On 2 October 2025 the one-year compliance period in New York's hospital cybersecurity regulation ran out. Since that date every general hospital licensed under Article 28 of the Public Health Law has had to run a cybersecurity program that includes, at a minimum, a penetration test of its information systems at least once a year, under 10 NYCRR 405.46(f)(2)(i). The Department's regulatory impact statement says that in 2023 it "has responded to more than 1 cybersecurity incident per month, several of which have forced hospitals to go on diversion." October 2026 closes the first full year, so a hospital that tested by the compliance date is now due again (our reading).
Quick answer. Yes. 10 NYCRR 405.46(f)(2)(i) requires every general hospital licensed under Article 28 to include "penetration testing of the hospital's information systems by a qualified internal or external party at least annually based upon the hospital's risk assessment," and the requirement has applied since 2 October 2025. The tester may be internal or external if qualified; the risk assessment sets scope; scans, timely remediation and six-year records sit alongside. Stingrai, a CREST-accredited penetration testing firm, delivers this test human-led across networks, Active Directory and patient portals, plus phishing exercises for (l)(2), with retesting and an attestation letter, as a one-time annual engagement or a continuous program.
Quotations are from the adopted text; this is not legal advice.
What 405.46 says about penetration testing
Subdivision (f), titled "Testing and vulnerability assessments," is the operative text:
(f)(1) The cybersecurity program for each hospital shall include monitoring and testing, developed in accordance with the hospital's risk assessment, designed to assess the effectiveness of the hospital's cybersecurity program and assess changes in information systems that may create or indicate vulnerabilities.
> > (f)(2) The monitoring and testing shall include at a minimum: (i) penetration testing of the hospital's information systems by a qualified internal or external party at least annually based upon the hospital's risk assessment; (ii) automated scans or manual or automated reviews of information systems reasonably designed to identify publicly known cybersecurity vulnerabilities in the hospital's information systems based on the risk assessment; and (iii) timely remediation of vulnerabilities based on the risk they pose to the hospital.
The definition at (b)(9) reads: "'Penetration testing' is a test methodology in which assessors attempt to circumvent or defeat the security features of an information system from outside or inside the hospital's information systems."
Four readings matter in a scoping call.
Annual is a floor. "At a minimum" and "at least annually" set it. The risk assessment can add scope or frequency, never subtract the annual test.
Qualified, not necessarily external. Subdivision (i)(2) adds that a hospital "may utilize an affiliate or qualified third-party service provider." HHS's Health Industry Cybersecurity Practices (2023) agrees that tests "can be run internally by qualified individuals, or they can be run by external partners." An external tester remains the simpler choice, because independence is easier to evidence than to argue.
"Outside or inside", not "both". New York's financial regulator requires testing "from both inside and outside the information systems' boundaries" in 23 NYCRR 500.5(a)(1). Read literally, 405.46 leaves the split to the risk assessment. Skipping the inside is still hard to defend: in Stingrai's State of Penetration Testing 2026, 92% of internal network findings were High or Critical against 54% for web applications (not a hospital-only dataset).
The scan is not the test. Scans sit in (f)(2)(ii), the test in (f)(2)(i). HICP: "Penetration tests involve more than simply conducting vulnerability scans and attempting to exploit the findings." The Department's control mapping ties (f)(2) to NIST SP 800-53 CA-8 (penetration testing), PM-14 and RA-5.
Who 405.46 covers, and who it does not
Subdivision (a): "This section shall apply to all general hospitals licensed pursuant to article 28 of the Public Health Law." Answering a commenter, the Department said the regulations "only apply to Article 28 general hospitals and not to managed care organizations." The clause names no other facility type, so nursing homes, diagnostic and treatment centers and physician practices sit outside 405.46 itself; their HIPAA obligations are unchanged.
The Department notes that Veterans Affairs facilities are not affected. In a health system the obligation attaches to each licensed general hospital. Our reading: (i)(2) lets a hospital use "an affiliate or qualified third-party service provider to assist in complying," so one test of shared infrastructure can serve several hospitals if the report maps findings to each.
405.46 next to NYDFS Part 500
The testing sentence closely tracks New York's financial services rule, with a few differences.
