HITRUST Compliance

The Health Information Trust Alliance (HITRUST) is a privately held company that delivers data protection standards and certification programs to help organizations safeguard sensitive information, manage information risk and reach their compliance goals.

HITRUST was founded in 2007 to make information security a core part of the healthcare industry, and its first board included leaders from major healthcare providers, insurers and vendors. It has since expanded beyond healthcare, and its framework is used across industries.

HITRUST differs from other compliance frameworks in that it maps dozens of authoritative sources, such as HIPAA, SOC 2, NIST and ISO 27001, into one set of controls. HITRUST describes itself as the only standards development organization with a framework, assessment platform and independent assurance program, which has helped drive widespread adoption.

What is HITRUST certification?

HITRUST created the HITRUST Common Security Framework (CSF) to provide an objective, measurable way to manage the security risks that come with handling healthcare information and other sensitive data.

HITRUST CSF certification shows that specific systems within an organization's environment meet the framework's requirements. Authorized HITRUST external assessors perform the assessment, and HITRUST reviews the results and issues the certification report, which helps organizations understand and improve their maturity levels. 

The HITRUST CSF is in version 11, released in January 2023 and updated regularly since. It draws on dozens of authoritative security and privacy standards, regulations and frameworks, and takes a risk-based approach through prescriptive, scalable controls. Version 11 offers three certifiable assessments:

• e1 (Essentials, one-year). 43 requirement statements, valid for one year.

• i1 (Implemented, one-year). 182 requirement statements, valid for one year.

• r2 (Risk-based, two-year). A requirement set tailored to the organization's risk factors, valid for two years with an interim assessment at the one-year mark.

Although HITRUST was originally designed for the highly regulated healthcare industry, its privacy and security control framework is industry-agnostic and can be used by organizations across all industries. Organizations that aren't ready to invest in a validated assessment can start with the readiness assessment to understand best practices and close gaps first.

Who needs HITRUST certification?

There are no Federal or government mandates for HITRUST CSF certification. In 2016, some of the largest health insurance payers announced they would require their vendors to become HITRUST certified, and since then HITRUST certification has become a common requirement among payers and other healthcare partners. 

For most companies that create, access, store or exchange protected health information (PHI), HITRUST compliance is a routine part of doing business: doctors, hospitals, pharmacies, insurance companies, healthcare vendors and their partners. Outside healthcare, there are no mandates for HITRUST certification, but organizations across industries can use it to demonstrate compliance with multiple regulatory requirements through a single assessment. Certification does not by itself prove legal compliance with any of them.

Benefits of HITRUST compliance

HITRUST certification helps organizations:

• build and run an information risk management program on one framework instead of several.
• reduce risk to sensitive data such as patient health information.
• simplify future compliance work, since CSF maps to more than 40 other frameworks' requirements. 
• reduce the number of separate assessments and reports customers and partners ask for.
• show customers, partners and insurers that recognized security standards are in place. 
• support HIPAA compliance efforts, since there is no official HIPAA certification.

How the HITRUST CSF is structured

The HITRUST CSF brings multiple regulations, standards, industry frameworks, state laws and business requirements into one central control repository. Instead of running separate efforts for NIST, HIPAA, HITECH and other frameworks, organizations can use a single assessment to address many of their requirements and report against several of them. Each HITRUST requirement is mapped to the framework, standard or regulation it comes from.

In version 11, the three assessments build on one another: the e1 sets a core group of requirement statements, the i1 adds to it and the r2 tailors the requirement set to the organization's risk factors, regulatory requirements and resources. The intent of any given control is the same across assessments; what changes is the amount of evidence and the scoring each assessment requires. 

The CSF is assessed across 19 domains, which are high-level subject areas that align with common IT process areas:

1. information protection program
2. endpoint protection
3. portable media security 
4. mobile device security 
5. wireless protection
6. configuration management 
7. vulnerability management 
8. network protection
9. transmission protection
10. password management 
11. access control
12. audit logging and monitoring
13. education, training and awareness
14. third-party security 
15. incident management
16. business continuity and disaster recovery
17. risk management 
18. physical and environmental security 
19. data protection and privacy

How HITRUST compares to other frameworks

HITRUST vs. HIPAA

Congress passed the Health Insurance Portability and Accountability Act (HIPAA) in 1996. The two are easy to confuse because of their ties to healthcare, but HIPAA is a law that requires covered entities and their business associates to protect PHI, while HITRUST is a voluntary framework for managing an organization's information risks.

HITRUST vs. SOC 2

SOC 2 is an attestation framework for service organizations. HITRUST was introduced to secure ePHI and now covers all industries; SOC 2 was introduced to help software vendors and other companies demonstrate their security controls to customers and partners.

HITRUST vs. NIST

The National Institute of Standards and Technology (NIST) is a non-regulatory government agency that develops standards and guidelines to help organizations manage cybersecurity risk. The NIST Cybersecurity Framework is built around six functions: govern, identify, protect, detect, respond and recover. NIST is required for federal agencies and many contractors; it is voluntary for most organizations.

HITRUST vs. ISO 27001

Published by the International Organization for Standardization (ISO), ISO 27001 is the international standard for an information security management system. The HITRUST CSF's core structure is based on the ISO 27001 control clauses, and both take a top-down approach, but they differ in scope, tooling and certification. 

HITRUST best practices

HITRUST scores each control against five maturity levels: policy, procedure, implemented, measured and managed. Which levels are scored depends on the assessment type, and the levels double as a roadmap for preparing:

• Document policies. Keep policies formal, current, approved and available to employees. Assign security responsibilities and state the consequences of not following them.
  
  
• Formalize procedures. Write down who does what, how and when for each control, and communicate the procedures to everyone who has to follow them.
  
  
• Create and test incident response and business continuity plans. Both are HITRUST requirements, not options. 
  
  
• Test controls regularly. Run vulnerability scans, penetration tests and self-assessments, and re-check individual controls as threats change. 
  
  
• Manage risk continuously. Correct weaknesses as they're found, build security into budget planning and adapt controls to new threats. 
  
  
• Get organizational buy-in. Certification touches teams well beyond IT and security. Executive support and the right resources make the difference. 

How HITRUST certification works

HITRUST certification requires an independent assessment. The timeline depends on the assessment type and the size and complexity of the organization, and many organizations work with a partner to prepare. The process has seven steps:

1. Download the HITRUST CSF. You can download the current version for free from the HITRUST website under its license agreement. Check the version number, since HITRUST replaces the earlier versions as it releases updates.
   
   
2. Choose an assessment type and determine scope. Decide whether e1, i1 or r2 fits what customers and partners require. Run an internal gap analysis against the CSF's target controls, and define which business units, systems and controls are in scope. Many organizations start with a readiness assessment, which produces no certification but shows where the gaps are. 
   
   
3. Subscribe to MyCSF. HITRUST's MyCSF tool is the platform for performing the assessment and managing corrective action plans. It is offered at several subscription levels. 
   
   
4. Complete the self-assessment. The questionnaire covers the organization's size, risk exposure and other factors, and answers determine which requirements apply. 
   
   
5. Engage an external assessor. An authorized HITRUST external assessor starts from the self-assessment and tests the security processes and controls in detail.
   
   
6. Submit for validation. The assessor's work goes to HITRUST for evaluation, along with any evidence HITRUST requests.
   
   
7. Receive the result. If the score meets the threshold, HITRUST issues the certification. If not, HITRUST sends a letter explaining why, with a corrective action plan, and the organization can resolve the issues and reassess.

More HITRUST resources

Blog

HITRUST vs. HIPAA: Understanding the difference