HITRUST CSF · Validated assessment and certification (e1, i1, r2)

HITRUST certification consulting for one assessment that answers many customers.

Reach HITRUST certification first time, with the assessment your customers actually asked for: an e1, an i1 or an r2, scoped to the service they rely on, with controls implemented and evidenced before the External Assessor starts testing. Sterling's expert and experienced consultants build the programme with your security, engineering and compliance teams, in 60+ countries, and stay with you through HITRUST's quality assurance and beyond. We ensure successful certification for our clients.

Book a free discovery call Start the free readiness check

One all-inclusive proposal for a fixed scope: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in a single proposal
A team of expert and experienced healthcare information security consultants, advising on management systems across sectors and countries since 2003
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not assess; the authorised External Assessor validates and HITRUST certifies

HITRUST at a glance

Purpose: Independent, centrally quality-assured evidence that sensitive and health information is protected against one harmonised control framework, shareable with many customers
Relevant to: Health-tech, SaaS, BPO, billing and data-services firms whose customers ask for HITRUST, and healthcare organisations themselves; the e1 suits start-ups, the r2 the most demanding environments
Edition: HITRUST CSF v11.9.0, the current release on HITRUST's framework page (checked September 2026); assessed through the e1 (43 controls), the i1 (182 controls) or the tailored r2
Certification: A HITRUST-authorised External Assessor performs the validated assessment; HITRUST quality-assures it and issues the certification: e1 and i1 valid one year, r2 two years with an interim assessment
Sterling's role: Assessment choice, scoping, gap analysis, implementation with your team, Effivity, training and validated-assessment readiness, then Sustain™
Cost and timing: Total investment for a HITRUST programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 12 months

8,100+ client engagements in 60+ countries.

HITRUST client experience

What it is

What is HITRUST CSF and what is it used for?

HITRUST CSF is a control framework published by HITRUST that brings many standards and regulations together into one set of security and privacy controls. HITRUST describes it as harmonising more than 70 of them, including ISO/IEC 27001 and ISO/IEC 27002, NIST SP 800-53 Revision 5, HIPAA, PCI DSS and GDPR, and as threat-adaptive: requirements are revised as threat intelligence and breach data change. On the framework sit HITRUST's validated assessments, the e1, the i1 and the r2, each tested by an External Assessor firm HITRUST has approved, reviewed by HITRUST's central quality assurance and, where the result qualifies, certified by HITRUST.

The case for HITRUST is commercial as much as technical. Instead of answering a different questionnaire and hosting a different audit for every customer, a vendor completes one validated assessment and shares the result with each customer that accepts it. For the customer, it means an independent firm tested the controls and HITRUST checked that firm's work. Neither benefit arrives unless the controls in scope actually operate, which is where most of the effort, and most of Sterling's work, sits.

Current version and assessments. The current release on HITRUST's framework page is HITRUST CSF v11.9.0 (checked 29 September 2026). HITRUST revises the CSF regularly; its comparison of v11.8.0 with v11.9.0 shows changed requirement statements and mappings, including HIPAA, NIST SP 800-53 and new AI security requirements. The assessments built on it are the e1 (43 foundational controls, valid one year), the i1 (182 controls, valid one year, with a rapid recertification option in year two) and the r2 (a requirement set tailored to your risk profile, valid two years with an interim assessment after the first). Confirm with your External Assessor which CSF version your assessment will use before scoping starts. HITRUST e1, i1 and r2 compared

Who it is for

Who needs HITRUST certification?

