A HITRUST assessment is the process of evaluating your controls against the HITRUST CSF. Certification is the outcome HITRUST grants when a validated assessment, performed by an Authorized External Assessor and reviewed by HITRUST quality assurance, meets the scoring thresholds. You can complete an assessment and not be certified. You cannot be certified without a validated assessment.
What types of HITRUST assessment exist?
| Assessment type | Performed by | Reviewed by HITRUST? | Results in certification? | Purpose |
| Readiness assessment (self-assessment) | The organization, often with assessor support | No, or limited | No | Identify gaps before validation |
| Validated assessment (e1, i1, r2) | Authorized External Assessor | Yes, full QA | Yes, if thresholds met | Obtain certification |
| Interim assessment (r2) | Authorized External Assessor | Yes | Maintains certification | Keep r2 valid in year two |
| Rapid recertification (i1) | Authorized External Assessor | Yes | Yes | Lighter i1 renewal |
| Bridge assessment (r2) | Authorized External Assessor | Yes | Temporary bridge certificate | Cover a short gap before recertification |
What is a readiness assessment?
A readiness assessment, sometimes called a gap assessment or self-assessment, applies the same requirement statements and scoring rubric but without formal validation. The output is a gap list, indicative scores and a remediation roadmap. It has no standing with customers as assurance, though a readiness report from an Authorized External Assessor is often accepted as proof that a credible programme is under way.
What is a validated assessment?
In a validated assessment, the external assessor:
1. Confirms scope and assessment parameters in MyCSF.
2. Tests each requirement using inquiry, inspection, observation and sampling.
3. Scores each requirement using the HITRUST scoring rubric.
4. Documents workpapers and links evidence in MyCSF.
5. Completes an internal quality review, led by a Certified HITRUST Quality Professional (CHQP).
6. Submits to HITRUST.
HITRUST then performs its own QA, raises queries and issues the report.
So what is certification?
Certification is HITRUST’s formal statement that the validated assessment met the requirements:
- e1 and i1: each domain averages at least 83.
- r2: each domain averages at least 62, with corrective action plans recorded for qualifying gaps.
The deliverables are a certification letter and a validated report.
Can you be assessed and not certified?
Yes. If thresholds are not met, HITRUST can issue a validated report without certification. It shows relying parties your independently validated scores but confers no certified status. Organisations then remediate and are reassessed. A sound readiness assessment makes this outcome unlikely.
Compliant vs certified: why wording matters
| Phrase | Meaning | Safe to use? |
| HITRUST certified | HITRUST has issued a current certification | Yes, with level and scope |
| HITRUST validated | Validated assessment completed, may or may not be certified | Only if accurate and explained |
| HITRUST compliant | No formal meaning | Avoid. It implies a status that does not exist |
| HITRUST ready | Marketing language | Avoid in contracts and RFPs |
| Aligned with the HITRUST CSF | Controls designed to the framework, not independently validated | Acceptable if true |
Procurement and legal teams increasingly challenge vague wording. Misstating status in an RFP response is a contractual and reputational risk.
Who is involved in each stage?
- You: project lead, control owners, executive sponsor.
- Authorized External Assessor: CCSFP qualified practitioners perform testing. A CHQP performs quality review.
- HITRUST: owns the CSF and MyCSF, performs QA and issues certification.
Independence matters. An assessor firm can support readiness and then perform validation, but must not assess controls that it designed or operated on your behalf. Ask any assessor how they manage this.
Which one do you need right now?
| Your situation | Next step |
| Never assessed, no deadline | Readiness assessment |
| Customer deadline within 6 months, mature controls | Short readiness check, then validated e1 or i1 |
| r2 certified, 10 to 12 months since certification | Interim assessment |
| i1 certified last year, stable environment | Rapid recertification |
| r2 expiring, recertification running late | Discuss bridge assessment with your assessor |
Key takeaways
- Assessment is the process. Certification is the result.
- Only validated assessments reviewed by HITRUST lead to certification.
- “HITRUST compliant” has no formal meaning.
- A validated report without certification is a possible outcome.
- Readiness work is the best insurance against it.
Frequently asked questions
Is HITRUST compliant the same as HITRUST certified?
No. Only “certified” is a formal status issued by HITRUST. “Compliant” has no defined meaning.
Can you fail a HITRUST assessment?
You can fall below the scoring thresholds, in which case HITRUST may issue a validated report without certification.
Who issues HITRUST certification?
HITRUST issues it, based on the external assessor’s validated assessment and HITRUST’s QA review.
What is a HITRUST readiness assessment?
A gap analysis against HITRUST requirements performed before validation to identify and fix weaknesses.
Can the same firm do readiness and validation?
Yes, provided independence rules are respected and the firm does not assess controls it implemented or operates.
About Finstein
Finstein is a HITRUST Authorized External Assessor. Our team includes CCSFP and CHQP qualified HITRUST professionals, CISA certified auditors and ISO 27001 lead auditors, led by Chartered Accountants. We support readiness assessments, validated e1, i1 and r2 assessments, interim assessments and recertification for organisations in the US, India, the UK and the Middle East that serve US healthcare, using an efficient remote delivery model. Ask which assessment type you need next.
