Tied to the submission | Report with the five named elements |
Health Canada device cybersecurity guidance | Lists structured penetration testing | Tied to the license application | Testing summary (Class III, IV); reports (Class IV) |
What to test in a healthtech product
A healthtech penetration test that passes a hospital review is scoped around the patient record, not the perimeter.
Patient-identifier authorization. Every endpoint that takes a patient, encounter, appointment, document or claim identifier must check that the caller may see that record. Broken object level authorization is first in the OWASP API Security Top 10, and NowSecure's healthcare page describes a case in which "50% of the APIs allowed medical professional users to access the pathology, x-rays, and clinical results of other patients."
The full role matrix. Patient, proxy, clinician, front desk, billing, administrator, vendor support and service accounts, each tested in its intended context as the TGV orientation requires, proving a lower role cannot reach a higher role's data.
Tenant isolation. A platform serving many clinics or health systems has to prove that customer A cannot reach customer B through shared search, reporting, exports, file storage or integration endpoints.
FHIR, HL7 and integration interfaces. SMART on FHIR launch flows and token scopes, FHIR search parameters that return more than the caller should see, HL7 v2 feeds and interface engines built for a trusted network, and the webhooks and SFTP drops that connect the product to an EHR.
AI features. Scribes, summarizers and patient assistants need direct and indirect prompt injection testing, cross-patient exposure through retrieval, system prompt leakage, and checks on where model calls send data. Quebec's criterion IA12 asks for a prompt injection test report where generative AI produces results, and IA40 bars personal information leaving Quebec through any AI component without consent. The clinical LLM and AI scribe scoping guide has the test cases.
Mobile patient apps. Keychain and Keystore storage, certificate pinning, deep links and the API behind the app, tested against OWASP MASVS and MASTG.
Telehealth and session security. Meeting links that admit anyone who has the URL, waiting room bypass, recording storage and access, and secure messaging attachments. Ontario Health's 2.3.10 requires the test to "include the application and application infrastructure", so the cloud tenancy and hosting configuration belong in scope too.
White box testing with source access is the safe default, because Quebec does not accept black box. Specify the report before the test begins so one document serves every file: the TGV orientation's eight elements, FDA's five elements where they apply, and a shareable letter. The statement of work template carries that language.
How the ranking was built
Ten firms were scored against six criteria. Every vendor claim traces to the vendor's own website, checked on 11 October 2026.
Published work for health technology companies. Digital health, healthcare technology suppliers, mHealth, software as a medical device or TGV work; logo walls did not count.
Application depth. Authenticated, role-by-role testing of web, API and mobile, including authorization and business logic.
Fit with the requirements above. The TGV orientation's conditions, Ontario Health's scope language, FDA's report elements, HITRUST or SOC 2 evidence.
Canadian and US coverage. Delivery on both sides of the border.
Evidence quality. Reproduction steps, retesting and a shareable letter.
Delivery model. One-time annual and continuous testing.
Firms whose main product is monitoring, governance software or compliance attestation without offensive testing were not ranked, and firms whose sites showed no work for this buyer were left out.
Quick comparison: best healthtech penetration testing companies
Company | HQ | Healthtech evidence | Best for | Source page, checked 11 October 2026 |
|---|---|---|---|---|
1. Stingrai | Toronto, Canada | CREST-accredited firm; TGV-scoped test for a Quebec healthtech company | Vendors needing TGV, Ontario Health, HIPAA and SOC 2 evidence from one white box test, annual or continuous | |
2. Clearwater | Nashville, Tennessee, USA | Digital health program; web, mobile and API testing | Early-stage digital health companies wanting compliance and testing together | |
3. Meditology Services | Atlanta, Georgia, USA | Healthcare technology suppliers; application, cloud and AI testing | Suppliers pursuing HITRUST or SOC 2 | |
4. Cobalt | Boston, Massachusetts, USA | Healthtech provider testing six web and mobile apps | Vendors with many applications | |
5. NetSPI | Minneapolis, Minnesota, USA | Medical device testing against FDA premarket guidance | Device software facing FDA review | |
6. OKIOK | Laval, Quebec, Canada | TGV penetration tests and preparation | Vendors entering Quebec's network | |
7. Blue Goat Cyber | Scottsdale, Arizona, USA | SaMD premarket package with cloud, mobile and API testing | SaMD makers preparing a 524B file | |
8. NowSecure | Chicago, Illinois, USA | mHealth mobile app penetration testing | Patient app publishers | |
9. Fortified Health Security | Brentwood, Tennessee, USA | Healthcare technology practice; penetration testing and red team | Vendors also wanting managed security | |
10. A-LIGN | Tampa, Florida, USA | HITRUST and SOC 2 assessor with a separate testing team | Vendors buying HITRUST or SOC 2 |
1. Stingrai (top rated for health technology vendors)
World-Class Offensive Security.