Point | 10 NYCRR 405.46 (general hospitals) | 23 NYCRR 500.5 (DFS covered entities) |
|---|---|---|
Test frequency | "at least annually," (f)(2)(i) | "at least annually," 500.5(a)(1) |
Who may test | "a qualified internal or external party" | "a qualified internal or external party" |
Scope words | "the hospital's information systems," "based upon the hospital's risk assessment"; defined as "from outside or inside" | "their information systems from both inside and outside the information systems' boundaries" |
Scanning | Automated scans or manual or automated reviews, per the risk assessment | Automated scans plus manual review of systems scans miss, per the risk assessment and after material changes |
Incident notice | No later than 72 hours, (n)(1) | No later than 72 hours, 500.17(a)(1) |
Records | At least six years, (g) and (n)(2) | Five years, 500.17(b)(3) |
Our NYDFS penetration testing guide covers the financial side.
Scoping the annual test from the risk assessment
Subdivision (h)(1) requires "an accurate and thorough annual risk assessment," and (f)(2)(i) ties the test to it. The definition of an information system at (b)(6) is broad: "a discrete set of electronic information resources," including "any specialized system such as industrial/process controls systems, telephone switching and private branch exchange systems, and environmental control systems. One such example is an electronic health records system."
A defensible hospital scope usually covers:
EHR and clinical applications. Subdivision (c)(4) requires "procedures for evaluating, assessing and testing the security of externally developed applications utilized by the hospital." Test the hospital's configuration, roles and integrations, with the vendor's written authorization where the platform is vendor-hosted.
Patient portals, telehealth and their APIs. The finding that matters is one patient reaching another patient's records, which needs authenticated web application testing across roles.
Active Directory and identity. Subdivision (k) requires separate privileged accounts and at least annual access reviews; an Active Directory assessment tests whether they hold.
Remote access and vendor connections. Under (k)(2), multi-factor authentication is required for anyone "accessing the hospital's internal networks from an external network" unless the CISO approves compensating controls in writing, and (k)(8) requires hospitals to "disable or securely configure all protocols that permit remote control of devices." Vendor support paths fall under the third-party policies in (j).
Medical devices and biomedical networks. Test the segmentation that isolates them, under rules agreed with clinical engineering. HICP warns that traditional vulnerability scanners "can negatively impact patient safety" on medical devices.
Building and process systems named in (b)(6), where reachable from other networks.
People. Training under (l)(2) "may include annual phishing exercises"; a phishing campaign supplies the measurement.
Record every exclusion and its reason; an unrecorded exclusion looks like a gap.
The evidence the Department can ask for
Subdivision (n)(2) requires each hospital to "maintain and submit for examination" documentation supporting the section, as the Department determines, kept "for a minimum of six years." Subdivision (n)(3) adds that where a hospital has identified areas "that require material improvement, updating or redesign," it "shall document the identification and the remedial efforts planned, and underway." Subdivision (e)(3) requires the CISO to report in writing "at least annually" to the governing body, including the "overall effectiveness of the hospital's cybersecurity program."
An annual test that survives examination produces:
The scope, traced to the risk assessment, with exclusions and reasons.
Written authorization and rules of engagement. HICP: "proper authority to perform the test must be documented."
Tester qualifications, the evidence for the word "qualified."
The report, with methodology, severities and reproduction steps, internal and external work kept identifiable.
The remediation record and plan that (f)(2)(iii) and (n)(3) ask for.
The retest report, which turns "planned" into done.
The CISO's annual report to the governing body, citing the results.
As of 13 October 2026 we found no published survey protocol specific to 405.46; the Department's page (revised February 2025) carries the regulation, reporting procedure, control mapping and three FAQs.
How 405.46 sits beside HIPAA, HICP and HITRUST
HIPAA today. The Security Rule names no penetration test. Its closest standard, 45 CFR 164.308(a)(8), requires "a periodic technical and nontechnical evaluation." The Department describes 405.46 as "intended to supplement HIPAA," and (h)(1) accepts a HIPAA risk assessment "provided they comport with the requirements herein"; see our HIPAA guide.
The HIPAA proposal, still pending. The proposed rule published on 6 January 2025 (90 FR 898) would require penetration testing by a qualified person "at least once every 12 months" or as the risk analysis requires, "whichever is more frequent," plus vulnerability scans at least once every six months. That cadence is proposed, not law. As of 13 October 2026 the Federal Register lists only the proposed rule under RIN 0945-AA22, and the 2026 Unified Agenda lists it under Long-Term Actions with a July 2027 target; the Spring 2025 agenda had said May 2026. A hospital meeting 405.46 already runs the test it would add.
