HITRUST
HITRUST CSF Certification
HITRUST CSF is a certifiable framework widely required in US healthcare and health-tech, increasingly used alongside or instead of HIPAA, assessed by HITRUST Authorized External Assessor organizations.
Q&A
What is HITRUST?
HITRUST CSF is a certifiable framework widely required in US healthcare and health-tech, increasingly used alongside or instead of HIPAA, assessed by HITRUST Authorized External Assessor organizations.
Who needs HITRUST?
Healthcare providers, payers, health-tech vendors, and any organization whose customers or business associates require HITRUST certification, most commonly as an alternative or complement to a HIPAA attestation.
How long does HITRUST take?
Up to 18 months for r2; 1–9 months for e1/i1
How much does a HITRUST audit cost?
$70,000–$160,000 for r2 (highest assurance); $20,000–$200,000 for lighter e1/i1 tiers
What does a HITRUST audit cover?
A HITRUST Authorized External Assessor organization tests the applicable HITRUST CSF controls at your selected tier (e1, i1, or r2) and submits the assessment to HITRUST for quality review. HITRUST issues the certification. The deliverable is a formal certification report shareable with customers and regulators.
What it is
The HITRUST CSF is a certifiable, control-based framework that harmonizes requirements from HIPAA, NIST, ISO 27001, PCI DSS, and other standards into a single set of prescriptive controls. It is widely adopted in US healthcare and health-tech supply chains as evidence of a mature security and privacy program. HITRUST offers three certification tiers: e1 (foundational, roughly 44 controls), i1 (leading practices, roughly 182 controls), and r2 (risk-based, expanded assurance with hundreds of tailored controls). Assessments must be performed by a HITRUST Authorized External Assessor organization and are validated by HITRUST itself before a certification is issued.
Healthcare providers, payers, health-tech vendors, and any organization whose customers or business associates require HITRUST certification, most commonly as an alternative or complement to a HIPAA attestation.
A HITRUST Authorized External Assessor organization tests the applicable HITRUST CSF controls at your selected tier (e1, i1, or r2) and submits the assessment to HITRUST for quality review. HITRUST issues the certification. The deliverable is a formal certification report shareable with customers and regulators.
Up to 18 months for r2; 1–9 months for e1/i1
$70,000–$160,000 for r2 (highest assurance); $20,000–$200,000 for lighter e1/i1 tiers