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
Stingrai holds CREST accreditation at firm level as a penetration testing service provider, one of a small number of CREST-accredited firms headquartered in Canada, with an office in London, UK. Each engagement is run by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, reviewed by the team lead and an engagement partner. The team has 18 published CVEs, bug bounty Hall of Fame listings at Apple, Google, Facebook, Yahoo, the US Department of Defense, the US Federal Reserve, PaySafe and Zynga, and a founding member of Uber's offensive security team. Stingrai is rated 5.0 out of 5 on Clutch (20 reviews) and 4.9 out of 5 on G2.
Stingrai performed the TGV-scoped penetration test for Bia Education, a Quebec company building an AI-powered recommendation system for musculoskeletal consultations; the published case study records the goal as "Penetration testing to certify our app for a cybersecurity requirement", six vulnerabilities identified, and retesting through the portal. TGV engagements follow the bureau's conditions: white box, a production-equivalent environment, every role tested, and a report built on the orientation's eight elements.
Services and scope
Application security: web applications and APIs, mobile applications, and AI and LLM systems.
Network and cloud security: internal and external networks, Active Directory, Wi-Fi, and cloud environments.
Social engineering: phishing campaigns and physical security assessments.
Adversary simulation: red teaming and purple teaming.
For a healthtech product, the web application test is authenticated across every user role, centered on business logic, broken authorization and IDOR on patient-scoped identifiers, and source-assisted when repository access is given. Mobile testing covers the IPA and APK, Keychain and Keystore storage, certificate pinning bypass with Frida and objection, and the backend API, aligned to OWASP MASVS and MASTG. AI testing covers prompt injection, system prompt leakage and tool misuse, mapped to the OWASP LLM Top 10, the OWASP Agentic Top 10 and MITRE ATLAS.
Delivery and evidence
Findings are posted to the PTaaS platform as they are confirmed, each with a working proof of concept and prioritized remediation guidance. Clients chat live with their penetration testers, push findings into Jira and Slack, and receive a redactable PDF report. Retesting is included, and human-led and hybrid engagements close with an attestation letter and a verified badge that can be shared with a hospital security team. The testing produces evidence for SOC 2, ISO 27001, HIPAA and PCI DSS programs, delivered as a one-time annual test or a continuous program that tests each release.
Where Snipe fits
Snipe is Stingrai's autonomous AI agent for web applications and associated APIs. Trained on more than 6,000 HackerOne Hacktivity reports and Stingrai's penetration testers' methodology, it hunts IDOR, broken authorization and business logic flaws, performs white-box code review, opens AutoFix pull requests, gates pull requests and runs automated retests. In a Hybrid engagement the penetration testers and Snipe test together throughout, with the testers directing its focus. Mobile, cloud, infrastructure, social engineering and red team scopes are tested by the penetration testers.
Pricing and fit: The Autonomous Pentest is US$3,000 per assessment or US$650 per month on a 12-month plan, and the Hybrid Pentest is US$6,800 per assessment or US$1,275 per month; both cover one web application and associated APIs (pricing). The "No High or Critical Finding = Don't Pay" guarantee applies to the Autonomous tier only. TGV scopes, mobile apps, AI features and multi-application platforms are quoted through the Enterprise tier. Stingrai fits vendors that need one white box test to serve a Quebec certification, an Ontario Health verification and a US hospital review.
