Patient portal IDOR bug
Pre-prod authZ testing under SA-11 finds users can open other patients’ visit summaries by changing an ID. Release is blocked until fixed and retested.
Developer Security Testing and Evaluation
High Risk
Complex
Medium Cost
SA-11 requires requiring developers to create and implement a security and privacy assessment plan; perform testing/evaluation; produce evidence; correct flaws; and control testing environments and data. Shipping untested patient portals, billing APIs, or device gateways is a recurring HIPAA breach pattern.
Control Objective
Ensure software and configurations affecting ePHI undergo planned security and privacy testing with tracked remediation before production use — using protected test data and environments.
Implementation Guidance
- Define required test types by risk: SAST/DAST, authZ checks, privacy/minimum-necessary review, and dependency scans.
- Require a developer security/privacy test plan for major releases and new interfaces.
- Ban production ePHI in lower environments; use synthetic or properly de-identified datasets.
- Track defects to closure; block go-live on critical findings without documented risk acceptance.
- Segregate test environments and credentials from production.
- Retain test evidence (reports, tickets) for assessors and breach readiness.
- Extend testing expectations to BA-delivered customizations via contract.
- Re-test after significant remediations and before promoting hotfixes that touch auth or data export.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Analytics extract uses prod clone
A vendor asks for a full EHR DB copy for QA. SA-11 policy denies prod ePHI in test; synthetic cohort is provisioned instead.
Ransomware-era dependency CVE
Scanner finds a critical library in a scheduling API. Defect is tracked, patched, and regression-tested before the weekend deploy.
Best Practices
- Risk-based mandatory test suites.
- No real ePHI in non-prod by default.
- Defect SLAs for Critical/High.
- Retain evidence with releases.
- Independent testing for high-risk apps periodically.
- Include privacy misuse cases, not only XSS/SQLi.
Common Gaps & Violations
- Production PHI copied to vendor laptops for testing.
- Security testing skipped for “small” interface changes.
- Findings logged but never verified fixed.
- Shared test/prod credentials.
- Only happy-path functional QA — no abuse cases.
Required Documentation
- Developer testing and evaluation standard (SA-11)
- Security/privacy test plan templates
- Non-prod data handling rules
- Defect tracking and go-live gate criteria
- Sample test reports and remediation evidence
How to Test & Validate
- Sample a recent release for SA-11 test evidence.
- Verify critical defects were closed or risk-accepted formally.
- Inspect non-prod for presence of real ePHI.
- Confirm test plan covers authZ and data export paths.
- Review BA deliverable testing clauses and evidence.
Audit Considerations
OCR and assessors frequently examine whether apps were tested and whether test environments leaked ePHI. SA-11 evidence should show planned testing and controlled data — not last-minute scans after go-live.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.308(a)(1) Risk Analysis / Risk Management — testing identifies and reduces technical risks to ePHI.
- 164.312(a) Access Control — verify unique user ID, emergency access, and encryption features work as intended.
- 164.312(c) Integrity — testing helps prevent improper alteration through application flaws.
- 164.530(c) Safeguards — privacy testing supports administrative, technical, and physical safeguards for PHI use.
Compliance Tips
- Add SA-11 evidence links on the CM-3 change record.
- Automate dependency and SAST scans in CI for custom code.
- Train analysts that “refresh from prod” is a privacy incident waiting to happen.
Frequently Asked Questions
Is a yearly pen test enough for SA-11?
Periodic independent tests help, but SA-11 also requires developer testing/evaluation on an ongoing basis for changes — not only an annual snapshot.
Can we use de-identified data for all tests?
Prefer synthetic or de-identified data; if limited ePHI is ever required, apply minimum necessary, controls, and documentation equal to production sensitivity.
Do configuration-only EHR changes need SA-11?
Scale testing to risk — privilege, disclosure, and interface changes still need evaluation even when little custom code is written.
References & Resources
- NIST SP 800-53 Rev. 5 — SA-11
- OWASP ASVS / testing guides
- Related controls: SA-3, SA-10, CA-8, SI-2, CM-4
Related Guidelines
Related controls that commonly accompany SA-11.
Need Help Implementing SA-11?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.