Implementation walkthrough
How to implement HITRUST CSF: video walkthrough
A walkthrough of preparing for a HITRUST validated assessment and certification, from choosing the assessment to HITRUST's quality assurance review.
Key takeaways
- HITRUST CSF harmonises many standards and regulations into one control framework.
- Choose between the e1, i1 and r2 assessments.
- The r2 requirement set is tailored to the organisation's risk profile and scope.
- An External Assessor tests; HITRUST quality-assures and certifies.
- e1 and i1 last one year; r2 lasts two years with an interim assessment.
One harmonised framework, shared with many customers
HITRUST CSF is a control framework published by HITRUST that brings many standards and regulations together into one set of security and privacy controls. HITRUST describes it as harmonising more than 70 of them, including ISO/IEC 27001 and ISO/IEC 27002, NIST SP 800-53, HIPAA, PCI DSS and GDPR, and as threat-adaptive, with requirements revised as threat intelligence and breach data change. On the framework sit HITRUST's validated assessments, the e1, the i1 and the r2.
The case for HITRUST is commercial as much as technical: instead of answering a different questionnaire for every customer, an organisation can share one independently assessed and quality-assured result. This short film walks through how an organisation prepares.
Three roles kept apart
Start by choosing the assessment and defining the scope. The e1 covers 43 foundational controls, the i1 covers 182 leading-practice controls, and the r2 uses a set tailored to the organisation's risk profile, technology environment, business operations and scope, which is why two r2 assessments rarely look alike. The scope statement defines the organisation, systems, platforms, facilities and data covered, with an inventory of systems and data flows, and for the r2 the scoping answers also shape which requirements apply.
A gap analysis against the requirement statements tailored in MyCSF, HITRUST's platform, then guides implementation, with policies, procedures and implemented controls producing evidence over time. HITRUST keeps three roles apart. The organisation, the Assessed Entity, implements the controls and defines the scope. An External Assessor firm, vetted and trained by HITRUST, tests them; only these firms may perform validated assessments submitted for certification. HITRUST then reviews the assessor's work through central quality assurance and issues the result. The e1 and i1 certifications are valid for one year, and the r2 for two years with an interim assessment.
Sterling's expert and experienced consultants carry assessment choice, scoping, gap analysis and implementation with your team under Sterling OS™. Sterling prepares; it does not assess or certify.
HITRUST CSF at a glance
- Purpose
- Independent, centrally quality-assured evidence that sensitive and health information is protected against one harmonised control framework, shareable with many customers
- Relevant to
- Health-tech, SaaS, BPO, billing and data-services firms whose customers ask for HITRUST, and healthcare organisations themselves; the e1 suits start-ups, the r2 the most demanding environments
- Edition
- HITRUST CSF v11.9.0, the current release on HITRUST's framework page (checked September 2026); assessed through the e1 (43 controls), the i1 (182 controls) or the tailored r2
- Certification
- A HITRUST-authorised External Assessor performs the validated assessment; HITRUST quality-assures it and issues the certification: e1 and i1 valid one year, r2 two years with an interim assessment
- Sterling's role
- Assessment choice, scoping, gap analysis, implementation with your team, Effivity, training and validated-assessment readiness, then Sustain™
- Cost and timing
- Total investment for a HITRUST programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 12 months
HITRUST CSF: questions people ask
Which HITRUST assessment do we need: e1, i1 or r2?
The one your customers will accept, at the depth your risk justifies. HITRUST positions the e1, with 43 foundational controls, for start-ups and organisations with limited risk profiles; the i1, with 182 controls, for organisations whose security programme is already robust; and the r2, a tailored requirement set, for those that must demonstrate compliance with sources such as HIPAA or the NIST Cybersecurity Framework. Ask the customer to put its requirement in writing before you commit.
Is HITRUST certification the same as HIPAA compliance?
No. A HITRUST certification shows that an External Assessor tested your controls against the HITRUST CSF and that HITRUST quality-assured and certified the result. The CSF maps HIPAA, and HITRUST offers Insights Reports that map results to it, but the US Department of Health and Human Services states that it does not endorse or recognise private organisations' certifications regarding the Security Rule. Business associate agreements, breach notification and the rest of your HIPAA obligations remain yours either way.
Does Sterling perform the assessment or issue the certification?
No. Sterling prepares your organisation. The validated assessment is performed by an External Assessor firm that HITRUST has vetted and approved, and HITRUST reviews that work through its quality assurance and issues the certification. Keeping preparation and assessment in separate hands is what makes the result credible to your customers.
How long is a HITRUST certification valid?
An e1 or an i1 certification is valid for one year. The i1 can be renewed through a rapid recertification in its second year, which concentrates on around 60 core controls. An r2 certification is valid for two years and requires an interim assessment after the first year to confirm continued compliance.
How long does it take to get HITRUST certified?
Mostly it depends on the assessment and your starting point. HITRUST states that most companies complete the i1 certification process within six to twelve months, and that an e1 can deliver assurance in as few as four to six weeks. Expect longer when controls still have to be built, and longest for a first r2. Our plan is built on your scope, your gaps and your customer's date, not on a headline figure.
Keep exploring
Related to this video
The complete guide
Everything on HITRUST CSF
Start with the HITRUST CSF page, or go straight to the guide you need.
On the HITRUST CSF page
Often combined with HITRUST CSF
More videos: Healthcare, medical devices and life sciences
- How to implement ISO 14971Implementation walkthrough · 3 min 15 s
- ISO 14971 requirements explainedTwo-minute brief · 2 min
- How to implement ISO 13485Implementation walkthrough · 3 min 24 s
- ISO 13485 requirements explainedTwo-minute brief · 2 min
- How to implement ISO 22716Implementation walkthrough · 3 min 24 s
- ISO 22716 requirements explainedTwo-minute brief · 2 min
- ISO 7101 requirements explainedTwo-minute brief · 2 min
- How to comply with ADHICS in Abu DhabiCompliance walkthrough · 3 min 15 s
- ADHICS requirements explainedTwo-minute brief · 2 min
Talk to a consultant
Plan your HITRUST certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice