Yes. HITRUST reports exist to be shared with relying parties such as customers, prospects, partners, auditors and insurers. Share the certification letter freely with appropriate wording. Share the full validated report, which contains scope detail, scores and corrective action plans, only under NDA and preferably through HITRUST’s secure results distribution tools.
What documents do you receive from HITRUST?
| Document | Contents | Sensitivity | Typical audience |
| Certification letter | Organisation, assessment type, CSF version, scope summary, certification dates | Low | Customers, prospects, partners |
| Validated assessment report | Letter plus scope description, domain scores, assessment context, CAPs | High | Customer TPRM and security teams under NDA |
| Additional compliance reports (r2) | Views against selected authoritative sources, for example HIPAA or NIST | High | Regulators, auditors, customers under NDA |
| Interim or bridge documentation | Confirms ongoing validity | Low to medium | Customers tracking your status |
Who will ask for it?
- Customer vendor risk teams at onboarding and each annual review
- Prospects during security evaluation
- Your customers’ own HITRUST assessors, to support third-party assurance
- External auditors, including SOC 2 auditors who may rely on it
- Cyber insurers at underwriting
- Investors and acquirers in due diligence
Should you require an NDA?
For the full report, yes. It describes your architecture, locations, technology stack and open weaknesses. That is useful reconnaissance for an attacker. Good practice:
1. Share the certification letter without NDA.
2. Share the full report only under an NDA or existing confidentiality clause.
3. Watermark copies with recipient name and date.
4. Log who received which version.
5. Prefer controlled access through a trust centre or HITRUST’s own sharing mechanism over email attachments.
How does HITRUST support secure sharing?
HITRUST provides a Results Distribution System (RDS) that lets assessed entities share assessment results electronically with relying parties, who can view authenticated results and, where permitted, consume them into their own risk tools. HITRUST also operates the Assessment XChange for organisations managing vendor assurance at scale. Two benefits: recipients know the results are authentic, and you keep control of access. Confirm current features with HITRUST, as these services evolve.
How can a customer verify a certification is genuine?
Relying parties should check that:
- The letter is issued by HITRUST, not by the assessor.
- The organisation name and legal entity match the contract.
- The scope includes the platform, facilities and services they use.
- The assessment type (e1, i1, r2) meets their policy.
- The dates are current, and for r2 that the interim assessment has been completed.
- Results are shared through HITRUST’s distribution system or verified with HITRUST where there is doubt.
Can you publish the letter or the report?
You may announce certification and describe it accurately. Publishing the full report is unwise and unnecessary. Posting the letter publicly is permitted by many organisations but a better pattern is a trust page that states the facts and offers the letter on request. HITRUST publishes communication and branding guidelines for certified organisations. Follow them, particularly on naming the assessment type and scope.
What should you redact or avoid?
- Do not alter the report. Share it whole or not at all. Partial extracts create misrepresentation risk.
- Do not share an expired report as current.
- Do not imply that certification of one product covers the entire company.
- Do not share your MyCSF workpapers. Those are not for relying parties.
How do you handle questions about corrective action plans?
Customers will ask. Prepare a short CAP status summary with owner, target date and progress for each item. Open CAPs are normal. Unmanaged CAPs are a red flag.
Key takeaways
- Sharing is expected. Control it.
- Letter: share widely. Full report: NDA only.
- Use HITRUST’s distribution tools or a trust centre.
- Make sure scope matches what the customer buys.
- Keep a CAP status summary ready.
Frequently asked questions
Is a HITRUST report confidential?
The full validated report contains sensitive security detail and should be treated as confidential and shared under NDA.
Can I post my HITRUST certification letter on my website?
You can announce certification and may share the letter, but most organisations provide it on request through a trust page.
What is the HITRUST Results Distribution System?
It is a HITRUST service for securely sharing authenticated assessment results with relying parties.
How can I verify a vendor’s HITRUST certification?
Check the HITRUST issued letter for entity, scope, type and dates, and request results through HITRUST’s sharing system if in doubt.
Do customers see our gaps in the report?
Yes. The full report lists corrective action plans, which is why it should be shared under NDA with a status update.
About Finstein
Finstein is a HITRUST Authorized External Assessor. Our team includes CCSFP and CHQP qualified HITRUST professionals, CISA certified auditors and ISO 27001 lead auditors, led by Chartered Accountants. We support readiness assessments, validated e1, i1 and r2 assessments, interim assessments and recertification for organisations in the US, India, the UK and the Middle East that serve US healthcare, using an efficient remote delivery model. Ask us how to set up a report sharing process.
