HITRUST certification
Prepare for HITRUST without starting from scratch
Reuse the controls you already run for HIPAA, SOC 2, and ISO 27001, then evidence the HITRUST requirements that remain for your assessor.
What HITRUST CSF is
The HITRUST CSF is a control framework maintained by HITRUST that harmonizes requirements from HIPAA, ISO 27001, NIST, PCI DSS, and other sources into a single set.
HITRUST offers assessments at increasing levels of assurance: e1 covers essential cybersecurity hygiene, i1 covers leading security practices, and r2 is tailored to your risk profile and is the most rigorous.
An authorized External Assessor performs the assessment, HITRUST reviews it through its quality assurance process, and HITRUST issues the certification.
Who needs HITRUST CSF
You sell to health systems, payers, or other healthcare organizations whose vendor review asks for HITRUST rather than, or alongside, a SOC 2 report.
How TrustLynce helps with HITRUST CSF
Reuse what you already run
Controls you evidence for HIPAA, SOC 2, or ISO 27001 map to the HITRUST requirements they satisfy.
Policy and procedure together
Each policy, the procedure that implements it, and the evidence that it operates, kept side by side the way r2 maturity scoring reviews them.
Evidence for your assessor
Organized by requirement, timestamped, and attributed to the system it came from.
Remediation tracking
Gaps found during readiness tracked with owners and dates before the validated assessment begins.
What the audit actually involves
Almost no competitor writes this down. Knowing the shape of it is most of what makes a first audit survivable.
Choose the assessment
e1, i1, or r2, usually decided by what your customers require.
Readiness
Self-assess against the requirements in scope and close the gaps.
Validated assessment
An authorized External Assessor tests your controls and submits the assessment to HITRUST.
Quality assurance and decision
HITRUST reviews the submission and makes the certification decision.
HITRUST CSF questions
The one your customers require. e1 is the lightest and r2 the most rigorous, and many buyers name the level in their vendor requirements.
Not necessarily. They answer different buyers: in healthcare, some accept SOC 2, some require HITRUST, and some ask for both.
e1 and i1 certifications are valid for one year. r2 is valid for two years, with an interim assessment in between.
No. An authorized External Assessor performs the assessment and HITRUST issues the certification.
Other frameworks
Evidence collected for one framework carries into the next.
SOC 2
The one your buyers ask for
ISO 27001
Recognised worldwide
HIPAA
Protect health information
GDPR
Handle EU personal data
PCI DSS
Take card payments safely
ISO 42001
Govern how you use AI
NIST CSF
A common security language
CMMC
Work with the DoD
Custom
Your own control set
ISO 27701
Privacy extension to ISO 27001
DORA
EU financial operational resilience
NIS 2
EU critical infrastructure cybersecurity
CCPA / CPRA
California comprehensive privacy
FERPA
Student education privacy standard
FDA 21 CFR Part 11
FDA electronic records & signatures
HDS Certification
French health data hosting certification
SOX ITGC
IT controls for public companies
FedRAMP
Sell cloud services to US agencies
NIST SP 800-53
The federal security control catalog
NIST SP 800-171
Protect CUI on federal contracts
Find out what your compliance program actually looks like
Thirty minutes, your real systems, no slideware. We'll show you what we'd automate first, and what you don't need us for.