HITRUST Certification

The HITRUST Framework, also known as the HITRUST CSF, harmonizes requirements from HIPAA, NIST, ISO, PCI DSS, and other authoritative sources into a single, certifiable control set. Healthcare payers, providers, and health systems frequently require HITRUST certification from vendors that create, receive, maintain, or transmit protected health information.

Three Assessment Levels

• e1 (Essentials, 1-year): 43 foundational cybersecurity controls. A good entry point for startups and lower-risk organizations, and a stepping stone to i1 or r2.

• i1 (Implemented, 1-year): 182 threat-adaptive control requirements that demonstrate leading security practices for organizations with an established program.

• r2 (Risk-based, 2-year): the most comprehensive level, tailored to your risk factors and regulatory requirements such as HIPAA and the NIST Cybersecurity Framework, with an interim assessment in year one.

HITRUST also offers an AI Security Assessment and Certification for AI platform and service providers that can be paired with e1, i1, or r2.

How Assessment Works

• Assessments are scoped and managed in HITRUST's MyCSF platform.

• You complete a readiness self-assessment, remediate gaps, then engage a HITRUST Authorized External Assessor for validated testing.

• HITRUST performs a quality assurance review before issuing the certification.

• Inheritance from certified cloud providers can reduce the number of controls you test directly.

How We Get You There

• Choose the right assessment level for your customers and risk profile.

• Readiness assessment and remediation roadmap mapped to HIPAA and the NIST Cybersecurity Framework.

• Policy, procedure, and evidence development aligned to HITRUST maturity requirements.

• External assessor coordination and ongoing vCISO support between assessments.

Resources

• HITRUST: The HITRUST Framework

• HITRUST: Assessments and Certifications (e1, i1, r2)

• HHS: The HIPAA Security Rule

• NIST Cybersecurity Framework (CSF)

• Related: SOC 2 and ISO/IEC 27001 and 27017

Ready to Start?

Tell us about your environment and customers and we will recommend the right HITRUST level and send a scoped readiness proposal. Request a quote.

HITRUST certifications are issued by HITRUST following assessment by an Authorized External Assessor. Temple of Epiphany provides readiness, remediation, and advisory services.