HICP and HITRUST. The Department's mapping links (f)(2) to HICP sub-practices including 7.L.A, Penetration Testing, which lists medical technologies among test targets. It cites NIST and HICP, not HITRUST, though a HITRUST-certified hospital can reuse the same test; see our HITRUST guide.
A first-year plan and cadence calendar
When | Activity | Subdivision |
|---|---|---|
Month 1 | Refresh the risk assessment and asset list; set scope, exclusions and vendor authorizations | (h)(1), (j) |
Month 2 | External perimeter and remote access test; phishing exercise | (f)(2)(i), (k)(2), (l)(2) |
Months 3 to 4 | Internal network and Active Directory from an assumed-breach position; segmentation into biomedical networks | (f)(2)(i), (k) |
Months 4 to 5 | Patient portal, telehealth and externally developed application tests | (c)(4), (f)(2)(i) |
Months 5 to 7 | Fix by risk; retest; document anything still open | (f)(2)(iii), (n)(3) |
Month 9 | CISO's written report to the governing body | (e)(3) |
All year | Scans or reviews for publicly known vulnerabilities; retest after material changes | (f)(2)(ii), (f)(1) |
Month 12 | Archive the year's evidence for six years; start the next cycle | (g), (n)(2) |
Stingrai's State of Penetration Testing 2026 found a median of 10.5 days to fix a Critical finding against 38 days for a High, where resolution was tracked, so plan the remediation window too.
What a 405.46 program and test cost
The Department estimated that programs "can cost between $250,000 and $10 Million to develop and implement initially," with ongoing annual costs of US$50,000 to US$200,000 for its 15 small hospitals, US$200,000 to US$500,000 for 62 medium ones and US$2 million for 114 large ones. Those are program figures, not test prices. The Governor's November 2023 announcement cited "$500 million in funding" in the FY24 budget for technology upgrades, and the Department's adopted documents describe "Statewide IV and Statewide V funding totaling $650 million" to assist with compliance.
For a single web application such as a patient portal, Stingrai publishes fixed prices for one web application and associated APIs: the Autonomous Pentest by Snipe, with no penetration testers, at US$3,000 per assessment or US$650 per month, and the Hybrid Pentest at US$6,800 per assessment or US$1,275 per month, with monthly prices on a 12-month plan (pricing). A hospital's full 405.46 scope, with networks, Active Directory, several applications and phishing exercises, is human-led and quoted through get a quote; see the cost guide for benchmarks.
What to ask a penetration testing vendor
Who will test, and what qualifies them: named testers, certifications, firm accreditation?
Will internal and external work both be covered and reported separately?
How will you protect clinical systems and medical devices: testing windows, clinical engineering sign-off, no active device scanning without approval?
Will patient portals be tested with authenticated accounts in every role?
Is retesting included, with its own report?
Are findings delivered as confirmed, at every severity, with remediation guidance?
What evidence package will we receive for a Department examination?
Where Stingrai fits
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
For a New York hospital, that means a human-led annual test run by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, with 18 published CVEs across the team. Stingrai Inc, the contracting entity, holds the accreditation, as its CREST Marketplace profile shows: evidence for the word "qualified."
Testing scope: internal and external network, Active Directory, patient portal and web application testing, and phishing exercises for (l)(2), remotely and on site in New York where scoped.
Evidence for (n)(2) and (n)(3): whether the test is one-time or continuous, every confirmed finding, at every severity, is posted to the PTaaS platform the same day it is confirmed, with a proof of concept and remediation guidance; retesting is included; and every human-led and hybrid report ships with an attestation letter: pentest evidence for your 405.46 and HIPAA programs.
One-time or continuous: a one-time annual engagement timed to your cycle, or a continuous program alongside it.
Snipe, Stingrai's AI agent, covers web applications and their APIs only; in the Hybrid Pentest it tests a patient portal alongside the penetration testers, hunting IDOR, broken authorization and business logic flaws. Network, Active Directory and phishing work is human-led.
Frequently Asked Questions
Does 10 NYCRR 405.46 require penetration testing?
Yes. Subdivision (f)(2)(i) requires "penetration testing of the hospital's information systems by a qualified internal or external party at least annually based upon the hospital's risk assessment." It applies to every general hospital licensed under Article 28 of the Public Health Law and has been enforceable since 2 October 2025, when the one-year compliance period in (p)(1) ended.
