The request usually arrives from a health plan's vendor risk team, and it names something most vendors have never bought: HITRUST certification, in writing, before the contract renews. A SOC 2 report does not satisfy it, and neither does a completed security questionnaire. The work takes most of a year at the top tier, and the certificate at the end comes from a private company rather than from a regulator.
That last detail explains the pricing, the tiers, the two-year clock and the careful wording every honest assessor uses about what certification proves.
What Is HITRUST?
HITRUST is an organization, a framework and a certification, and the same five letters get used for all three. The organization began as the Health Information Trust Alliance and has been running assurance programs since 2007, so that health plans and their suppliers could stop answering the same security questionnaire in twenty different formats. The framework it publishes is the HITRUST CSF. The certification is what an organization receives after an assessment against that framework clears HITRUST's own quality review.
Nothing about it is governmental. HITRUST sets the requirements, authorizes the firms that assess against them, operates the platform the evidence goes into, reviews the finished work and issues the report. What gives the certificate its force is that large healthcare buyers write it into contracts, the same mechanism that makes SOC 2 feel mandatory in software. The framework was opened beyond health information years ago, so certifications appear in insurance and technology too, but a buyer asking for HITRUST is almost always in healthcare.
What Is the HITRUST CSF?
The CSF is a control library that consolidates other people's requirements. Rather than write a new standard, HITRUST maps existing ones into a single set of requirement statements, so one assessment can be reported against several frameworks. That is why a company facing HIPAA, PCI DSS and a customer's ISO questions at once finds it attractive.
What Are the HITRUST Assessment Types?
Three certifiable assessments exist, and they are three products at three depths rather than three stages of one process. A buyer asking for "HITRUST" without naming a tier does not yet know what they want, and the gap between the cheapest and the deepest is most of a year.
| Tier | Requirements | Valid for | Ask for it when |
|---|---|---|---|
| e1, essentials | 43 foundational controls | 1 year | A low risk vendor needs more than a self-completed questionnaire |
| i1, implemented | 182 control requirements | 1 year | A vendor holds real data and the buyer wants leading practice |
| r2, risk based | Tailored to the risk profile | 2 years, interim at 1 year | Regulated data at scale, or a contract naming r2 |
The e1 controls are the things that stop the attacks that actually arrive: multi-factor authentication, patching, backups and security awareness training that everyone completes. The r2 is the only tier that reshapes its requirement list around your environment, and HITRUST calls it its gold standard.
How HITRUST Certification Is Scored
Scoring is where HITRUST differs most from a report you may already hold. A SOC 2 auditor states an opinion. A HITRUST assessment produces a number, and the number has to clear a bar.
Read that ladder again and the cost of an r2 becomes obvious. You are scored not only on whether multi-factor authentication is switched on, but on whether a policy says so, a procedure supports it, somebody measures that it works, and the measurements produce action. Four artifacts for one control, across a requirement set that runs into the hundreds.
Is HITRUST Required by Law?
No. No federal statute names HITRUST, no regulator issues or recognizes the certificate, and no penalty follows from not holding one. The pressure comes from contract language written by health plans, health systems and their prime vendors. The law it stands in for is the HIPAA Security Rule, and that rule asks for something different from a certificate.
That is the structure that governs what HIPAA actually asks of a provider: the rule sets standards and lets each organization decide what is reasonable and appropriate for its size and risk. Certification is a business decision layered on a legal duty, not a substitute for it.
Does HITRUST Certification Mean You Are HIPAA Compliant?
It does not, and the clearest statement of that comes from the regulator rather than from any assessor.
The narrower version of the claim is still worth money: an authorized assessor validated a defined set of controls, HITRUST reviewed that work, and the results can be reported against HIPAA's requirements through HITRUST's own mapping. That answers a vendor risk team. It is not a shield.
HITRUST vs SOC 2 and ISO 27001
Most companies asking about HITRUST are deciding between it and a report they already hold or could get more cheaply.
If the buyer is a US software customer outside healthcare, an accountant's opinion is usually what they mean, and HITRUST is an expensive answer to a question nobody asked. If the buyer is a health plan, a health system or a company selling to one, HITRUST is often named in the contract and a SOC 2 will not be accepted instead. If the buyer is European or public sector, the certificate they know is ISO 27001, and how those two already compare is the more useful starting point. Holding more than one is common at the top of the market, because the underlying evidence overlaps even though the deliverables do not.
How to Get HITRUST Certified
The sequence is fixed. Work happens in MyCSF, which generates the requirement statements for your scope and holds the scoring and evidence. An authorized external assessor firm performs the validation and submits it, and HITRUST runs its own quality review before any certification report exists. Nobody self-certifies, and the assessor does not issue the certificate.