HITRUST certification is a market expectation rather than a legal duty. The demand usually comes from customers that manage the security risk of many vendors and want results they can compare. HITRUST positions the e1 for start-ups and organisations with limited risk profiles, the i1 for organisations whose security programme is already robust, and the r2 for those that must demonstrate compliance with authoritative sources such as HIPAA or the NIST Cybersecurity Framework. Organisations come to Sterling for HITRUST from four starting points:

A healthcare customer has written HITRUST into the contract. A health system, a health plan or a large enterprise wants a HITRUST result before it signs or renews. Establish first which assessment it will accept, e1, i1 or r2, and for which scope, because the three are very different projects.
Security questionnaires are consuming your team. Every customer sends its own spreadsheet and evidence requests. One validated assessment, shared with each customer that accepts it, can replace much of that repetition.
You run ISO/IEC 27001, SOC 2 or a HIPAA programme, and a customer now wants HITRUST as well. Much of the control work already exists, since the CSF counts ISO/IEC 27001, ISO/IEC 27002 and HIPAA among its sources. The job is mapping, closing the remaining gaps and presenting evidence the way an External Assessor will test it.
An earlier attempt stalled or scored badly. The scope was too wide, the evidence could not be produced on request, or an r2 was chosen where an i1 would have served. The programme needs re-scoping and a realistic plan, not another push at the same boundary.

The intended result is a certification your customers accept, on a scope that matches the service they rely on, and controls that keep it. That depends on the controls operating every day, not on one good month before the assessor arrives.

Business benefits

How HITRUST certification supports sales, trust and security

A HITRUST programme earns its keep in fewer questionnaires, quicker procurement and controls that hold up when someone tests them. We start where customer scrutiny is heaviest, usually the platform, the data and privileged access, and build outwards.

One result, many customersA validated, centrally quality-assured assessment shared with each customer that accepts it, instead of a new questionnaire and a new audit for every contract.
Quicker procurement and renewalsA security review can become a check of your certification and its scope, rather than months of spreadsheets passing back and forth.
Several obligations answered togetherControls harmonised across HIPAA, NIST, ISO/IEC 27001, PCI DSS and GDPR requirements, so one control set serves several frameworks and regulations.
Controls tested, not merely describedAn External Assessor tests how each control operates, and the r2 evaluates policy, procedure and implementation, so weaknesses surface in your plan rather than in a customer's incident report.
A path that grows with the companyAn e1 while you are young, the i1 as the programme matures, the r2 when customers require it, with the work carried forward at every step.
Results customers can rely onResults delivered as HITRUST-signed data through the Results Distribution System, with corrective action plan updates, instead of PDFs forwarded by e-mail.

Track a handful of measures that matter commercially: questionnaires answered from the certification, days from security review to signature, and the number and age of open corrective actions. A thicker evidence folder is not a business result.

Requirements

What are the main HITRUST CSF requirements?

The HITRUST CSF is a library of control requirements drawn from its authoritative sources, and no organisation implements the whole library. The assessment you choose decides which requirements apply: 43 foundational controls in the e1, 182 leading-practice controls in the i1, and in the r2 a set tailored to your risk profile, technology environment, business operations and assessment scope, which is why two r2 assessments rarely look alike. The table maps what each part of the scheme requires of you; the requirement statements themselves are tailored for your assessment in MyCSF, HITRUST's platform.

Element	What it requires of you	What it looks like in practice
Assessment scope The in-scope environment	Define the organisation, systems, platforms, facilities and data the assessment covers; for the r2 the scoping answers also shape which requirements apply	A scope statement a customer can read, an inventory of systems and data flows, and every boundary decision recorded with its reason
e1 1-year validated assessment: foundational cybersecurity	Implement and evidence 43 foundational security controls, the level HITRUST positions for start-ups and organisations with limited risk profiles	For each control, the policy or standard behind it, the configuration or record that shows it operating, and the owner who keeps it that way
i1 1-year validated assessment: leading security practices	Implement and evidence 182 controls that HITRUST curates as leading practice and keeps mapped to evolving threats	A programme mature enough that every control has an owner, a documented approach and operating evidence covering a period, not a single day
r2 2-year validated assessment: expanded practices	Implement a requirement set tailored to your risk profile and to the authoritative sources that matter to you, such as HIPAA or the NIST Cybersecurity Framework	Risk and compliance factors answered in MyCSF, a requirement set you can trace back to those answers, and evidence prepared for each requirement
Maturity evaluated Policy, procedure, implementation (r2)	Show that each requirement is written into policy, defined in an operational procedure and implemented in practice	Policy statements mapped to requirements, procedures people genuinely follow, and implementation evidence sampled across the whole scope
Inheritance Controls your providers operate	Where a provider's controls have been validated through HITRUST, inherit them instead of having them tested again	A shared-responsibility matrix per provider, inherited controls identified in MyCSF, and your own side of each shared control evidenced
Corrective action plans Gaps the assessment records	Plan and close the gaps the validated assessment identifies, and keep the customers relying on your results informed	Each plan with an owner, a date and closure evidence; customers receiving your results through the Results Distribution System see the updates
Keeping certified Renewal, rapid recertification, interim	Renew the e1 and i1 every year, the i1 with rapid recertification in year two on around 60 core controls; complete the r2 interim assessment after one year	A calendar that schedules the next assessment well before the current certification ends, with controls monitored in between
AI security Optional, for AI systems	Where you build or deploy AI systems, add the AI Security Assessment and Certification, on its own or paired with an e1, i1 or r2	An inventory of the AI systems in scope, control over who and what can reach models and agents, and the same evidence discipline as the core assessment