2. Clearwater
Clearwater is a healthcare-only cybersecurity and compliance firm based in Nashville, Tennessee, which says its team works with over 500 customers across the healthcare ecosystem. Its digital health page describes staged programs that take a vendor from covered-entity readiness through SOC 2 Type II readiness and enterprise security questionnaire support to HITRUST e1 or r2 certification.
The testing sits on Clearwater's technical testing page, which lists web application penetration testing, mobile app penetration testing for iOS and Android, API security assessment, internal and external penetration testing, social engineering, and medical device security assessments.
Delivery model: consulting inside a broader compliance and managed services relationship. No list price is published on the pages reviewed.
Best for: early-stage digital health companies wanting the HIPAA risk analysis, questionnaire support and penetration test from one firm.
3. Meditology Services
Meditology Services is a healthcare-focused consultancy whose listed address is in Atlanta, Georgia, with offices in Philadelphia, Nashville, Denver and San Diego. Its home page names Healthcare Technology Suppliers as one of two client groups, with outcomes including "Faster security reviews" and "Streamlined customer obligations", and its service lines include HITRUST certification services and SOC 2 examination support.
Its ethical hacking and penetration testing page covers AI, network, application and cloud security testing, and lists "Safe testing methods to protect patient safety" among its differentiators.
Delivery model: healthcare-only consulting. No list price is published on the pages reviewed.
Best for: healthcare technology suppliers preparing for HITRUST or SOC 2 who want application and AI testing from a healthcare-only firm.
4. Cobalt
Cobalt is a penetration testing as a service provider whose US headquarters is in Boston, Massachusetts, with a UK office in Oxford. Its healthcare page cites a healthtech software provider that "needed to test six web and mobile applications across a rapidly expanding attack surface after three acquisitions", and advertises a pool of 500+ pentesters and pentest launch in 24 hours.
Its pricing page describes a credit model in which one credit "represents the equivalent of 8 hours of offensive security testing", sold in annual packages that include scoping, testing and retesting.
Best for: healthtech vendors with several web and mobile applications who want testing booked against a credit pool.
5. NetSPI
NetSPI is headquartered in Minneapolis, Minnesota, and lists an office in Toronto, Ontario. Its medical device penetration testing page combines threat modeling with testing of firmware, hardware, wireless configuration, network analysis, thick client and mobile applications, sensor data and potential patient safety issues, and frames the outcome against "the current standards and recommendations by the FDA Premarket Cybersecurity Guidelines." Its PTaaS line also covers web, API, mobile, cloud and AI testing.
Delivery model: platform-delivered testing programs with a hardware practice. No list price is published on the pages reviewed.
Best for: device and SaMD companies whose test report travels with an FDA submission and whose product spans hardware and software.
6. OKIOK
OKIOK is a cybersecurity firm headquartered in Laval, Quebec, founded in 1973 according to its history page. Its health care page names "health network suppliers" among its clients, lists "Penetration tests required for TGV certification" and "Preparation and support for TGV certification" among its health care work.
Its penetration testing page reports more than 2,500 tests performed for more than 250 active clients, covers web application and API testing and mobile application testing for Android and iOS, and lists OSCP, OSCE, OSEP, OSWE, GPEN, GWAPT, CRTO, CEH and CISSP among credentials held across the team.
Delivery model: consulting, with governance and compliance support alongside testing. No list price is published on the pages reviewed.
Best for: vendors entering Quebec's health network who want one Quebec firm for TGV preparation and the S16.03 test.
7. Blue Goat Cyber
Blue Goat Cyber is a medical device cybersecurity firm in Scottsdale, Arizona. Its SaMD cybersecurity service describes "The Entire Premarket Cybersecurity Package for Software as a Medical Device", covering the section 524B submission: threat model, secure architecture, SBOM, "cloud + mobile + API pen testing", a vulnerability management plan and labeling, with extensions for products that use machine learning.
