In development
Breach Simulator is being built. It is not part of any plan today, and nothing on this page describes a capability you can use yet. The rest of the page describes the intended product. It is intended for the Pro plan.
See what ships todayDefense · Breach Simulator
A capability we are building. Not one you can use yet.
The idea: take a scenario that has actually happened to practices like yours, and walk it against what your office has recorded — not to produce a score, but to find the step where it would get through.
HIPAA mapping
Where this fits in the Security Rule.
3 provisions this capability contributes to, each with the specific Breach Simulator behavior behind it. The obligation stays with your practice — the mapping shows which part of the work the platform carries.
§164.308(a)(1)(ii)(A)Risk analysis
The provision asks a practice to identify risks and vulnerabilities to ePHI confidentiality, integrity and availability. The intent of this capability, once built, is to do that against your recorded configuration rather than a generic threat model. It does not do it today.
§164.308(a)(1)(ii)(B)Risk management
The provision asks for security measures sufficient to reduce risk. The intended output is a prioritized list of such measures, ranked by where a scenario got through. Nothing produces that list yet.
§164.308(a)(8)Evaluation
The intent is to test safeguards against realistic scenarios, with each run producing evaluation documentation. None of it exists yet.
What it does
Real scenarios. Real configuration. Real weakest links.
Generic breach training shows attack patterns against generic companies. Useful for awareness; useless for prioritization. Your practice has specific vendors, specific workforce, specific devices, specific ePHI flows. The attack that lands at a typical hospital is not the attack that would land at your independent behavioral health office.
The Breach Simulator is not built yet; what follows is the shape we intend. It would run a scenario against your recorded configuration — reading your workforce roster, your device inventory, your BAA portfolio, your PHI flow map, and your training completion patterns. It would walk a specific attack scenario — phishing campaign, lost device, ransomware event, insider misuse — and show you the step where it got through.
The output is the weakest link. Where in the sequence would the attack succeed? Which control, if hardened, would have stopped it? The simulator turns abstract risk analysis into specific remediation. “Train workforce” becomes “train these specific 4 workforce members on phishing” because the simulation showed exactly which members the attack would target and which lack current training.
How it works
6 mechanisms we intend to build.
Scenarios drawn from what has actually happened.
The intent is a scenario set grounded in documented incidents at independent practices rather than enterprise red-team exercises — the compromised vendor, the lost laptop, the message that went to the wrong recipient. Which scenarios ship first is not decided.
Walked against what you have recorded.
The direction is to run a scenario against the practice's own recorded state — the workforce, the systems inventory, the vendor agreements — rather than against a generic profile, so the output names your weak step rather than a category of weakness. How that reads against each module is still being worked out.
The point is the step, not a score.
What we want out of it is the first place a scenario gets through, named specifically enough to fix. Not a rating, not a percentage — the step. Whether that generalises cleanly across scenarios is one of the open questions.
Impact, deliberately unresolved.
Attaching a number to what a scenario would cost is the part we are being careful about. Our live breach cost calculator already models that honestly and says what kind of estimate it is; we are not going to ship something that reads more confidently than the arithmetic deserves.
It should produce work, not a report.
The intent is that a finding lands in the Compliance Advice queue alongside everything else a practice owes, rather than as a document somebody files. That is the pattern the rest of the platform already follows, and it is the reason to build this inside it rather than as a separate exercise.
Would re-run as your recorded configuration changes.
The intent is that you could run the same scenario before and after remediation and see whether the weakest link moved — the check that a fix actually closed the gap. That is the direction, not something available now.
Who this is for
Built for the practices that need it most.
Practices that want their training to be specific.
Training that reaches everyone equally produces results that apply to nobody in particular. The reason to build this is to make training specific to the people a real attempt would reach first.
Practices that have done a checklist SRA but want more.
An assessment tells you which controls are in place. A scenario would tell you whether they hold in sequence. Those are different questions, and today Patient Protect answers the first one — thoroughly, across 331 items.
Practices preparing for board or insurance reviews.
Underwriters and boards ask whether controls have been tested. If that question is live for you now, the honest answer today is your assessment and your training records, not this page.
Practices watching this space.
If scenario testing is something you want, the useful thing to know is that it is being built and is not here yet. In the meantime the Security Risk Assessment is the structured evaluation that exists today, and it is where the recorded state a simulation would read from comes from in the first place.
What you get
6 outcomes it is meant to produce.
Named steps, not risk categories.
The intent, once built.
A finite list.
Scenarios should converge rather than multiply.
Grounded in real incidents.
What has happened to practices, not enterprise exercises.
An input to evaluation.
§164.308(a)(8) asks the practice to evaluate; this would give it something to look at.
Training that matters.
Would let training target the specific people a specific attack would reach first.
Re-run verification.
Confirm remediation actually closed the gap.
Can I use this today?
What should I use instead right now?
How firm is any of this?
Would it attack our systems?
Why publish a page for something that does not exist?
Continue exploring
Related features in the platform.
Intelligence
ePHI Data Flow Mapper
A free tool, in your browser, with no account. Place your systems and vendors, connect what talks to what, and the connections nobody has papered become the ones you are looking at.
Learn moreIntelligence layer
HIPAA Breach Cost Calculator
The free tool that models what a breach would cost a practice of your size, and says plainly what kind of estimate it is.
Learn moreDefense
Security Alerts
The BAA that lapsed while the vendor kept working. The policy nobody adopted. The training assignment that never got made. Conditions do not announce themselves, and the practice that finds out during an investigation found out too late.
Learn moreIn development. The assessment it would read from is not.
If scenario testing is what you came for, the honest answer is that it is being built. The Security Risk Assessment is live, included in Basic, and is where this would start from anyway.