What does useful HITRUST evidence look like?

Evidence an External Assessor can test: policies mapped to the requirement statements, procedures that say who does what and how often, and records drawn from the systems themselves, such as access reviews, configuration exports, vulnerability scans with remediation tickets, training completion and incident records, across the whole scope. We organise it by requirement in Effivity from the first workshop and write nothing only to be seen, so the assessor samples daily practice, not a display prepared for the visit.

HITRUST requirements explained, assessment by assessment

Certification process

How do you get HITRUST certified?

HITRUST keeps three roles apart, and the separation is what gives the certification its value. Your organisation, the Assessed Entity, implements the controls and defines the scope. An External Assessor firm tests them; HITRUST vets and trains these firms, and only they may perform the validated assessments submitted to HITRUST for certification. HITRUST then reviews the assessor's work through central quality assurance and issues the result. Sterling prepares your organisation; Sterling does not assess, and you engage the External Assessor directly.

01
Choose the assessment and define the scope.Confirm which assessment your customers will accept, e1, i1 or r2, and the systems, facilities and data the certification has to cover.
02
Gap analysis: compare current controls with the requirements that apply.The gap analysis rates today's policies, procedures and implementation against the requirement statements for your assessment, keeps what works and agrees actions, owners and dates.
03
Implement the controls and let them run.Close the gaps, train the people involved and keep every control operating long enough to produce the evidence an assessor will sample.
04
Test internally and clear the findings.An internal audit against the requirement statements and a management review; we raise the findings first and you close them with evidence before the External Assessor arrives.
05
Complete the validated assessment.Your External Assessor tests the controls and submits the assessment to HITRUST, which performs its quality assurance review and issues the certification when the result qualifies.
06
Keep the certification current.Share results through the Results Distribution System, close corrective action plans and plan the next cycle: annual renewal for the e1 and i1, the interim assessment one year into the r2.

Check the credibility of the route, not just the price. Only HITRUST issues HITRUST certification, and only External Assessor firms that HITRUST has approved may perform the validated assessments submitted to it; HITRUST itself tells the Assessed Entity to carry out its own due diligence before engaging one. Ask any provider which assessment it recommends and why, who will perform the validated assessment, and how your customers will receive the result. How to choose a credible HITRUST provider · The certification buyer's checklist

Cost

How much does HITRUST certification cost?

No reliable single price exists for a HITRUST programme, because the assessment type moves the effort more than anything else. An e1 for a small cloud platform and an r2 across data centres, offices and outsourced operations are different projects. What we can promise is a proposal in which every component is visible and nothing is added later.

