Scoping call
Frameworks / HITRUST

HITRUST readiness for companies that sell to healthcare.

HITRUST is a certifiable security framework that maps to HIPAA, NIST, ISO 27001, and other standards. Health systems and payers often require it from vendors that handle patient data. HITRUST issues the certification after an authorized External Assessor tests your controls.

e1
Foundational assessment, valid one year
i1
182 requirements, valid one year
r2
Risk-based assessment, valid two years
v11.9
Current HITRUST CSF version (September 2026)
Source: HITRUST Alliance assessment and CSF documentation. Status as of October 2026.
How we help

Mapped from the controls you already run.

Most companies come to HITRUST after SOC 2. We map your existing controls to the HITRUST requirements in scope, close the technical gaps, write the policies HITRUST expects, and organize evidence in MyCSF for your External Assessor.

For an e1 or i1 built on an existing SOC 2 program, that is a defined project. For an r2, we will tell you on the scoping call whether we are the right fit.

Assessment types

Three assessments, from foundational to risk-based.

e1 · 44 requirement statements · valid 1 year
i1 · 182 requirement statements · valid 1 year
r2 · tailored to your risk factors; includes every i1 statement · valid 2 years, with an interim assessment at year 1
No fixed count published
Validity
0Year 1Year 2
e1
i1
r2
Interim
HITRUST CSF v11.9.0 (released September 24, 2026).

HITRUST also offers an AI Security assessment for companies that build AI applications or platforms. It is assessed together with an e1, i1, or r2.

Common questions

HITRUST questions.

Who performs the assessment?

A HITRUST-authorized External Assessor firm tests your controls; HITRUST reviews the results and issues the certification. Assessor firms may not build the controls they assess. Building them is our role.

Which assessment should we start with?

Start with the one your customer asks for. If no contract names a type, an e1 or i1 is usually a faster first certification than an r2.

How long does it take?

Readiness and remediation for an e1 or i1 often take a few months. An r2 commonly takes nine months or more, including HITRUST’s quality review. We give you a specific timeline after the Assessment.

Does our SOC 2 work help?

Yes. Many SOC 2 controls map to HITRUST requirements, so an existing SOC 2 program shortens the work. HITRUST is more prescriptive, so expect some gaps.

Health system asking for HITRUST?

On a scoping call we’ll help you choose an assessment type and estimate the work.

Book a scoping call