In this article, we will take a big-picture look at what HITRUST compliance is and how it compares with other types of compliance. You will learn about the HITRUST certification requirements, why compliance is important, and who must comply with the framework and controls. By the end of this article, you will have a clearer understanding of the best practices you can follow to obtain HITRUST certification and how HITRUST compliance can help your organization reduce risk, streamline compliance, and maintain a high level of data security.
The Health Information Trust Alliance (HITRUST) is a non-profit company that delivers data protection standards and certification programs to help organizations safeguard sensitive information, manage information risk, and reach their compliance goals.
HITRUST stands out from other compliance frameworks because it harmonizes dozens of authoritative sources such as HIPAA, SOC 2, NIST, and ISO 27001. It is also the only standards development organization with a framework, assessment platform, and independent assurance program, which has helped drive widespread adoption.
HITRUST created the HITRUST Common Security Framework (CSF) to provide an objective, measurable way to manage the security risks that come with handling healthcare information and other sensitive data. HITRUST CSF certification is a way for organizations to demonstrate that specific systems within their environment meet the framework’s rigorous standards and regulations. HITRUST-certified assessors perform certifications and produce detailed reports to help organizations understand and improve their maturity levels.
The latest CSF version (v9.6.0) integrates 44 major security and privacy-related standards, regulations, and frameworks as authoritative sources. It incorporates a risk-based approach to help organizations address security challenges through prescriptive and scalable security controls and privacy controls.
Although HITRUST was originally designed with the highly regulated healthcare industry in mind, its privacy and security controls framework is industry-agnostic and can be used by organizations across all industries. Organizations that may not be ready to invest in the time, effort, and cost of the HITRUST CSF Validated Assessment can choose from other assessment offerings to understand best practices and implement good hygiene.
HITRUST was founded in 2007 to help make information security a core pillar of the healthcare industry. The HITRUST acronym and HITRUST definition are distinct reminders of the organization’s original focus on securing healthcare information. The first Board of Directors included leaders from some of the top healthcare providers, insurers, and vendors.
Although HITRUST is still the gold standard for compliance in the healthcare industry, the company has since rebranded to reflect its expansion beyond healthcare. Its global expansion and industry-agnostic approach have made HITRUST CSF one of the most widely adopted security and privacy frameworks in the world. Its security programs and frameworks help organizations of all sizes and industries maintain the highest level of information security.
Information security is a critical component of modern healthcare information systems and medical technologies. Security frameworks like HITRUST help ensure that private health information and other sensitive data is secure by making it easier for organizations to obtain compliance.
All organizations that need to address compliance and risk management can benefit from achieving HITRUST compliance. The HITRUST CSF improves the security of an organization while helping reduce the complexity, risk, and cost associated with information security management and compliance. Certification provides objective verification that your security program is operating within the parameters of its intended design and meets HITRUST standards.
There are no federal or governmental mandates for HITRUST CSF certification. However, in 2016, some of the biggest health insurance payers announced a requirement for all of their vendors to become HITRUST certified. Since then, HITRUST certification has become an industry-wide standard required by a majority of payers.
For most companies that create, access, store, or exchange Protected Health Information (PHI), HITRUST compliance is an essential part of doing business. This ranges from doctor’s offices, hospitals, and pharmacies to insurance companies, healthcare vendors, and more. Outside the healthcare industry, there are no mandates for HITRUST certification, but all organizations can benefit from it. Following HITRUST regulations ensures that an organization is meeting multiple regulations and implementing the highest security standards for its data and systems.
As digital information and healthcare technology become increasingly common, organizations are more and more vulnerable to cyberattacks and breaches. Protecting data in today’s environment has a number of challenges, from rapidly changing business and technology environments to increased scrutiny from auditors, customers, and business partners.
HITRUST compliance helps organizations maintain a high level of data security, manage risk internally and with external vendors, and reduce the chances of a data breach. The framework also provides a map for ongoing improvements, making it easier to stay ahead of evolving threats and regulations.
The HITRUST Framework includes multiple regulations, standards, industry frameworks, state-specific laws, and business requirements in one central control repository. Instead of investing time and resources to comply with NIST, HIPAA, HITECH, and a myriad of different frameworks and standards, organizations can perform a single assessment and know that they are complying with their regulatory requirements.