Cost component	What affects it
Consulting and implementation	The assessment type, current maturity, the systems and locations in scope, deliverables and how much of the work your team takes on (Design™ or Drive™)
Validated assessment and certification	The External Assessor firm's fee for testing and any HITRUST platform or assessment charges, quoted by them and identified separately so the programme cost stays comparable
Internal resources	Time from engineering, IT, security and HR, the security tooling the gaps call for, and any change to how systems, access and vendors are managed
Software and learning	Part of the Sterling engagement at no additional cost: Effivity runs the programme and Sterling Academy trains your people, with users, courses and access period set out in the proposal
Continued support	Interim assessment and rapid recertification preparation, corrective action plan closure, refresher training and CSF version changes, under Sustain™

What moves the price

The assessment type: e1, i1 or r2
Platforms, data centres, offices and countries in scope
Whether ISO/IEC 27001, SOC 2 or a HIPAA programme already runs, and how well
Controls you can inherit from providers already validated through HITRUST
The customer's deadline, and how much of the work your team can carry

What a Sterling proposal always shows

Deliverables, responsibilities, assumptions and exclusions, in writing
External Assessor and HITRUST charges shown separately, so the full cost can be compared
Effivity, training and Academy access listed at no additional cost
Payments tied to deliverables, not dates
One all-inclusive proposal. No surprises, ever

Timeline

How long does HITRUST certification take?

Plan in months. The assessment type sets most of the timetable: an e1 for a small, well-run organisation sits at the short end, HITRUST itself says most organisations complete the i1 process within six to twelve months, and a first r2, the most comprehensive of the three, needs the longest runway. Controls must operate long enough to produce evidence, then be tested by the External Assessor and quality-assured by HITRUST before anything is issued. We plan backwards from the date your customer needs, with milestones your team follows in Effivity.

Phase	What determines the pace
Assessment choice, scope and gap analysis	Clarity on what the customer will accept, access to system owners, and the state of existing policies and records
Implementation and remediation	The number of gaps, engineering capacity, tooling decisions, provider and inheritance arrangements, and the training rollout
Controls in operation	Controls running long enough to generate the records an assessor samples, followed by internal audit and management review
Validated assessment and HITRUST quality assurance	The External Assessor's availability and testing, how quickly you answer its requests, and HITRUST's quality assurance review before issue

If a contract depends on the certification, give us the date on day one. We will tell you what is achievable, which assessment fits the time available and which decisions cannot wait. A HITRUST certification date promised before anyone has examined your scope is a guess, not a plan.

Challenges

Common HITRUST implementation challenges

HITRUST programmes tend to stall in the same five places. Each has a practical answer.

The customer asked for "HITRUST" without saying which assessment.

Ask before you start. The e1, the i1 and the r2 differ in control count, depth and validity, and choosing the wrong one wastes months in either direction. We help you confirm in writing what the customer will accept, so the programme is sized to the requirement, not a guess.

The scope is wider than the service the customer relies on.

Every system, facility and team inside the scope has to be evidenced, and for the r2 the scope also changes which requirements apply. We draw the boundary around the platform, data and services the customer depends on, and record why everything else sits outside it.

Policies exist, but procedures and operating evidence do not.

An assessor wants more than a policy. We write procedures that reflect how your teams really work, then make sure each control leaves a record as it runs, so evidence builds up without a scramble before testing.

Cloud and service providers run half the controls.

Separate the controls your providers own, the ones you share and the ones that are yours alone. Where a provider's controls have been validated through HITRUST, inheritance can take them out of your testing; your side of each shared control still needs its own evidence.

Certification arrives, then the next cycle catches everyone unprepared.

The e1 and the i1 last one year, and the r2 needs an interim assessment after its first. On the day the certification is issued we schedule the next assessment, the open corrective action plans and the control monitoring in Effivity.

Your engagement

What your HITRUST engagement includes

Your agreed scope brings together what a certifiable security programme and a prepared team need. Plenty of providers sell a gap report and leave the rest to you; a Sterling engagement covers the whole route, from one team, under one all-inclusive proposal.

Assessment choice, scope and gap analysis
The assessment your customers need, the in-scope environment and the gaps against its requirements, with owners, dates and decisions agreed before work starts.
Policies, procedures and control implementation
Written for your environment on Sterling's own template sets, with your engineering and operations teams, and mapped to the requirement statements of your assessment.
Effivity ISO & GRC software
Your HITRUST programme runs in Effivity from the first week, included with the engagement at no additional cost.
Training for everyone
Preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement, and internal auditor training for the team that will audit the programme, as applicable to your standard.
Internal audit and management review
An internal audit against your requirement statements and a management review, conducted or facilitated as agreed, with findings closed before the External Assessor begins testing.
Validated-assessment readiness and support
Help with External Assessor due diligence, evidence requests during testing, questions arising from HITRUST's quality assurance and corrective action plans, until the certification is issued.

