Penetration Testing for the Healthcare Sector.
EHR portals, patient applications and staff portals are high-value targets. Resync tests manually for vulnerabilities in NEN 7510 context, with respect for patient data and care continuity. Want an overview of our general pentest offering first? That page covers scope categories, pricing model and process in one overview.
Highest risk, highest impact.
The healthcare sector has a unique risk profile: maximum data value, minimum tolerance for downtime, and strict statutory obligations. Patient records are worth 10× more than credit card data on the dark web — used for identity fraud, insurance fraud, and extortion.
At the same time, a hospital cannot simply be taken offline "for maintenance". Attackers know this, and exploit it. Ransomware groups specifically target healthcare because organisations pay faster and higher than other sectors.
In 2024, Dutch hospitals, mental health providers and GP networks were repeatedly hit by cyber incidents — often through the same vulnerability classes that a manual pentest would have detected in advance.
Pentest as auditable evidence.
NEN 7510 ("Information security in healthcare") requires healthcare organisations to demonstrably protect patient data. The standard does not explicitly mandate a pentest, but does require periodic verification of technical security measures. In practice, an independent penetration test is the standard form of evidence.
What a pentest covers within NEN 7510
- A.12.6.1, Management of technical vulnerabilities: demonstrable identification and assessment
- A.14.2.8, Systems security testing: requires active verification
- A.18.2.3, Technical compliance review: pentest as objective evidence
- Risk management around processing under GDPR Art. 32, adequate technical measures
The Resync report is structured to serve as evidence to a NEN 7510 auditor, IGJ supervision, the Dutch Data Protection Authority and internal governance. Not a loose PDF — a structured document with management summary, technical findings and retest declaration.
What Resync tests in healthcare organisations.
EHR portals & patient portals
Authentication, authorisation, IDOR on patient identifiers, integrations with DigiD/MyHealth, session management.
Staff portals
Roles and permissions, segregation between disciplines, access to records outside the treatment relationship.
Online appointment systems
Booking flows, rescheduling, cancellations — often carrying IDOR risks on appointment IDs and patient numbers.
External integrations
Integrations with labs, pharmacies, insurers and care groups. API tokens, mTLS, per-party authorisation.
Network segmentation
Isolation of medical-technical equipment, OT networks and office automation. Lateral movement tests.
Public-facing services
External websites, e-consult, intake forms and chat features — often the primary attack path.
Safe and careful, without disrupting care.
Working in a healthcare environment requires an adapted approach. Resync applies standard protocols:
- Testing in acceptance environment wherever possible, with synthetic data
- For production tests: pre-agreed stop criteria and a direct escalation line
- No exfiltration of patient data; evidence via screenshots with redacted data
- No denial-of-service tests without explicit written consent
- Daily status updates during the testing period
- NDA and data processing agreement (GDPR Art. 28) standard
At a healthcare organisation, Resync discovered an IDOR vulnerability in the patient portal: by simply changing the ID in the URL, it was possible to retrieve another patient's records. Demonstrably resolved before the production release — preventing a data breach potentially affecting tens of thousands of individuals.
Questions from healthcare organisations.
What exactly is a NEN 7510 penetration test?
Do you test in production or acceptance?
How does this relate to an external IT provider or vendor?
Is a data processing agreement signed?
Demonstrable security for your healthcare organisation.
One conversation about scope, NEN 7510 context and planning. Fixed-price quote within one business day, free intake.
Book a free intake → Back to home