Penetration Testing for UK Healthcare & the NHS Supply Chain
CREST-accredited penetration testing for NHS suppliers, digital health and healthtech firms, private healthcare, dental and mental health providers. Evidence for NHS DTAC, the DSPT and UK GDPR Article 32, across patient portals, EPR integrations, telehealth, e-prescribing and medical device companion apps. Patient-data-strict.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
months is the usual age limit NHS buyers applying DTAC set for your latest penetration test report, alongside a documented action plan for the findings.
What NHS Buyers & UK GDPR Expect
NHS DTAC. NHS buyers use the Digital Technology Assessment Criteria before they adopt a digital health product. Its technical security section expects evidence of penetration testing, typically an annual external test against the OWASP Top 10, a report from the last 12 months and an action plan for the findings. DTAC is a buyer requirement rather than law, but in practice you will not get through NHS procurement without it. NHS England: DTAC.
Data Security and Protection Toolkit. Organisations with access to NHS patient data or systems complete the DSPT every year. The current toolkit is aligned to the NCSC Cyber Assessment Framework, and its Guide 9 (IT protection) keeps an annual penetration test of web servers and critical network infrastructure. NHS DSPT.
UK GDPR Article 32. Health data is special category data. Article 32(1)(d) requires a process for regularly testing, assessing and evaluating the effectiveness of your security measures. It does not name penetration testing as the method, but a test is the most direct evidence that your controls work. UK GDPR Article 32.
Who we test for. NHS suppliers and clinical software vendors, digital health and healthtech start-ups, private hospitals and clinics, dental groups, mental health services and online pharmacies. For assurance-specific engagements see our NHS DTAC and DSPT pages.
SCOPE
What We Test for UK Healthcare & NHS Suppliers
Patient Portals & EPR
Patient-facing portals, electronic patient records and appointment booking. Patient-to-patient access (IDOR), proxy access for carers and parents, clinical role separation, record integrity and audit-log scrutiny.
E-Prescribing & Online Pharmacy
Prescription management, e-prescribing workflows and online pharmacy storefronts. Prescriber, pharmacist and patient role boundaries, approval and signature flows, order and payment integrity.
Telehealth & Digital Triage
Video consultation, secure messaging and digital triage apps. Consultation identity, meeting-link and attachment access, device storage of clinical data, OWASP Mobile Top 10.
Care-System Integrations & APIs
FHIR and HL7 interfaces, lab and EPR feeds, identity integrations. Object-level authorisation, consent scope, and the trust boundary between your product and the care systems it connects to.
Medical Device Companion Apps
Device-to-cloud connections, companion apps and IoMT APIs. Tested from the cloud side or on a bench unit, never on a patient-connected device.
Patient Data in the Cloud
AWS, Azure and GCP configuration with healthcare scrutiny. Encryption at rest, IAM scoping, audit logging and multi-tenant boundaries on shared platforms.
Clinical & Corporate Networks
Segregation between clinical, administrative and biomedical engineering networks. Active Directory attacks and the boundary between managed devices and clinical equipment.
Phishing Defence
Targeted phishing simulation against clinical admin, IT and finance staff, using NHS-aware lures such as NHSmail impersonation and supplier-payment fraud.
OUR PROCESS
From Scope to Attestation in 4-6 Weeks
Scoping Call
30-minute technical scoping call. Define attack surface, methodology, rules of engagement, safe testing windows and timeline. Fixed-price quote within 24 hours.
Active Testing
3-15 days of hands-on testing by CREST-certified pen testers, against non-production environments with synthetic patient data wherever possible. Daily status updates.
Reporting
Executive summary plus full technical report with CVSS scores, reproduction steps, screenshots, and specific remediation. 60-minute walkthrough call.
Free Retest
After remediation, we retest at no extra charge. Letter of attestation provided for DTAC, DSPT, buyer due diligence or audit.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST healthcare pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Aligned to Every Framework
Findings map to specific control references in each framework, so your audit team submits the report directly without translation work.
NHS DTAC
Technical security evidence: an independent test, a report from the last 12 months and an action plan for findings.