Certification decisions remain with HITRUST, after the External Assessor's validated assessment and HITRUST's quality assurance.

How we deliver

How Sterling supports your HITRUST implementation

Each HITRUST engagement runs on Sterling OS™, our delivery operating system: five phases, each with named deliverables, decision owners and evidence. Pick the level of support your capacity calls for; the method, the software and the accountability do not change.

01
Design™Guided implementation: your security and engineering teams do the build, with Sterling's structure, templates, workshops and coaching behind them.
02
Drive™Fully managed consulting: Sterling consultants carry the agreed work, from gap analysis to evidence, alongside your control owners.
03
Sustain™After certification: control monitoring, corrective action plans, the r2 interim assessment or the i1 rapid recertification, and training for new joiners, every year.
04
Automate™The programme in Effivity: scope, requirements, policies, evidence, risks, providers, audits and actions in one workspace.
05
Revise™New CSF versions, a step up from the e1 to the i1 or r2, AI security, and changes in your platforms, locations or customers.

At kick-off we agree the engagement team, the weekly working session, the deliverables and the people who decide. Progress is reviewed against those commitments, so a gap shows up in week three rather than in the assessor's first request list.

How Sterling OS™ works

Often combined with

Standards organisations pair with HITRUST CSF

Effivity · HITRUST compliance software, included in every engagement

How Effivity helps you fulfil, automate and simplify the requirements of HITRUST CSF v11.

Effivity, the ISO and GRC automation platform the Sterling group built and clients use in 50+ countries, comes with every Sterling HITRUST engagement. Your consultant configures the workspace within the agreed scope, so scope decisions, requirement mapping, policies, procedures, evidence, providers, audits and corrective actions sit in one place and your External Assessor samples a live system rather than a shared drive. Effivity runs alongside MyCSF, HITRUST's own platform, where the assessment itself is tailored and validated. The Effivity subscription is included with the engagement, at no additional cost.

Included in every engagement See Effivity

Effivity: Context of the Organisation dashboard with issues, interested parties and scope — Effivity · Context of the Organisation dashboard

Assessment scope

Scope, systems and data flows

The in-scope organisation, platforms, facilities and data flows held in one register, with the reason for every boundary decision, and reviewed when the environment changes, not rediscovered at the next assessment.

Requirement statements

Your requirements, mapped to your controls

The requirement statements of your assessment linked to the controls, owners and evidence that satisfy them, with the sources you also answer to, such as HIPAA or ISO/IEC 27001, visible on the same control.

Policy

Policies with owners and review dates

Every policy statement traced to the requirements it answers, then approved, versioned and reviewed on schedule, so the policy evidence an r2 evaluates is ready without a search.

Procedure

Procedures people follow

Operational procedures that state who does what, when and with which tool, linked to the policy above them and to the records they generate below them.

Implementation

Operating evidence, collected as work happens

Access reviews, configuration checks, vulnerability remediation, training completion, incidents and vendor reviews, each creating its record as the work is done and filed against the requirement it proves.

Inheritance

Provider controls and shared responsibility

A register of what your cloud and service providers operate, what is shared and what is yours alone, with each provider's HITRUST results on file and your side of every shared control evidenced.

Corrective action plans

Gaps closed on a timetable

Findings from internal audit and from the validated assessment turned into corrective action plans with owners, dates and closure evidence, ready for the updates your customers will see.

Across the programme

One control set for HITRUST, HIPAA, SOC 2 and ISO/IEC 27001

Controls mapped once to every framework you carry and evidenced once, with forms, workflows and reports adapted to how you work, without code.

