The HIPAA security rule does not specifically mention vulnerability scans or penetration tests. However, to comply with the security rule, Health and Human Services require a technical vulnerability assessment of all the IT assets, including all web and network assets. Therefore, to comply with HIPAA, you must regularly use a vulnerability scanner to assess the security of your assets.
Learn about HIPAA vulnerability scan requirements.