HITRUST e1 and i1 certifications are valid for one year and must be renewed annually through a new validated assessment. The i1 offers a lighter rapid recertification in alternate years for eligible organisations. The r2 certification is valid for two years, provided an interim assessment is completed successfully around the one-year anniversary.
Renewal cycles at a glance
| Level | Validity | Year 1 | Year 2 | Year 3 |
| e1 | 1 year | Validated assessment | Full validated assessment | Full validated assessment |
| i1 | 1 year | Validated assessment | Rapid recertification if eligible, otherwise full | Full validated assessment |
| r2 | 2 years | Validated assessment | Interim assessment | Full validated assessment |
How does e1 renewal work?
The e1 is repeated in full each year against the then current CSF version. Because it is compact, renewal is usually a matter of weeks of fieldwork, provided evidence routines have run through the year.
What is i1 rapid recertification?
In the year after a full i1, an organisation whose scope and control environment have not materially changed can use rapid recertification. The assessor tests a reduced sample of requirement statements rather than the full set. If the sample shows degradation, or if significant changes have occurred, a full i1 is required. The following year returns to a full assessment. Eligibility rules are defined by HITRUST and should be confirmed for your CSF version.
What is the r2 interim assessment?
The interim assessment keeps an r2 certification valid through its second year. It is due around the one-year anniversary of the certification date and typically involves:
1. Assessor testing of a sample of requirements, with at least one from each of the 19 domains.
2. Review of progress on corrective action plans from the original assessment.
3. Confirmation that there have been no significant changes to scope or no security breaches that undermine the certification.
4. Submission through MyCSF and HITRUST review.
Failure to complete the interim assessment on time puts the certification at risk.
What counts as a significant change?
Inform your assessor early if any of these occur during the certification period:
- Migration between data centres or cloud providers
- Major application re-architecture
- Mergers, acquisitions or divestitures affecting scope
- New in-scope facilities or outsourcing of key control operations
- A security incident affecting the in-scope environment
Significant change may require additional testing or re-assessment.
When should you start recertification?
Work backwards from expiry. HITRUST expects submission ahead of the expiry date to allow for QA. A prudent calendar:
| Time before expiry | Action |
| 9 months | Confirm scope, CSF version and assessor. Review open CAPs |
| 7 months | Internal readiness check. Identify control drift |
| 6 months | Remediate. Remember the 90 day incubation rule for changed controls |
| 4 months | Book QA reservation. Start validated fieldwork |
| 2 months | Submit to HITRUST |
| Expiry | New certification issued with no gap |
The most common cause of a lapse is starting four months out and discovering a control that needs 90 days of operating history.
What if you will not make the date?
For r2, HITRUST offers a bridge certificate in defined circumstances. It is a short-term extension, typically 90 days, designed to cover a gap while recertification is completed. It requires an application supported by your assessor and is not automatic. There is no equivalent safety net to rely on for poor planning, so treat the bridge as a contingency only and confirm current rules with HITRUST.
Does the CSF version change at renewal?
Often, yes. HITRUST retires versions for new assessment objects on a published schedule. For example, new e1 and i1 objects had to be created on v11.8.0 from 7 May 2026. At each renewal, review the changes between your previous version and the current one. They are usually modest for e1 and i1 but should not be discovered during fieldwork.
Key takeaways
- e1 and i1: annual. r2: two years with interim at month 12.
- i1 rapid recertification reduces year two effort for stable environments.
- Track significant changes and tell your assessor early.
- Start renewal planning nine months before expiry.
- The bridge certificate is a contingency, not a plan.
Frequently asked questions
How long is HITRUST certification valid?
One year for e1 and i1. Two years for r2, subject to a successful interim assessment.
What is a HITRUST interim assessment?
A lighter assessment at the one-year point of an r2 that samples requirements across all domains and reviews corrective action plan progress.
What is HITRUST rapid recertification?
An i1 option in the year after full certification that tests a reduced sample where the environment has not materially changed.
What is a HITRUST bridge certificate?
A short-term extension for r2 certifications in defined circumstances while recertification is completed.
When should I start HITRUST recertification?
Begin planning about nine months before expiry and start fieldwork about four months before.
About Finstein
Finstein is a HITRUST Authorized External Assessor. Our team includes CCSFP and CHQP qualified HITRUST professionals, CISA certified auditors and ISO 27001 lead auditors, led by Chartered Accountants. We support readiness assessments, validated e1, i1 and r2 assessments, interim assessments and recertification for organisations in the US, India, the UK and the Middle East that serve US healthcare, using an efficient remote delivery model. Get your renewal calendar mapped.