What this means at the audit

An External Assessor asks for the scope, the policies and procedures behind each requirement, samples of operating evidence, the internal audit results and the open corrective actions. In Effivity each of those is a screen with dates, owners and attachments, not a folder rebuilt in the week testing begins. After certification, Sustain™ runs in the same workspace, so the interim assessment or the next renewal finds controls that never stopped operating.

Effivity for HITRUST: the guide Effivity GRC on effivity.com

In your engagement

Effivity subscription included, at no additional cost
Set up by your Sterling consultant for the agreed scope
Your policies, registers and evidence migrated, not retyped
Admin and user training for your team
Further modules (ISMS, PIMS, BCMS, QMS) when other standards join the programme

HITRUST client experience

Client letters on file, available on request.

Client feedback wall: letters on file

Signed client letters for HITRUST CSF are available on request. The client feedback wall lists every letter by standard.

How an integrated HITRUST programme runs

One control set, several assurance results.

All case studies

01
Health-tech and BPO: HITRUST on an existing ISMS, with HIPAA and SOC 2
How such a programme typically runs: an organisation already operating ISO/IEC 27001 or SOC 2 controls chooses the HITRUST assessment its customers accept, maps its controls to the requirement statements and closes only the gaps. HIPAA safeguards, the SOC 2 criteria and the HITRUST requirements share one control set and one evidence base, so the External Assessor, the CPA firm and the certification body each test the same records. This row describes the method; it is not a named client outcome.
Integrated programmes explained

Sterling Academy · HITRUST e-learning

Train every employee on HITRUST, not just the security team.

Controls fail through people as often as through technology, so the programme needs evidence that each person knows their part. Sterling Academy provides e-learning for everyone in scope and for the people who run the programme: short video lessons, practice checkpoints, a final exam and a numbered Certificate of Completion per learner that can be verified online. Through their Sterling consultant, clients receive preferential Sterling Academy course access and special pricing, including complimentary awareness training for their people as part of the engagement.

HITRUST CSF awareness for every employee in scope, with completion records for the evidence file
Practitioner courses for control owners, the security lead and the compliance team
Internal auditor training for the people who will audit the programme, as applicable to your standard, as part of the engagement
Learner progress by team and location, and a training status report ready for the External Assessor
New joiners trained as they arrive, so evidence stays current through interim and renewal assessments
Questions from learners answered by a Sterling consultant

Keep exploring

Explore more about HITRUST CSF

Watch a video on how to implement HITRUST here.
Watch a video on HITRUST requirements here.

HITRUST resources

Services for HITRUST CSF

Why Sterling

Want successful HITRUST certification? Come to Sterling.

Whether you are a health-tech start-up facing its first hospital contract, a BPO in the Philippines or India serving US healthcare clients, or a platform provider whose customers now expect an r2, Sterling builds a HITRUST programme your External Assessor can test and your people can run. We work through scoping, provider inheritance and the overlap with frameworks you already hold, so HITRUST becomes one more result from the same controls, not a second programme.

Security and compliance programmes in 60+ countries

Information security, privacy and compliance programmes delivered for BPOs, SaaS and health-tech providers, IT services firms and healthcare organisations, with one engagement team accountable in every country you operate in.

All-inclusive proposal

Consulting, Effivity, training and Academy access in one proposal, with External Assessor and HITRUST charges shown separately. No surprises, ever.

Controls your teams can operate

Less paperwork, more effect: policies, procedures, training and software tied to the way engineers, agents and administrators already work, so controls keep running after the assessor leaves.

Expert and experienced consultants

Consultants who have advised on information security, privacy and compliance programmes across sectors and countries since 2003, and who prepare your HITRUST programme properly the first time, so the validated assessment confirms what already works.

Sterling vs the rest: the full comparison Explore HITRUST client experience

The Sterling Promise

What our HITRUST certification success guarantee means

100%on-time completion · success · 8,100+ client engagements

We stay with you until your agreed HITRUST certification outcome is achieved: the assessment chosen and scoped, the controls in place and evidenced, and the validated assessment supported through testing, HITRUST's quality assurance and any corrective action plans. Clear explanations, practical delivery, included software and employee learning turn the investment into lasting capability rather than a certification that lapses at its first renewal.