Delivery model: fixed-scope premarket packages and stand-alone medical device penetration testing. No list price is published on the pages reviewed.
Best for: software as a medical device companies that want the penetration test produced as part of a complete FDA premarket cybersecurity file.
8. NowSecure
NowSecure is a mobile application security company headquartered in Chicago, Illinois. Its healthcare page addresses mHealth apps, offers expert-led mobile app penetration testing alongside automated testing, and ties findings to compliance implications including HIPAA.
Delivery model: a mobile testing platform plus penetration testing as a service. No list price is published on the pages reviewed.
Best for: healthtech companies whose product is primarily an iOS and Android patient app and its API.
9. Fortified Health Security
Fortified Health Security is a healthcare-focused security firm based in Brentwood, Tennessee. Its Healthcare Technology, Medical Devices and Biotech page describes helping healthcare technology providers assess third-party risk and manage vulnerabilities "to protect data, ensure operational efficiency, and build customer trust", and its advanced penetration testing page covers internal networks, public-facing systems, Wi-Fi environments and web applications, with red team exercises for healthcare organizations ready to go a step further.
Delivery model: advisory and managed security, with testing as one service line. No list price is published on the pages reviewed.
Best for: healthtech companies that want penetration testing inside an ongoing managed security and third-party risk relationship.
10. A-LIGN
A-LIGN is a compliance assessment firm headquartered in Tampa, Florida. Its healthcare page covers HITRUST and HIPAA assessments alongside penetration testing and red team services, and on 11 March 2026 it announced an integration and resale partnership with HITRUST. Its testing is delivered by Pathfynder by A-LIGN, a penetration testing team the company says operates independently from its assurance and assessment teams "to protect the integrity of both functions."
Delivery model: assessment-led, with a separate offensive team. No list price is published on the pages reviewed.
Best for: vendors buying a HITRUST or SOC 2 assessment who want the test under the same contract, with independence documented.
A healthtech vendor's penetration testing checklist
[ ] Map each market to its instrument: TGV, Ontario Health verification, a HIPAA business associate agreement, HITRUST or SOC 2, FDA or Health Canada for devices.
[ ] Confirm with the Quebec bureau (certification@sante.quebec) that the testing firm is accepted before commissioning the S16.03 test.
[ ] Write the role matrix: every role and what it may see and do.
[ ] Give testers white box access: source, architecture, API specifications, prompts and tool definitions.
[ ] Put hosting and cloud infrastructure in scope, as Ontario Health's 2.3.10 requires.
[ ] Specify the report up front: TGV's eight elements, FDA's five where applicable, and a shareable letter.
[ ] Retest critical and high findings before the report goes to a customer; once TGV-certified, report a critical to the bureau immediately with a mitigation plan within three business days.
[ ] Test at least annually, after every major release or architecture change, and ahead of the TGV self-declaration.
[ ] Keep the evidence pack current: report, retest results, letter, scan summaries and the SOC 2, ISO 27001 or HITRUST document.
How much does healthtech penetration testing cost in 2026?
Cost follows scope: applications, roles, interfaces, mobile apps, AI features and report requirements. Stingrai publishes package pricing: an Autonomous Pentest at US$3,000 per assessment or US$650 per month on a 12-month plan, and a Hybrid Pentest at US$6,800 per assessment or US$1,275 per month, each covering one web application and associated APIs (pricing page); larger and TGV scopes are quoted. The C$15,000 TGV fee is separate and payable to Santé Québec. For benchmarks, see the penetration testing cost guide and the pentest cost calculator.
Frequently Asked Questions
Who are the best healthtech penetration testing companies in 2026?
The best healthtech penetration testing companies in 2026 are Stingrai, Clearwater, Meditology Services, Cobalt, NetSPI, OKIOK, Blue Goat Cyber, NowSecure, Fortified Health Security and A-LIGN. Stingrai ranks first: a CREST-accredited firm headquartered in Toronto that puts two named penetration testers on the product, tests every role and patient-scoped endpoint white box, and includes retesting and an attestation letter, as a one-time annual test or a continuous program. Every vendor entry links to the vendor's own website, checked on 11 October 2026.