The HITRUST framework is as flexible as it is comprehensive. Designed with security and privacy professionals in mind, it will not include the same process and requirements for every company.
Here’s an overview of the architecture:
Each control category includes implementation requirements which provide detailed information to support the implementation of the control and meet the control objective. Requirements are defined through three progressive implementation levels—a concept leveraged from NIST’s risk management framework and expanded upon by HITRUST.
The intent of any given control is the same, but the three HITRUST implementation levels take into account an organization’s risk factors, regulatory requirements, resources, and the type of HITRUST assessment being performed. Level 1 is the minimum; each subsequent level includes the previous level’s requirements along with additional requirements.
HITRUST also recognizes that various organizations may have specific community requirements (such as industry groups or cooperative sharing agreements), and it provides the capability for these requirements to be incorporated during the assessment process.
The CSF contains 14 control categories, made up of 49 control objectives and 156 security and privacy-related control specifications. Control objectives are a statement of the desired result, while specifications mandate the specific tasks infosec teams need to perform to achieve the objective. These specifications can be policies, procedures, guidelines, practices, or organizational structures and may be administrative, technical, managerial, or legal in nature.
The HITRUST CFA is broken down into 19 control domains, which are high-level subject areas that align with common IT process areas.
Congress passed the Health Insurance Portability and Accountability Act (HIPAA) in 1996. It can be easy to confuse HITRUST vs HIPAA because of their strong ties to the healthcare industry, but HITRUST and HIPAA are actually quite different. HIPAA is designed to ensure that covered entities protect PHI, while HITRUST focuses on mitigating an organization’s information risks.
| HITRUST | HIPAA |
|---|---|
| A framework created by security industry experts | A U.S. law created by lawyers and lawmakers |
| Applies to organizations across all industries | Only applies to organizations that manage PHI |
| Builds on the requirements of HIPAA, incorporating them into a security and risk framework | Requirements are nuanced and vary based on an organization’s size |
| Certification is done by an independent third-party HITRUST-certified assessor | Audits can be done in-house or with a vendor |
| Requires a passing score of at least 3 on a scale of 1-5 in each control category | Compliance is determined by a pass/fail system |
| Failing a HITRUST audit results in losing certification; there are no financial penalties |
Steep penalties for non-compliance |
SOC 2 is a popular security and risk assessment framework. HITRUST and SOC 2 both aim to address cybersecurity concerns in cloud-based systems, but they use different scoping factors. Another key difference is that while HITRUST works across industries, it was introduced to address problems related to securing health records and focuses on handling electronic protected health information (ePHI). SOC 2, on the other hand, was introduced to help software vendors and companies demonstrate their security controls to customers and partners.
| HITRUST | SOC 2 |
|---|---|
| Risk-based framework | Compliance-based framework |
| Introduced to help healthcare organizations secure electronic protected health information (ePHI) | Introduced to help software vendors and other companies demonstrate the security controls they use to protect customer data in the cloud |
| 19 categories, encompassing 156 controls that align with HIPAA | 5 common Trust Services Principles with specific requirements that are unique per organization |
| Evaluates controls based on a maturity rating | Tests controls for design and operating effectiveness |
| Certification is good for two years | Requires a full-scope examination annually |
The National Institutes of Standards and Technology (NIST) is a non-regulatory governmental agency that develops policies, standards, and guidelines to help organizations in all sectors manage cybersecurity risk. The NIST Cybersecurity Framework is built around five ideals: identify, protect, detect, respond, and recover. While NIST is required for federal agencies and their contractors, it is completely voluntary for most organizations.
| HITRUST | NIST |
|---|---|
| Required for organizations that manage healthcare information | Required for federal agencies and their contractors |
| Compliance is certifiable | Non-regulatory, voluntary guidance for most organizations |
| Takes the baseline security controls found in NIST and adds to them | Built around five ideals and six recommended organizational steps |
| Takes an organizational (top-down) approach to security | Takes a system (bottom-up) approach |
Published by the International Organization for Standardization (ISO), ISO 27001 is a widely known international standard for managing information security. It provides a management framework designed to help organizations of all sizes and industries protect their information in a systemic, cost-effective way. The focus is on developing a process for managing risks through a combination of policies and processes using specific requirements.