The engagement identifies the assessment type, scope, outcome and responsibilities. Your organisation supplies accurate information and operates the agreed controls. The External Assessor tests them, and HITRUST reviews the assessment and retains the certification decision. Our commitment concerns the agreed certification support, not a promise of every future contract or of a future without incidents.

After certification

What happens after HITRUST certification?

A HITRUST certification has a short life by design: one year for the e1 and the i1, with the i1's rapid recertification available in year two, and two years for the r2, with an interim assessment after the first to confirm continued compliance. Customers who receive your results through the Results Distribution System also receive the updates on your corrective action plans.

Under Sterling OS™ Sustain™ we review control operation, incidents, providers and corrective actions with you alongside the planned internal audits and management reviews, and schedule the next assessment before the current certification ends. When customers ask for more, Revise™ plans the step from the e1 to the i1 or r2, or the addition of AI security, on the controls already in place.

FAQs

Frequently asked questions about HITRUST

Which HITRUST assessment do we need: e1, i1 or r2?

The one your customers will accept, at the depth your risk justifies. HITRUST positions the e1, with 43 foundational controls, for start-ups and organisations with limited risk profiles; the i1, with 182 controls, for organisations whose security programme is already robust; and the r2, a tailored requirement set, for those that must demonstrate compliance with sources such as HIPAA or the NIST Cybersecurity Framework. Ask the customer to put its requirement in writing before you commit.

Is HITRUST certification the same as HIPAA compliance?

No. A HITRUST certification shows that an External Assessor tested your controls against the HITRUST CSF and that HITRUST quality-assured and certified the result. The CSF maps HIPAA, and HITRUST offers Insights Reports that map results to it, but the US Department of Health and Human Services states that it does not endorse or recognise private organisations' certifications regarding the Security Rule. Business associate agreements, breach notification and the rest of your HIPAA obligations remain yours either way.

Does Sterling perform the assessment or issue the certification?

No. Sterling prepares your organisation. The validated assessment is performed by an External Assessor firm that HITRUST has vetted and approved, and HITRUST reviews that work through its quality assurance and issues the certification. Keeping preparation and assessment in separate hands is what makes the result credible to your customers.

How long is a HITRUST certification valid?

An e1 or an i1 certification is valid for one year. The i1 can be renewed through a rapid recertification in its second year, which concentrates on around 60 core controls. An r2 certification is valid for two years and requires an interim assessment after the first year to confirm continued compliance.

How long does it take to get HITRUST certified?

Mostly it depends on the assessment and your starting point. HITRUST states that most companies complete the i1 certification process within six to twelve months, and that an e1 can deliver assurance in as few as four to six weeks. Expect longer when controls still have to be built, and longest for a first r2. Our plan is built on your scope, your gaps and your customer's date, not on a headline figure.

Should we choose HITRUST or SOC 2?

They answer different questions. A SOC 2 report is a CPA firm's attestation on your controls against the AICPA trust services criteria; HITRUST certification is issued by HITRUST after an External Assessor tests your controls against the HITRUST CSF. Customers may ask for either, or for both. The controls overlap substantially, so run both on one control set and let customers decide which reports you commission.

We are certified to ISO/IEC 27001. How much of that carries over?

A good deal of the control work. The HITRUST CSF counts ISO/IEC 27001 and ISO/IEC 27002 among its sources, so your ISMS already addresses many HITRUST requirements. What changes is the evidence: the External Assessor tests each requirement statement in your assessment, and the r2 evaluates policy, procedure and implementation for each. The gap analysis maps what you have and shows what is left to do.

Can we inherit controls from our cloud provider?

Where your provider holds validated HITRUST results that can be inherited, yes, for the controls it operates. HITRUST supports the inheritance of validated controls through MyCSF and its Shared Responsibility and Inheritance Program. Your own side of every shared control, such as the user access and configuration you manage, still needs your evidence.

What happens if the External Assessor finds gaps?

