Oakland's health economy spans both sides of the transaction - organisations that deliver care and organisations that pay for it - and the sharpest risk lives in the seam between them. CyberFortify runs manual API, web, cloud and network penetration tests here, aligned to the HIPAA Security Rule, the California CMIA, CCPA/CPRA and SOC 2. Delivered remotely from our Gulf base on a daily overlap window, with on-site work where it genuinely helps. Fixed price, audit-ready reporting, free retest.
// 01 Why Oakland businesses need penetration testing
Follow a single medical claim through the East Bay and you cross more organisational boundaries than most people expect. An eligibility check goes out to a health plan and returns in seconds; a prior-authorisation request travels the other way and comes back with a decision that changes what care happens next. Coverage details and clinical justifications move both ways, through interfaces built to be fast rather than adversarial.
Oakland is unusual in holding both ends of that chain in one city: large provider organisations and health plans, plus the claims processors, care-management platforms and digital-health vendors between them. Interoperability rules have pushed much of that exchange onto FHIR APIs that patients, members and third-party applications call directly. That is sound policy - people should be able to take their health information with them - but it turns private integrations into a public authorisation surface, where the failure mode is one person retrieving another's record because a token, a scope or an identifier was trusted when it should have been checked.
Scanning does not find that class of flaw. A scanner reports an outdated library; it cannot tell you that changing a patient identifier in a FHIR request returns someone else's medication list, or that a third-party app registered last year still holds a refresh token nobody revoked. Those are authorisation decisions, and confirming them takes a tester who understands the protocol and the relationship behind it.
// 02 Compliance and regulatory drivers in Oakland
Californian health organisations answer to a federal privacy regime, a stricter state layer above it, and a consumer-privacy statute covering everything else they hold. These are the requirements we most often map evidence against.
HIPAA Security Rule - risk analysis & evaluation
Covered entities and business associates must run an accurate risk analysis and periodically re-evaluate their technical safeguards. Independent testing is how most Oakland organisations evidence it.
California CMIA
The Confidentiality of Medical Information Act governs disclosure of medical information in California and is stricter than HIPAA in places, reaching entities and disclosures federal rules do not.
HITECH breach notification
HITECH sets the notification duties that follow an unauthorised disclosure. An unresolved authorisation flaw in a member-facing API is a potential notification event, so we prioritise findings by what they expose.
CCPA / CPRA
California's consumer-privacy regime adds rights, risk-assessment expectations and cybersecurity-audit duties across non-clinical data - member portals and the identity systems behind them. Our privacy-regulation guidance compares them.
SOC 2, ISO 27001 & NIST CSF
Health-tech and claims vendors selling into plans and provider systems face security review before contract. SOC 2 reports, ISO 27001 A.8.29 evidence and NIST CSF programmes all rest on independent testing.
PCI DSS v4.0 - Req 11.4
Patient payment portals, premium billing and civic payment services must penetration-test the cardholder environment and prove segmentation under Req 11.4.5.
// 03 Penetration testing services for Oakland
Oakland engagements weight interfaces over perimeters, because that is where data crosses organisational lines. API testing leads for plans, providers and health-tech vendors; cloud follows, since the integration platforms live there; web and mobile cover the member and patient front doors.
API pen testing
FHIR, claims, eligibility and prior-authorisation interfaces - broken object-level authorisation, scope enforcement and token handling.
Cloud pen testing
Identity, tenant isolation, storage exposure and service-account scope across the platforms hosting integration engines and member data.
Web application pen testing
Member and patient portals, provider directories and civic applications, tested against the OWASP Top 10 and business-logic abuse.
Mobile app pen testing
iOS and Android member and care apps - local data storage, certificate handling and the API traffic behind the screen.
Network pen testing
External, internal and Active Directory testing, plus segmentation checks between clinical, corporate and integration environments.
Red teaming
Goal-based adversary simulation, including ransomware scenarios, testing whether intrusions are detected before operations halt.
// 04 How we deliver to Oakland
We will not pretend otherwise: CyberFortify is a Gulf-based firm on UTC+3, and Oakland sits ten to eleven hours behind us. We have no California office and no local staff. What we have is a working pattern built around that gap: our late afternoon and evening is your morning, and we hold that window open daily for stand-ups, live triage and read-outs. Testing continues while Oakland is offline, so results are waiting when your day starts.