The HITRUST CSF’s core structure is based on the ISO 27001 control clauses. Certifications require similar controls, though they differ in number. Both take an organizational (top-down) approach to security, but there are a number of key differences.
| HITRUST | ISO 27001 |
|---|---|
| Compliance and risk-based framework | Management/process model |
| Originated in healthcare; supports all industries | Primarily used in financial and healthcare sectors |
| The MyCSF tool supports assessment and compliance | Minimal assessment tools available |
| Certification is valid for two years | Certification is valid for three years |
You may have heard terms like “HITRUST measured and managed” or “HITRUST policy and procedure.” HITRUST uses five maturity levels as scoring rubric for compliance. Each control will be assessed in five different areas:
Looking closer at the HITRUST Maturity Model and understanding the levels and areas for assessment is extremely useful. It can translate into best practices for your organization, giving you a roadmap to prepare for HITRUST compliance.
Refer to the following best practices for HITRUST compliance.
Make sure your policies are formal, up-to-date, documented, and readily available to employees. They should be documented and based on NIST or ISO to meet the HITRUST requirements. They should cover all facilities, operations, and systems and be approved by key parties. Clearly assign security responsibilities and identify penalties if policies are not followed.
Make sure formal, up-to-date, documented procedures are provided to implement the security controls identified by the defined policies. You’ll need to outline procedures in detail and identify the “who, what, how, and when.” Clearly define information security responsibilities and expected behaviors and communicate procedures to everyone who needs to follow them.
Make sure you have an action plan in place so you know exactly what to do in the event of a security incident or breach. Your business continuity plan will ensure you can continue to function in the event of a disaster or business interruption. These are requirements for HITRUST certification.
Validate the security of your system with technical controls like vulnerability testing and penetration testing. Tests should be routinely conducted to evaluate the adequacy and effectiveness of all implementations. These may include self-assessments, independent audits, and evaluations initiated by organizational management. Continually re-evaluate threats, and test individual controls frequently.
Are your information security procedures and controls implemented in a consistent manner? Reinforce them through training, and discourage any ad hoc approaches. Conduct initial testing to make sure controls are operating as you intend.
Correct identified weaknesses and make continuous improvements to policies, procedures, implementations, and tests. Integrate information security in budget planning, and make decisions based on cost, risk, and mission impact. Understand and manage security vulnerabilities, adapting controls to emerging threats.
The HITRUST certification process is a significant undertaking that will require a lot of heavy lifting—not only from the IT and security teams but also from others in the organization who might need to change their processes. Make sure you have executive support and the appropriate resources to be successful.
Some security audits are all about “checking the box,” but HITRUST facilitates a robust security program and organization-wide compliance culture. Making security a part of your organization’s daily routine and operations will make HITRUST certification much easier. No one wants to be cramming for a HITRUST exam at the last minute!
Encourage business leaders to understand how adopting the framework benefits the business by addressing risk and providing guidance on important data protection elements. Strong information security isn’t just about the IT team; it extends across all departments with sensitive data to protect. This can include Risk Management, Procurement, Finance, Operations, Human Resources, Sales, Marketing, and many others.
HITRUST certification requires an independent assessment. The HITRUST certification timeline is approximately three to four months, with the length depending on the size and complexity of your organization. The process can be very overwhelming, and many organizations choose to work alongside a partner to prepare.
Here is a HITRUST compliance checklist to help you understand the steps involved in getting certified and learn how to prepare for an assessment.
The latest version of the HITRUST CSF framework is available to download for free on the HITRUST website. Download the latest HITRUST PDF, v9.6. (NOTE: This replaces the HITRUST CSF 9.3 pdf, HITRUST CSF 9.4 PDF, and other previous versions.)
Perform an internal gap analysis of existing controls against the target controls in the HITRUST CSF. Outline the scope by defining which business units and subsidiaries are affected, the type of assessment needed, and the controls to address. This is a critical first step and can help your organization save time and money in the long run.
Once you understand your information protection posture, you can develop and communicate a risk management strategy and implementation timeline throughout the organization. Many organizations seek assistance from an Authorized HITRUST External Assessor or certification partner to ensure they are prepared.