Gaps recorded in the validated assessment become corrective action plans with owners and dates, and customers receiving your results through the Results Distribution System see their updates. Whether a result qualifies for certification is decided by HITRUST under its own scoring rules, so the aim is to find and close gaps in the internal audit, before the assessor does.

What do you need to prepare a HITRUST proposal?

The customer requirement and the assessment it names, the platforms, locations and data in scope, approximate headcount, the frameworks you already hold, the providers you rely on, and the target date. That is enough for a scoped, all-inclusive proposal; no policy set is needed first.

Before the first call

Prepare a useful HITRUST readiness brief

You need no policy set before the first discussion. Bring a short account of what customers ask for and what sits behind the service they rely on. Seven questions are enough:

Which customer or contract asks for HITRUST, and does it name the e1, the i1 or the r2? Or, if nobody has asked yet, why are you considering it?
Which platforms, applications, facilities and teams deliver the service the customer relies on, and what sensitive or health data do they handle?
Which cloud, hosting and service providers run parts of that service, and do any of them hold HITRUST results?
Which frameworks do you already hold or run, such as ISO/IEC 27001, SOC 2, HIPAA or PCI DSS, and what evidence exists for them?
What have customer questionnaires, audits or incidents told you about your weakest controls?
Who owns security, engineering and compliance decisions, and how much time can they give the programme?
Is there a contract date, a renewal or an existing certification cycle to plan around?

With these answers we can scope the work and give you a realistic price. They prepare a conversation, not a scored assessment, and they are not a HITRUST result.

Don’t be fooled by certification scams

If it takes ten days, it is not HITRUST certification.

Because customers ask for HITRUST by name, the market sells imitations of it: a self-assessment presented as a certification, a "HITRUST compliant" badge nobody tested, a certification whose scope covers one small system when the customer relies on the whole service, or one that expired a year ago. They cost less, until a customer's risk team asks to receive the result through HITRUST's own distribution system.

How to choose a credible HITRUST provider

Ask who performs the validated assessment. Only External Assessor firms approved by HITRUST may perform assessments submitted for certification; check the firm in HITRUST's own directory, not in a proposal.
Ask who issues the certification. HITRUST does, after its quality assurance review. Anyone offering to certify you themselves is not describing HITRUST certification.
Ask which assessment and which scope. An e1 is not an r2, and a certification for one platform says nothing about the rest of the service; both should match what your customer asked for.
Ask how your customers will verify the result. HITRUST shares results as HITRUST-signed data through its Results Distribution System, so a claim that cannot be checked there deserves a second look.
Ask what your people will learn and where the evidence will live. Without trained control owners and a system for evidence, every renewal starts again from zero.
Walk away from "HITRUST certified in ten days", "a self-assessment is enough" and one invoice for preparation and certificate. Controls have to be implemented and operating before an External Assessor can test them.

All ten warning signs of shortcut certification

What genuine HITRUST certification always involves

Implementation time, in months, scaled to the assessment and the scope
An assessment chosen for the customer's requirement: e1, i1 or r2
A defined scope, tailored and managed in HITRUST's MyCSF platform
Testing by an External Assessor firm that HITRUST has approved
HITRUST's central quality assurance before any result is issued
Certification issued by HITRUST, with results shared through its Results Distribution System
Annual renewal for the e1 and i1, and an interim assessment one year into the r2

Sterling's position. Sterling does not assess and does not certify. We consult, train and prepare you; the authorised External Assessor validates and HITRUST certifies. We do not sell badges, self-assessments dressed up as certification or certificates without implementation, and we tell you when an offer you have received is one. A self-assessment is a useful starting point; it is not a certification, and careful customers know the difference.

Holding or been offered a HITRUST result you are unsure about? Send it to us and we will tell you, free of charge, whether it would satisfy a careful customer.

Keep exploring

More on HITRUST CSF and related standards

More in Healthcare, medical devices & life sciences

Talk to a consultant

Plan your HITRUST certification with confidence.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

hello@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Get HITRUST certified for the first timeUnderstand cost, scope and timingChoose between the e1, i1 and r2Integrate HITRUST with HIPAA, SOC 2 or ISO/IEC 27001

Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice