By EJN Labs · 31 Jul 2026 · 8 min read
Apple does not name penetration testing in its App Review Guidelines, but medical and health apps face the strictest scrutiny of any App Store category, and independent penetration testing is the accepted way to evidence that patient data and clinical functions are protected. Most UK health app teams commission a mobile and API test of 4 to 6 days, typically £4,800 to £8,400.
Why penetration testing matters for Apple medical apps
Penetration testing matters because Apple reviews medical apps more closely than almost anything else it distributes, since a defect in a dosing calculator or diagnostic aid can cause physical harm rather than inconvenience. Security evidence is what Apple, a regulator or an NHS buyer is likely to ask about.
The question comes up at a predictable moment: the health app is built, App Store submission is close, and someone asks what evidence will actually be needed.
The security angle follows directly. iOS medical, dosing, diagnostic, treatment-support and health-measurement apps handle data that UK GDPR treats as special category health data, and they connect to backend APIs holding patient records. If an attacker can tamper with readings, pull another user’s records through a broken API, or extract health data from a device, the app fails the standard Apple and every UK health buyer holds it to.
What Apple actually requires, and what it does not
Apple requires compliance with its App Review Guidelines, mandatory for any App Store app. For medical apps that means greater scrutiny where inaccurate data could affect diagnosis or treatment, accountable sources for drug dosage calculators, and regulatory clearance for apps making regulated medical claims.
That clearance is expected in the markets where the app operates, and it is worth being precise here because a lot of advice overstates the position. Apple also requires health data to be protected, kept out of advertising ecosystems and handled with explicit consent.
What Apple does not do is name penetration testing as a submission requirement. There is no checkbox in App Store Connect asking for a test report. Penetration testing sits in this picture as accepted evidence: it is how you demonstrate, to Apple if questions arise, to the MHRA if your app qualifies as a medical device, and to NHS buyers assessing you against DTAC, that the security claims in your submission and privacy label are true in practice. For UK health apps the sector-linked drivers are usually stronger than Apple itself.
So the honest position is this: Apple mandates the outcome, a safe app with protected health data and truthful claims, and penetration testing is the recognised way to evidence it. Teams that treat testing as optional tend to rediscover it as a blocking item in an NHS tender or enterprise security questionnaire.
What to test in a health app estate
A meaningful test covers more than the binary you upload. Health apps are systems, and most of the exploitable risk sits behind the app rather than inside it.
The iOS app itself
Local data storage is the first place we look. Health readings cached in plaintext files, tokens outside the Keychain, sensitive values written to logs or the pasteboard, and HealthKit data handled outside its entitlement model are all common findings. We also test certificate pinning, jailbreak detection and whether the app’s binary protections can be bypassed to tamper with clinical logic such as dose calculations. A mobile application penetration test covers this layer end to end.
APIs and the backend
This is where patient records actually live, and it is where the most serious findings appear. Broken object-level authorisation, where user A can request user B’s records by changing an identifier, is the classic health app failure. API penetration testing exercises authentication, authorisation, rate limiting and input handling across every endpoint the app calls, plus any endpoints that exist but the app does not use.
Cloud infrastructure and third-party SDKs
Health backends commonly run on AWS, Azure or GCP, so misconfigured storage buckets, over-permissive roles and exposed management interfaces belong in scope through cloud penetration testing. Third-party SDKs deserve attention too: analytics or crash-reporting SDKs that receive health data are both a security exposure and a direct conflict with Apple’s rules on health data leaving the app for advertising or data-mining purposes.
How an engagement runs
An engagement starts with a scoping call to map the estate: the app, its APIs, the cloud environment and any clinical functions needing careful handling. Testing then runs in a staging environment that mirrors production, because testing dose logic against live patient data is never acceptable.
For a health app we also ask for a build with debug symbols where possible and two test accounts per role, so we can test cross-user authorisation properly.