Does a healthtech vendor need a penetration test to sell into Quebec?
Yes, if the product needs TGV certification. Criterion S16.03 of the list of 24 April 2026 requires a penetration test administered by an independent provider recognized by Santé Québec, the bureau's orientation does not accept black box testing, and item 3 of the TGV attestation requires at least one test a year after certification, filed with the annual self-declaration.
Does Ontario Health require penetration testing for virtual care solutions?
Yes, for solutions seeking verification under the Virtual Visits Solution Requirements. Mandatory requirement 2.3.10 of version 3.1, dated 15 September 2026, states that penetration tests are to be done at a minimum on an annual basis, or after a major software release or change in architecture or infrastructure, and must include the application and application infrastructure. The verification program itself is voluntary and free.
Does HIPAA require business associates to do penetration testing?
Not by name. Business associates must comply with the Security Rule under 45 CFR 164.302, including its risk analysis and periodic evaluation, and are directly liable for failing to do so. The proposed rule at 90 FR 898 would add an annual penetration test and require covered entities to obtain yearly written verification from business associates, but as of 11 October 2026 it is not final, and the current Unified Agenda lists it under Long-Term Actions with a final action date of July 2027.
Is SOC 2 or HITRUST enough for a hospital security review?
Often it is the starting point rather than the whole answer. Ontario Health's virtual visits standard accepts a SOC 2 Type 2 report, ISO 27001 or HITRUST r2 under requirement 2.3.8 and still requires annual penetration testing under 2.3.10. Neither the AICPA criteria nor HITRUST's public documents set a fixed penetration testing frequency, so evidence of testing has to be requested separately.
Do FDA cybersecurity rules apply to my healthtech product?
Only if the product is a medical device. Section 520(o)(1) of the Federal Food, Drug, and Cosmetic Act excludes administrative software, wellness software, certain electronic patient record functions, software that only transfers, stores or displays device data, and qualifying clinical decision support from the device definition. For a device with cybersecurity considerations, FDA's guidance of 3 February 2026 asks for penetration test reports covering tester independence and technical expertise, scope, duration, methods, and results, and section 524B adds statutory requirements for cyber devices.
What should a healthtech penetration test cover?
Patient-identifier authorization on every endpoint, the full role matrix, isolation between customer organizations, FHIR, HL7 and integration interfaces, AI features, mobile patient apps and their APIs, and the telehealth session layer, with the application infrastructure. White box testing is the safe default because Quebec does not accept black box testing.
How much does a healthtech penetration test cost?
It depends on scope. Stingrai's published packages are US$3,000 per assessment for the Autonomous Pentest and US$6,800 per assessment for the Hybrid Pentest, each covering one web application and associated APIs, or US$650 and US$1,275 per month on a 12-month plan. Platforms with several applications, mobile apps, AI features or a TGV scope are quoted.
Related reading
Best Healthcare Penetration Testing Companies (2026), for providers and payers.
Best Healthcare Penetration Testing Companies in Canada (2026), for Canadian hospitals.
Best Medical Device Penetration Testing Companies (2026), for firmware and hardware scopes.
TGV Certification and Penetration Testing (2026), the full Quebec certification walkthrough.
TGV Certification for AI Health Tools in Quebec (2026), for the 69 AI criteria and the prompt injection report.
HIPAA Penetration Testing Requirements (2026) and HITRUST Penetration Testing Requirements, for the US frameworks clause by clause.
