The HITRUST certification is an independent assessment of an organization’s information security controls against the HITRUST Common Security Framework (CSF), which is widely used in healthcare. An authorized external assessor evaluates the controls, and HITRUST reviews the results before issuing a certification letter. The letter identifies the certification level, scope, and expiration date.
Also called: HITRUST CSF certification, HITRUST certified. HITRUST’s levels are e1, i1, and r2.
Quick facts
- Function: Security assurance
- Domain: Healthcare information security
- Used by: Compliance officers, vendor risk teams, IT security leaders
- Related Terms: SOC 2 Type II, ISO 27001, Business Associate Agreement (BAA)
What are the HITRUST certification levels?
HITRUST offers three certification levels: e1, i1, and r2. Each addresses different security assurance needs.
- e1: Covers essential cybersecurity practices and requires annual recertification.
- i1: Assesses a broader set of implemented security controls and requires annual recertification.
- r2: provides a tailored, risk-based assessment of security control, with a two-year certification cycle and an interim assessment.
Healthcare organizations should choose a level based on their risk exposure, security requirements, and the sensitivity and volume of protected health information (PHI) a vendor handles.
How does an organization get certified?
An organization seeking HITRUSH certification follows four main steps:
- Define the scope: Identify the systems, facilities, teams, and processes included in the assessment.
- Complete the assessment: Work with an authorized external assessor to evaluate controls against the applicable HITRUST requirements.
- Submit for review: Send the assessment to HITRUST for quality assurance and validation.
- Receive certification: If the assessment meets the requirements, HITRUST issues a certification letter documenting the level, scope, and expiration date.
HITRUST Certified vs. compliant vs. mapped
The following terms describe different types of security assurance:
- Certified: HITRUST has reviewed the assessment and issued a certification letter for the stated scope.
- Compliant: This is not an official HITRUST certification status. Organizations may use the term informally to describe their security practices or alignment with requirements.
- Mapped: Another framework’s controls, such as SOC 2, have been cross-referenced to the HITRUST CSF. Mapping alone does not mean an organization is HITRUST certified.
What does certification cover?
The HITRUST certification applies only to the system, facilities, teams, and processes included in the documented assessment scope. A software platform’s certification does not automatically cover an outsourced team that uses the platform. Buyers should confirm that the certification covers the specific services and operations relevant to their business.
Why does it matter when outsourcing patient access?
Outsourced patient access teams may handle large volumes of PHI through scheduling, patient registration, insurance verification, and other administrative services. Healthcare organizations should verify that a vendor’s security assurance covers the people, processes, and systems supporting those services.
Questions to ask an outsourcing vendor
Before selecting a healthcare outsourcing partner, ask:
- Which HITRUST certification level do you hold? For example, ROI CX Solutions is HITRUST r2 certified.
- When does the certification expire? Verify that it is current.
- What is included in the certification scope? Check whether the relevant teams, systems, facilities, and services are covered.
FAQs
Is HITRUST certification required by HIPAA?
HIPAA does not require organizations to obtain HITRUST certification. However, many healthcare organizations use it to evaluate the security of vendors that handle PHI and may require it as part of their vendor risk management process.
How long does HITRUST certification last?
The e1 and i1 certifications follow a one-year cycle and the r2 certification follows a two-year cycle.
Can a SOC 2 report be mapped to HITRUST?
Yes, SOC 2 controls can be cross-referenced to the HITRUST CSF to identify areas of alignment and potential gaps. However, mapping a SOC 2 report to HITRUST does not grant HITRUST certification.