Testing usually runs one to two weeks depending on scope. You receive findings as they are confirmed rather than waiting for the report, so a critical API flaw can be fixed while testing continues. The report grades each finding by severity, explains the clinical and data protection impact in plain English, and gives your developers reproduction steps. A retest of fixed findings then produces the clean evidence you attach to submissions and tenders. Our penetration testing checklist walks through what to have ready before a test starts.
What it costs and how scope drives the price
Penetration testing is priced on effort. UK day rates for CREST-accredited testing typically run £1,200 to £1,400, and the number of days is driven by how much of the estate you include. Typical ranges for health app engagements look like this:
| Scope | Typical effort | Typical UK cost |
|---|---|---|
| iOS app only | 4 to 6 days | £4,800 to £8,400 |
| App plus supporting APIs | 6 to 9 days | £7,200 to £12,600 |
| App, APIs and cloud configuration review | 8 to 12 days | £9,600 to £16,800 |
A dosing or diagnostic app usually justifies the wider scope, because the API and cloud layers are where record-level data exposure happens. For a fuller breakdown of what moves the price, see our guide to penetration testing costs in the UK. These are typical UK ranges; an exact price comes from scoping your estate.
How EJN Labs approaches Apple medical app testing
EJN Labs is a CREST-accredited UK penetration testing firm, and all testing is carried out by UK-based testers. We test health apps as systems rather than binaries: the iOS app, the APIs behind it and the cloud environment underneath it in one engagement, so the report reads as a single picture of risk to patient data.
Because the output is usually destined for a regulator, an NHS buyer or an enterprise security review, we write reports for that audience. Findings map to the claims in your App Store submission and privacy label, and the executive summary states plainly whether health data was adequately protected at the time of testing. We hold Cyber Essentials Plus and ISO 27001 ourselves, so we understand the evidence chain from the inside. Our guide to choosing the best UK penetration testing provider covers what to check before you commission anyone, including us.
Frequently Asked Questions
Does Apple require penetration testing for medical apps?
No, not explicitly. Apple’s App Review Guidelines require medical apps to protect health data, come from accountable sources and hold regulatory clearance where their claims demand it, but they do not name penetration testing. In practice, an independent test is the accepted evidence those requirements are met.
UK buyers such as the NHS also expect to see that evidence during procurement.
What does a penetration test for an Apple medical app cost?
Testing the iOS app alone typically takes 4 to 6 days, which is £4,800 to £8,400 at UK day rates of £1,200 to £1,400. Adding the supporting APIs usually brings the engagement to 6 to 9 days, or £7,200 to £12,600. Scope is the main cost driver, so an exact figure comes from a short scoping call.
Does a UK health app need MHRA clearance as well as App Store approval?
It depends on what the app claims to do. If it diagnoses, treats or informs clinical decisions, it may qualify as software as a medical device under UK regulation, which is an MHRA matter separate from Apple’s review, so clearance and App Store approval are two distinct hurdles.
Apple expects apps making regulated medical claims to hold the relevant clearance. Confirm your classification with a regulatory adviser, and note that penetration test evidence supports both routes.
What should be in scope for a health app penetration test?
Include the iOS app at minimum, covering local storage, transport security, binary protections and any HealthKit integration, plus the APIs the app calls and the cloud environment they run in, because most of the serious risk sits in the backend.
Third-party SDKs that receive health data are worth reviewing too, because they can breach Apple’s health data rules directly.
How often should a health app be retested?
Retest annually as a baseline, and after any significant change: a new clinical feature, a rebuilt API, a change of cloud architecture or a major iOS version migration. NHS and enterprise buyers generally expect test evidence less than twelve months old, so annual cover is the practical minimum.
Aligning retests with your renewal and tender calendar avoids scrambling for a report at short notice.
Get security evidence your submission can stand on
If your health app is heading for the App Store, an NHS tender or a regulatory file, the fastest route to a price is a short scoping conversation. Tell us what the app does and what evidence you need, and we will come back with a fixed scope and cost. Get a CREST penetration testing quote from our UK-based team.
Leave a Reply