What runs remotely
API, web, cloud, mobile and external testing from our secure environment - the large majority of payer, provider and health-tech scope. Findings land in a shared channel as confirmed, and critical issues are escalated immediately.
What we do on-site
Internal network, wireless and segmentation testing where a tester genuinely needs to be on the wire, plus in-person workshops for security committees. We travel when it adds value and say so when it does not.
Every engagement opens with a free 30-minute scoping call and a fixed-price quote within the hour. For clinical and claims environments we agree test windows around operational load, and a free retest proves the fixes.
// 05 Industries we secure in Oakland
Oakland's risk profile is shaped by a dense concentration of health organisations, a working port economy and a growing technology base.
// 06 Our methodology
Oakland engagements follow the same audit-defensible process we run everywhere, tuned to the data exchange at the centre of this market. Testing is grounded in the PTES and NIST SP 800-115, with exploitation mapped to MITRE ATT&CK tactics and application work driven by OWASP, including the API Security Top 10. As a CREST Accreditation Pathway firm we lead with manual testing - automation supports the tester, never replaces one.
Scoping & rules of engagement
Targets, API surfaces, trading-partner boundaries, test accounts and escalation paths agreed in writing first.
Fixed quote in 1hReconnaissance & threat modelling
Attack surface mapped around the exchange itself - who calls what, with which token, on whose behalf, and what each party may see.
ATT&CK alignedManual exploitation
Weaknesses are exploited and chained under controlled conditions, with cross-account access proven using seeded test records - never live member or patient data.
Controlled exploitReporting & free retest
Executive summary, CVSS-scored detail and mapping to HIPAA, CMIA, CCPA/CPRA, SOC 2 or NIST CSF - plus a free retest once fixes ship.
Audit-ready// 07 Why CyberFortify for Oakland
A scan-and-report vendor
Automated output rebadged as a penetration test, blind to authorisation logic, unable to reason about who a token belongs to or what a trading partner may request.
CyberFortify
A Gulf-based, CREST-pathway team candid about the time difference and structured around it. Manual exploitation aimed at the authorisation seam between plans, providers and their vendors, findings mapped to your assessors' frameworks, fixed pricing and a free retest.
Oakland engagements most often pair an API assessment with a cloud penetration test, since an interoperability platform's risk splits between the authorisation logic in front of it and the identity configuration underneath. Where downtime is a clinical safety event, we add red teaming to test detection under a ransomware scenario.
// 08 Frequently asked questions
Do you test FHIR and interoperability APIs for Oakland health organisations?
Yes - it is the work we are most often asked for here. We test the authorisation model behind patient-access and payer-to-payer FHIR endpoints: whether a token issued for one member can read another member's resources, whether resource identifiers can be enumerated or substituted, whether scopes are enforced per request rather than only at login, and whether bulk export reaches beyond the consented set. We also review third-party app registration and the consent records meant to bound each app.
How do you test the exchange between a health plan and a provider organisation?
We treat the integration as its own target rather than assuming it inherits either side's security. We test the eligibility, claims and prior-authorisation interfaces directly: how the two systems authenticate to each other, whether service credentials are over-scoped, and whether a partner identifier in a request can be changed to reach another organisation's data. We test from the positions a real attacker would occupy, including a hostile trading partner and a compromised integration account.
Which regulations drive penetration testing for Oakland health organisations?
The HIPAA Security Rule requires a risk analysis and periodic technical evaluation, and independent testing is the usual way that evaluation is evidenced. HITECH governs breach notification. California's Confidentiality of Medical Information Act applies on top and is stricter than HIPAA in several respects, while CCPA/CPRA adds consumer rights and risk-assessment duties. Health-tech vendors add SOC 2, card handlers add PCI DSS 4.0 Requirement 11.4, and many organisations anchor the programme to NIST CSF.
You are not based in California - how does the time difference actually work?
We should be plain: CyberFortify is a Gulf-based firm on UTC+3, ten to eleven hours ahead of Oakland, with no California office or local staff. We work a deliberate daily overlap window - our late afternoon and evening is your morning - reserved for stand-ups, live triage and read-outs. Testing continues while your team is offline, so findings are usually waiting when you start the day.
How fast can we get a quote for an Oakland engagement?
Book a free 30-minute scoping call and we return a fixed-price quote, usually within the hour and always within one business day. The report is written to hand straight to an auditor, and a remediation retest is included once your fixes ship.