How often must a New York hospital run a penetration test under 405.46?
At least once a year. The rule says "at a minimum" and "at least annually," so annual is the floor; the risk assessment, refreshed at least annually under (h)(1), can add scope or frequency.
Who can perform the penetration test under 405.46?
A "qualified internal or external party." There is no requirement to hire an outside firm, and (i)(2) lets a hospital use "an affiliate or qualified third-party service provider." The hospital must be able to evidence the tester's qualification.
Which facilities does 405.46 apply to?
All general hospitals licensed under Article 28 of the Public Health Law. The Department said the regulations "only apply to Article 28 general hospitals and not to managed care organizations," and the clause names no other facility type.
Does 405.46 require testing from both inside and outside the network?
Not in those words. The definition at (b)(9) covers testing "from outside or inside the hospital's information systems," and the risk assessment decides the scope; NYDFS Part 500, by contrast, requires both. A program that tests only the perimeter leaves clinical networks and directory services untested, which is hard to defend.
What penetration testing records must a hospital keep under 405.46?
At least six years of documentation supporting the section, available for Department examination under (n)(2), including the remedial efforts planned and underway under (n)(3). In practice: scope, authorization, tester qualifications, report, remediation record, retest report and the CISO's annual report.
Does HIPAA require penetration testing in 2026?
Not by name. The Security Rule requires a periodic technical and nontechnical evaluation under 164.308(a)(8). The January 2025 proposal would require penetration testing at least once every 12 months, but as of 13 October 2026 it is not final; the 2026 Unified Agenda targets July 2027.
How is 405.46 different from NYDFS Part 500?
The testing sentence is nearly the same: annual, by "a qualified internal or external party." Part 500 adds "from both inside and outside the information systems' boundaries" and five-year records where 405.46 requires six. Both require incident notice within 72 hours.
Related reading
References
New York State Department of Health. 10 NYCRR 405.46, Hospital Cybersecurity Requirements, effective 2 October 2024 (Notice of Adoption, NYS Register, 2 October 2024, Vol. XLVI, Issue 40, I.D. No. HLT-49-23-00001-A). https://regs.health.ny.gov/content/section-40546-hospital-cybersecurity-requirements
New York State Department of Health. Hospital Cybersecurity Requirements, adopted text with impact statements and Assessment of Public Comment. https://regs.health.ny.gov/sites/default/files/pdf/recently_adopted_regulations/Hospital%20Cybersecurity%20Requirements.pdf
New York State Department of Health. Hospital Cybersecurity Requirements page, FAQs and control mapping workbook, revised February 2025. https://www.health.ny.gov/facilities/hospital/cybersecurity/
Office of the Governor of New York. Governor Hochul Announces Proposed Cybersecurity Regulations for Hospitals Throughout New York State. 13 November 2023. https://www.governor.ny.gov/news/governor-hochul-announces-proposed-cybersecurity-regulations-hospitals-throughout-new-york
New York State Department of Financial Services. Second Amendment to 23 NYCRR Part 500, adopted text, sections 500.5 and 500.17. https://www.dfs.ny.gov/system/files/documents/2023/10/rf_fs_2amend23NYCRR500_text_20231101.pdf
eCFR. 45 CFR 164.308, Administrative safeguards. https://www.ecfr.gov/current/title-45/section-164.308
Federal Register. HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, proposed rule, 6 January 2025, 90 FR 898. https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information
Office of Information and Regulatory Affairs. Unified Agenda entry, RIN 0945-AA22. https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0945-AA22
HHS 405(d). HICP Technical Volume 2: Cybersecurity Practices for Medium and Large Healthcare Organizations, 2023 Edition. https://hhscyber.hhs.gov/Documents/HICP/tech-vol2-508.pdf
Stingrai. The State of Penetration Testing 2026. https://www.stingrai.io/reports/state-of-penetration-testing-2026
Stingrai. Pricing. https://www.stingrai.io/pricing
Talk to Stingrai
If your hospital's next 405.46 test is due, Stingrai will scope it against your risk assessment: named penetration testers, network, Active Directory and patient portal testing, phishing exercises, retesting and an attestation letter, as a one-time annual engagement or a continuous program. Get a quote or see pricing.