References
HHS Office for Civil Rights, Change Healthcare Cybersecurity Incident FAQ (reviewed 13 August 2025). https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html
MSSS, Critères de vérification de la TGV, version 2026-04-24. https://www.msss.gouv.qc.ca/professionnels/documents/technologies-information/certification-produits-services/liste-criteres-TGV_v2026-04-24.xls
Bureau de certification, Orientation concernant les tests d'intrusion. https://www.msss.gouv.qc.ca/professionnels/documents/technologies-information/certification-produits-services/orientation-tests-intrusion.pdf
Santé Québec, Attestation, certification TGV (BC-D0001-01). https://www.msss.gouv.qc.ca/professionnels/documents/technologies-information/certification-produits-services/BC_TGV_ATTESTATION.pdf
MSSS, À propos de la certification (updated 5 May 2025). https://www.msss.gouv.qc.ca/professionnels/technologies-information/certification-produits-et-services-technologiques/a-propos-certification/
Santé Québec, Entente, certification TGV (BC-D0002-01). https://www.msss.gouv.qc.ca/professionnels/documents/technologies-information/certification-produits-services/BC_TGV_ENTENTE_SQ_Fournisseur.pdf
Ontario Health, Virtual Visits Solution Requirements, version 3.1, 15 September 2026. https://ontariohealth.ca/content/dam/ontariohealth/documents/virtual-verification-solutions-standard.pdf
Ontario Health, Virtual Visits Verification Standard (updated 4 June 2026). https://ontariohealth.ca/system-planning/digital-standards/virtual-visits-verification
Ontario Health, Online Appointment Booking Service Standard, version 2.0, spring 2024. https://ontariohealth.ca/content/dam/ontariohealth/documents/online-appointment-booking-service-standard.pdf
Ontario, O. Reg. 329/04, section 6. https://www.ontario.ca/laws/regulation/040329
eCFR, 45 CFR 160.103, 164.302, 164.308 and 164.314. https://www.ecfr.gov/current/title-45/section-164.314
HHS, Direct Liability of Business Associates. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/factsheet/index.html
HHS OCR, HIPAA Security Rule proposed rule, 90 FR 898, 6 January 2025, RIN 0945-AA22. https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information
OIRA, Unified Agenda, RIN 0945-AA22, publication 202510. https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0945-AA22
HITRUST, Assessments and Certifications. https://hitrustalliance.net/assessments-and-certifications
HITRUST, Assessment Handbook, version 1.2. https://hitrustalliance.net/hubfs/Website/PDF%20Downloads/Final%20-%20HITRUST%20Assessment%20Handbook%20v1.2.pdf
AICPA, 2017 Trust Services Criteria (Revised Points of Focus, 2022). https://assets.ctfassets.net/rb9cdnjh59cm/2sK6Ih6dzy6t7aU6RQvoeD/d97a2a14609e74a1af1ce9ab0b142b69/92317096_trust_services_criteria_red-lined_version.pdf
21 U.S.C. 360j(o). https://www.govinfo.gov/content/pkg/USCODE-2024-title21/html/USCODE-2024-title21-chap9-subchapV-partA-sec360j.htm
FDA, Clinical Decision Support Software, January 2026. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/clinical-decision-support-software
FDA, Cybersecurity in Medical Devices, 3 February 2026. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-management-system-considerations-and-content-premarket
Health Canada, Pre-market Requirements for Medical Device Cybersecurity, effective 26 June 2019. https://www.canada.ca/en/health-canada/services/drugs-health-products/medical-devices/application-information/guidance-documents/cybersecurity/document.html
HHS, HPH Cybersecurity Performance Goals. https://hhscyber.hhs.gov/cybersecurity-performance-goals.html
OWASP, API Security Project. https://owasp.org/API-Security/
Talk to Stingrai
One test often has to answer three audiences: a Quebec bureau that accepts white box testing in all cases and rejects black box, an Ontario Health verification that wants the application and its infrastructure tested every year, and a US hospital that wants a recent independent test and a letter it can file. Stingrai scopes one engagement for all three: two named penetration testers, every role and patient-scoped endpoint, AI features and mobile apps where they exist, retesting and an attestation letter, as a one-time annual test or a continuous program. Book a free scoping call, get a quote for a multi-application or TGV scope, or read the published packages on the pricing page.