Available through HITRUST, the MyCSF tool gives organizations a SaaS solution for performing risk assessments and corrective action plan management. Using it can help reduce resources, improve efficiency, enhance reporting and dashboards, streamline assessment modeling, and share assessment information. It is offered at varying subscription levels.
Complete a questionnaire to provide information about your organization's size, risk exposure, and other factors. Your answers will determine which controls, which requirements, and which requirement levels you will need to implement.
Hire a third-party auditor licensed by the HITRUST Alliance. They will begin with the data generated by your self-assessment and then dive into your security processes and controls in detail.
Submit the assessor's work to HITRUST for evaluation, and provide any evidence HITRUST requests.
If the score is sufficient, HITRUST will issue a certification. If it’s not, you will receive a letter describing the reasons why the assessment failed and a corrective action plan to help achieve certification. You will then have an opportunity to resolve issues and—if you choose to—try again.
Because of its complexity, HITRUST certification is quite expensive. HITRUST cost estimates range from $36,000 to $200,000 depending on the size and complexity of your organization. Many companies aiming for HITRUST certification are likely to see prices in the six figures. Self-assessments are significantly less expensive, but you won’t receive the same level of security assurance you would by hiring a third-party assessor.
Although a validated HITRUST assessment and certification is costly, anyone can access and download the HITRUST CSF free of charge. Many organizations that find HITRUST pricing is beyond their budgetary limitations use the HITRUST framework PDF to achieve a number of information security goals.
The Delinea platform supports many of the most challenging parts of HITRUST compliance and HITRUST audits, such as access control, audit controls, integrity, and transmission security. You can simplify meeting your compliance requirements by automating least-privilege access and collection of audit evidence, centralizing logging, and locking down sensitive information to minimize the risk of data exposure or data loss.
Delinea also deploys built-in monitoring and log collection so you always have a record of access and permissions. This provides transparency into your compliance efforts, reveals potential risks, and supports formal and informal audits.
HITRUST is not only for healthcare. Although the framework was originally created to help manage the security risks that come with handling healthcare information, it has since expanded to embrace all industries.
HITRUST combines the base controls of NIST with controls from other widely-used frameworks. The two work together to help organizations achieve compliance.
When you complete a HITRUST assessment, you will receive a report including a scorecard that details your organization’s compliance with NIST Cybersecurity Framework-related controls included in the HITRUST CSF framework. If you are HITRUST Certified, you can use the scorecard to assure management, business partners, and regulators of your compliance with the NIST Framework’s objectives and demonstrate compliance with the NIST Cybersecurity Framework.
HITRUST does not replace HIPAA. The two are managed by different entities: HITRUST is a privately held company, while HIPAA is regulated by the federal government. HITRUST encompasses the requirements of HIPAA and incorporates them into a broader security and risk framework. Because of this, the HITRUST framework may be used as a means to achieve HIPAA compliance. Many organizations also use HITRUST CFA certification to demonstrate HIPAA compliance since there is no official HIPAA certification.
As you can see from this comprehensive guide, HITRUST certification is a major undertaking that requires a significant investment in time, money, and resources. However, many companies find it to be worthwhile. The benefits of improved data security, reduced risk, and streamlined, efficient compliance across a number of regulations and frameworks can make up for the cost.
HITRUST certification demonstrates that your organization has met the gold standard for compliance and brings peace of mind to your business, customers, and partners.
Ready to enhance your security posture and HITRUST compliance readiness? Schedule a demo today.
John Martinez, Technical Evangelist, has had a long 30+ year career in systems engineering and architecture, but has spent the last 13+ years working on the Cloud, and specifically, Cloud Security. He's currently the Technical Evangelist at Delinea, taking the message of Zero Trust Privileged Access Management (PAM) to the world. As a practitioner, he architected and created cloud automation, DevOps, and security and compliance solutions at Netflix and Adobe. He worked closely with customers at Evident.io, where he was telling the world about how cloud security should be done at conferences, meetups and customer sessions. Before coming to Delinea, he lead an innovations and solutions team at Palo Alto Networks, working across many of the company's security products.