Compliance
10 NYCRR 405.46, Hospital Cybersecurity Requirements
Component tests from $4,200, free retest. See all pricing →
Last reviewed
Reply in one business day
Thanks, we've received your message.
We'll be in touch shortly.
When you need it
The situations that bring teams to this engagement, and where it fits alongside the rest of your program.
The rule
New York hospital cybersecurity regulations sit in one section, 10 NYCRR 405.46, which the Department of Health adopted effective October 2, 2024 and made fully enforceable on October 2, 2025. It applies to every general hospital licensed under article 28 of the Public Health Law, and unlike the HIPAA Security Rule it names the penetration test outright. The requirements that bear on testing:
Requirement
Cadence
What Invadel delivers
Scope
The rule’s definition is wider than many hospital asset lists. It covers any discrete set of electronic information resources, names industrial and process control systems, telephone switching and PBX systems, and environmental control systems, and gives the electronic health record as its example. A test scoped to the corporate network alone leaves most of that out.
The EHR, PACS, laboratory, and pharmacy systems, and the HL7 and FHIR interfaces between them. Tested in a staging or mirrored environment wherever one exists.
Portals, scheduling, telehealth, and billing: internet-facing and full of nonpublic information. Tested as web application and API engagements.
Active Directory, remote access, and the segmentation between clinical, corporate, biomedical, and guest networks, the paths ransomware uses to spread.
Building management, HVAC and environmental controls, and telephone switching and PBX systems, tested with plant-safe OT methods.
Vendor remote-support paths, which subdivision (j) makes the hospital govern, and medical devices, tested as a separate engagement; our guide to medical device penetration testing explains how.
What we assess
The rule defines penetration testing as an attempt to circumvent or defeat the security features of an information system from outside or inside the hospital’s systems. We run both, scoped to the systems that hold nonpublic information and keep care running.
The internet-facing edge, VPN and remote access, and the MFA 405.46(k)(2) requires for anyone reaching the internal network from an external one.
We test for
How far one phished workstation reaches toward the EHR, and whether privileged accounts are separated and limited as 405.46(k) requires.
We test for
The EHR, portals, and applications the hospital must assess, whether developed in-house or bought.
We test for
The rule’s definition of an information system includes industrial and process controls, telephone switching and PBX systems, and environmental control systems.
We test for
Patient safety
A test that degrades a clinical system puts patients at risk, so these rules are agreed in writing with IT and clinical engineering before any testing starts.
Compare
New York hospitals carry both. The state rule covers fewer organizations and says more about what they must do.
HIPAA Security Rule
10 NYCRR 405.46
For the federal safeguards in detail, read our guide to HIPAA technical safeguards.
Governing body
Section 405.46(e)(3) requires the CISO to report in writing, at least annually, to the governing body on the cybersecurity program, material risks, and the program’s overall effectiveness. Subdivision (n) requires the hospital to keep supporting records for six years and produce them for examination. The test deliverables are written for both readers.
Hospitals anywhere in New York State are served from our Manhattan office: external and application testing run remotely, internal testing runs through a small device we ship, and we come on site when the scope needs it; see penetration testing in New York City.
Methodology
Every engagement follows the Penetration Testing Execution Standard and the relevant OWASP guides.
These are the phases your compliance test runs through.
The systems your framework actually covers, and nothing you would pay to test twice.
The component penetration tests run to PTES and OWASP standards by senior testers.
Every finding tied to the requirement or control it evidences.
Evidence formatted the way your assessor, examiner, or QSA expects to read it.
A free retest so the audit shows closed findings, not open ones.
How it works
From scope through the final retest, your team stays in the loop at every step, with findings tracked live in our platform.
Scope with clinical teams
We map the information systems in scope and agree exclusions, testing windows, and stop conditions with IT and clinical engineering.
Annual test
External and internal penetration testing, with scans and application testing where the risk assessment calls for them.
Report for the CISO
Findings ranked by risk to the hospital, written for the CISO’s report to the governing body.
Fix & retest
Close the findings, then a free retest so remediation is documented for the Department.
Fixed prices
Published starting prices, fixed in writing before work begins. The annual test is the first two.
What it covers
Price
Every starting price is on our pricing page. Health systems with several campuses are quoted from the network layout, as one fixed price.
Component tests
Compliance testing is built from our standard fixed-scope engagements. Each one is scoped to your boundary and reported against the framework.
Proof
Every engagement is confidential, so the work below is anonymized to sector and engagement type.
Free
Retest on every penetration test
185+
Years combined experience
14
Senior in-house specialists
24h
Onboarding after signing
Healthcare · Imaging
Organization-Wide Phishing Simulation
Over half the workforce took the bait: roughly a third clicked the link and a quarter entered their credentials on the simulated capture page.