- Scope it: which systems, which locations, which risk factors. Scoping drives the requirement count, so this decision sets the price
- Readiness. Close gaps, write procedures that match what you actually do, and start the controls running
- Controls have to be in operation before they can be scored at the implemented level, so evidence accumulates before fieldwork rather than during it
- The authorized external assessor tests each requirement, scores every maturity level and submits the object to HITRUST
- HITRUST reviews the assessor work, raises questions, and issues the report once the scoring threshold is met
- Interim assessment, required to keep an r2 certification alive for its second year
- Recertification, against whichever CSF version is current by then
How Much HITRUST Certification Costs
No published dataset exists, so treat any confident single figure, including the ranges assessor firms advertise, as a sales aid rather than a benchmark. What can be said honestly is what moves the number.
Three invoices are involved and companies routinely budget for one. HITRUST charges for the MyCSF subscription and the report. The external assessor charges for the validated assessment. A readiness partner, where you use one, is usually a different firm and bills separately. Staff time sits on top, is the largest cost in every program, and appears on no invoice. Scope drives all four: an r2 with a wide system boundary generates far more requirement statements than an e1 with 43.
Who Needs HITRUST Certification?
Anyone selling into healthcare who has been told to get it, and almost nobody else. That sounds circular and it is the honest answer: HITRUST is a contractual requirement, so the population that needs it is the population being asked for it.
The reason these requests keep arriving is measurable. The 2026 Verizon Data Breach Investigations Report found breaches involving a third party now account for 48 percent of all breaches, with supply chain breaches up 60 percent. Nearly half of incidents reach an organization through somebody else's environment, which is why vendor risk teams that once sent a spreadsheet now ask for a scoring threshold.
Key takeaways
- HITRUST is a private company, a control framework called the HITRUST CSF, and a certification against that framework. No regulator is involved at any point.
- The CSF harmonizes more than 70 standards and regulations by HITRUST's own count, so one assessment can be reported against several frameworks.
- Three tiers certify: e1 with 43 foundational controls and i1 with 182 control requirements, both valid one year, and r2, tailored to your risk profile and valid two years with an interim assessment at twelve months.
- Certification requires a rating of 3 or higher on a scale of 1 to 5 across 19 domains, scored through five PRISMA-based maturity levels.
- No US law requires HITRUST. The HIPAA Security Rule requires a risk analysis and a periodic evaluation, and those duties stay with you whoever certifies what.
- Budget four costs, not one: the platform and report, the assessor, any readiness partner, and staff time.
Common questions
What does HITRUST stand for?
The organization was founded in 2007 as the Health Information Trust Alliance. It now uses the HITRUST name alone, because the framework and the certifications reach beyond health information.
Is HITRUST the same as HIPAA?
No. HIPAA is federal law binding covered entities and business associates. HITRUST is a private framework and certification that can serve as evidence of meeting parts of that law. The Security Rule obligations exist whether or not you hold a certificate.
How long does HITRUST certification take?
An e1 can be done in weeks once the controls are genuinely running, and an i1 in a few months. An r2 usually takes most of a year, because readiness, a look-back period, fieldwork and HITRUST's quality review sit end to end.
How long is a HITRUST certification valid?
The e1 and i1 are valid for one year and must be renewed annually. An r2 is valid for two years and requires an interim assessment after the first year to stay in force.
What is the difference between e1, i1 and r2?
Depth and scoring. The e1 covers 43 foundational controls, the i1 covers 182 curated requirements, and the r2 tailors its requirement set to your risk factors and scope. The e1 and i1 score implementation; the r2 also scores policy and procedure.
Is HITRUST better than SOC 2?
Neither is better; they answer different buyers. HITRUST scores you against a prescriptive control set with a pass mark, which is why healthcare procurement favors it. A SOC 2 report is a CPA opinion on controls you designed yourself.
Who can perform a HITRUST assessment?
Only a HITRUST authorized external assessor firm can perform a validated assessment and submit it. HITRUST then runs its own quality review and issues the report. Self-certification is not available at any tier.
How much does HITRUST certification cost?
No authoritative dataset publishes this, so distrust any single number. Four parts make it up: HITRUST's platform and report fees, the assessor's fee, an optional readiness partner, and staff time, which is usually the largest.
What happens if we fail a HITRUST assessment?
Weak scores are not a rejection letter. Requirements below the threshold go into corrective action plans that the assessed organization prepares and HITRUST reviews, so the outcome is remediation and a later report.
On this page
- What Is HITRUST?
- What Is the HITRUST CSF?
- What Are the HITRUST Assessment Types?
- How HITRUST Certification Is Scored
- Is HITRUST Required by Law?
- Does HITRUST Certification Mean You Are HIPAA Compliant?
- HITRUST vs SOC 2 and ISO 27001
- How to Get HITRUST Certified
- How Much HITRUST Certification Costs
- Who Needs HITRUST Certification?
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.