NHS DSPT
Evidence for Guide 9 (IT protection) of the CAF-aligned toolkit, which keeps an annual test.
UK GDPR
Article 32(1)(d) evidence that you regularly test the effectiveness of your security measures.
ISO 27001
Annex A 8.8 technical vulnerability management, once you declare that control applicable.
Cyber Essentials Plus
Often asked for by NHS buyers alongside DTAC. Certified directly by us as an IASME certification body.
NCSC CAF
Objective evidence for vulnerability management outcomes. The CAF does not require a pen test; testing is one form of evidence.
PRICING
Indicative Engagement Pricing
Fixed-price quotes confirmed during scoping. Free retest, executive summary, walkthrough call, and letter of attestation included.
Depends on service + scope
External / web / API / mobile single-target engagement. CREST-certified delivery. Around 3 to 5 working days from kickoff to report.
Get a fixed quoteDepends on service + scope
Multi-target combined engagement (web + API + external + AD), or single complex target. Typically 7-10 days.
Get a fixed quoteDepends on service + scope
Full-stack engagement (multiple cloud accounts, hybrid AD, complex web + API + mobile). Typically 12-15+ days.
Get a fixed quoteWHY EJN LABS
What You Get From Healthcare Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
Do you have NHS supply chain experience?
Yes. We test web applications and APIs for health technology suppliers selling into the NHS, with awareness of DTAC submissions, DSPT cycles and clinical safety processes. See our Techpharma case study.
What does a healthcare test look at that a standard web app test does not?
Patient-to-patient access, clinical role separation (clinician, admin, patient, carer), record integrity, consent handling, the security of integrations with care systems, and safe testing windows around clinical service hours.
Which healthcare organisations do you test for?
NHS suppliers and clinical software vendors, digital health and healthtech firms, private hospitals and clinics, dental groups, mental health services and online pharmacies.
How do you handle patient data during testing?
We ask for a non-production environment with synthetic or fully pseudonymised patient data. Production testing only goes ahead with explicit Information Governance approval and a restricted scope.
Can you test on an active medical device?
Direct testing of patient-connected medical devices is restricted to bench environments. We test the device-cloud connection and the device API surface from the cloud side, never on a patient-connected unit.
Can you support our DSPT submission?
Yes. Our reports can include an appendix mapping each finding to the relevant DSPT and CAF outcomes, so your submission shows what was tested, what was found and what was fixed. See our DSPT penetration testing page.
Can you support our DTAC submission?
Yes. We provide a report and remediation evidence written for DTAC’s technical security section: an independent test, a CVSS-scored report and confirmation of fixes. See our NHS DTAC penetration testing page.
What happens if testing finds a live exposure of patient data?
We do not exfiltrate patient data. If testing surfaces a live exposure, we stop, tell your nominated contact straight away and support your Information Governance team, who decide whether a report to the ICO is needed within 72 hours under Article 33.
What if our supplier processes are non-compliant?
Pre-test scoping identifies obvious supplier-side issues before active testing begins. We share the scoping output as actionable intelligence, then proceed with testing under your guidance regardless of supplier status.
What’s in the report?
Executive summary (board-ready), technical report with CVSS 3.1 scores, reproduction steps, screenshots, specific remediation guidance, and a 60-minute walkthrough call. Letter of attestation issued after free retest.
Do you sign NDAs?
Yes. We sign client-supplied NDAs as standard. Engagement data is protected under our ISO 27001 (BSI-audited) information security management system.
How quickly can you start?
From signed scope to active testing in 24 hours where required. Standard pipeline is 3-5 business days from initial scoping call to test start.
Are your testers UK-based and what certifications do they hold?
Every engagement is performed by vetted UK-based CREST-certified testers matched to your engagement based on security clearance, compliance scope, and sector specialism. Testers hold CREST certifications relevant to their discipline (CRT, CCT APP, CCT INF, CCSAM).
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get my Healthcare pen test scope
A CREST-certified pen tester will contact you within one business day with a fixed price aligned to your DTAC, DSPT and NHS buyer needs.