Outcome. Quantified credential-compromise risk across the whole organization and delivered a prioritized program of role-targeted awareness training, recurring simulations, and a faster, simpler reporting workflow.
11,800+
Employees targeted
53%
Phish-prone
24%
Entered credentials
HR & Payroll SaaS
Web Application Penetration Test
Critical: a file-inclusion flaw that let an attacker read sensitive files from the server through the application itself. High: stored cross-site scripting capable of session theft, insecure direct object references, and an authorization bypass that let an administrator create or delete organization owners.
Outcome. Delivered a remediation plan sequenced by real business impact, critical and high findings first, with a complimentary retest to verify every fix.
28
Findings
1
Critical
5
High
Resources
HIPAA Compliance Checklist: Security Rule Requirements, Privacy and Breach Notification (2026)
A 2026 HIPAA compliance checklist: each Security Rule safeguard marked required or addressable, Privacy and Breach Notification items, and evidence to keep.
HIPAA Security Rule Technical Safeguards: What §164.312 Requires in Practice
HIPAA Security Rule technical safeguards in 45 CFR 164.312: access control, audit, integrity, authentication and transmission, and what a test evidences.
HIPAA Penetration Testing Requirements: What the Security Rule Requires Now and What Is Proposed
HIPAA penetration testing requirements: what the Security Rule requires today, the proposed annual test and six-month scans, what OCR penalizes, how to scope.
Want to see a report first?
Read a sample report for a fictional client, or request a redacted one from a real engagement. Our guide explains what a penetration testing report should contain.
FAQ
What teams most often ask before
NY Hospital 405.46 testing.
Yes. Section 405.46(f)(2)(i) requires penetration testing of the hospital’s information systems by a qualified internal or external party at least annually, based on the hospital’s risk assessment. Paragraph (f)(2)(ii) adds automated scans, or manual or automated reviews, designed to identify publicly known cybersecurity vulnerabilities, and (f)(2)(iii) requires timely remediation based on the risk each vulnerability poses to the hospital.
All general hospitals licensed under article 28 of the New York Public Health Law. In a health system, every licensed general hospital is covered, so testing is usually scoped across the shared network and EHR in a way that reaches each hospital’s systems.
Section 405.46 was adopted and took effect on October 2, 2024. Hospitals had one year to comply, so the full rule has been enforceable since October 2, 2025. The 72-hour incident reporting requirement in subdivision (n) applied immediately on adoption.
The rule allows a qualified internal or external party. An internal team can qualify, but it would be testing systems it built and runs, and the CISO’s annual report to the governing body carries more weight when the test is independent. Many hospitals use an outside firm for the annual test and keep internal staff on scanning and remediation.
It can. Subdivision (h) accepts a risk assessment performed for another regulatory purpose, such as HIPAA, provided it meets the subdivision’s own requirements, including that it is accurate, thorough, and repeated every year. The annual penetration test is a separate obligation that feeds both. Our HIPAA penetration testing page covers the federal side.
A cybersecurity incident: a cybersecurity event that has a material adverse impact on the hospital’s normal operations, has a reasonable likelihood of materially harming them, or results in ransomware deployed within a material part of its information systems. The hospital must notify the Department as promptly as possible and no later than 72 hours after determining an incident occurred. That notice does not replace any other notification required under State or Federal law.
Yes, with plant-safe methods. The rule counts industrial and process controls, telephone switching and PBX systems, and environmental control systems as information systems, so they belong in scope. We start passively and touch live controllers only with written agreement and a facilities or clinical engineering contact on hand; see OT and ICS penetration testing. Medical devices are tested as a separate hardware engagement, never while attached to a patient.
Subdivision (j) requires each hospital to have written policies for the security of systems and information that third-party service providers can reach or hold: identifying and assessing those providers, setting the minimum cybersecurity practices they must meet, and setting guidelines on their access controls, encryption, notice to the hospital of a cybersecurity incident, and representations and warranties about their security. Expect security questionnaires and requests for a recent independent penetration test. A dated test of the product and the systems that hold hospital data answers most of them; our page on healthcare penetration testing covers vendor scopes.
The annual test is built from our published fixed prices: external network testing from $4,200 and internal network testing from $6,000, each with a free retest, plus web application testing from $5,200 for portals and in-house applications, and vulnerability scanning from $1,500 for up to 250 devices, with larger estates quoted. A health system with several campuses gets one fixed price from its network layout. Every starting price is on our pricing page.
Talk to our team about what your NY Hospital 405.46 compliance requires.
Prefer the full scoping questionnaire?Tell us what you need tested. We reply within one business day.
Thanks, we've received your message.
We'll be in touch shortly.
