No. HITRUST certification is not mandatory under any US federal law, including HIPAA. It becomes mandatory in practice when a customer, typically a payer, health system or large health tech platform, writes it into a contract, business associate agreement or vendor risk programme. For many healthcare vendors, that commercial requirement is as binding as a legal one.
Does any law require HITRUST?
No federal statute or regulation names HITRUST as a requirement.
- HIPAA requires covered entities and business associates to implement administrative, physical and technical safeguards, conduct risk analysis and manage risk. It does not prescribe a framework and HHS does not recognise or endorse any certification as proof of compliance.
- HITECH Act extended HIPAA obligations to business associates and increased penalties. It does not mandate certification.
- State laws. Some states reference recognised cybersecurity frameworks in safe harbour statutes for breach litigation. Where they do, HITRUST-aligned programmes can help, but certification itself is not mandated. Confirm the position with counsel for each state relevant to you.
So from a strict legal perspective, a healthcare company can be fully HIPAA compliant without ever engaging HITRUST.
Then why does everyone say HITRUST is required?
Because the requirement comes from the market, not the regulator. Three mechanisms make it binding:
1. Contract clauses. Master service agreements and BAAs state that the vendor “shall obtain and maintain HITRUST CSF certification” within a defined period, often 12 to 24 months from signing.
2. Third-party risk management programmes. Large payers and health systems tier their vendors by data sensitivity. Vendors in the top tiers, those handling significant PHI volumes, are required to present HITRUST r2 or i1. Lower tiers may be accepted with e1 or SOC 2.
3. RFP scoring. Even where not an absolute condition, HITRUST certification carries scored weight. Uncertified bidders start at a disadvantage.
Historically, a group of major US payers publicly announced that their business associates would be expected to obtain HITRUST certification. That set the market norm, and the practice has since spread to health systems, PBMs and health tech platforms that pass the requirement down to their own subcontractors.
Who is most likely to face a HITRUST requirement?
| Organisation type | Likelihood of requirement | Typical level requested |
| Claims processors, RCM and medical billing firms | Very high | r2 or i1 |
| Health tech SaaS handling PHI for payers or health systems | High | i1 or r2 |
| Cloud hosting and managed service providers | High | r2 |
| Offshore BPO and IT service providers serving US healthcare | High | i1 or r2 |
| Telehealth and digital health start-ups | Moderate, rising | e1 or i1 |
| Small physician practices | Low | Rarely requested |
| Analytics and AI vendors using de-identified data | Low to moderate | e1 or SOC 2 |
Is HITRUST mandatory for HIPAA covered entities?
No. Hospitals, clinics and health plans are regulated by HIPAA, not HITRUST. Many large covered entities voluntarily certify because it structures their own security programme and sets the standard they expect from vendors. Smaller providers rarely certify unless a partner or payer contract asks for it.
Even if not mandatory, is there a legal benefit?
Yes. Public Law 116-321 (H.R. 7898), enacted in January 2021, amended the HITECH Act. It requires HHS OCR to consider whether a covered entity or business associate had recognized security practices in place for at least the previous 12 months when determining fines, audit outcomes and remedies after a security incident.
Recognized security practices include the NIST Cybersecurity Framework, the HHS 405(d) practices and other programmes developed under statutory authorities. A maintained HITRUST certification, which maps to NIST, provides strong, independently validated evidence that such practices existed and operated. It does not grant immunity, but it can materially influence enforcement outcomes.
What are the alternatives if a customer asks for HITRUST?
Before committing, check whether the customer will accept an alternative. Options, in order of how often they are accepted:
1. HITRUST e1 or i1 instead of r2. Many customers say “HITRUST” without specifying level. Ask.
2. SOC 2 Type 2 with HIPAA mapping. Accepted by a good share of mid-market buyers.
3. SOC 2 plus HITRUST. A combined report using HITRUST CSF criteria.
4. ISO/IEC 27001 certification. More common with international buyers, less persuasive to US payers.
5.A time-bound commitment. A contractual roadmap to certify within 12 to 18 months, supported by a readiness assessment report.
Option 5 is under-used. A readiness report from an Authorized External Assessor often satisfies procurement for the first contract year.
How should you respond when a customer demands HITRUST?
1. Ask for the exact clause and the assessment level required.
2. Ask for the deadline and whether an interim deliverable (readiness report, e1) is acceptable.
3. Quantify the contract value against the programme cost.
4. Commission a scoping and readiness assessment.
5.Negotiate the timeline. Allow for the 90 day control incubation period and HITRUST QA turnaround.
Key takeaways
- HITRUST is not required by HIPAA or any federal law.
- It is commonly required by contract, vendor risk programmes and RFPs.
- The 2021 HITECH amendment gives maintained security frameworks real weight in OCR enforcement.
- Always confirm the level required before scoping. Many customers accept e1 or i1.
- A readiness report plus a committed roadmap can buy time.
Frequently asked questions
Does HIPAA require HITRUST certification?
No. HIPAA requires safeguards and risk management but does not require or recognise any certification.
Can a customer legally require me to get HITRUST certified?
Yes. It is a commercial contract term. If you sign a contract or BAA containing the clause, you are contractually bound to comply.
Is HITRUST mandatory for business associates?
Not by law. Many payers and health systems require it of business associates handling significant PHI.
Will SOC 2 be accepted instead of HITRUST?
Sometimes. Mid-market buyers often accept SOC 2 Type 2. Large payers and health systems more frequently insist on HITRUST.
What happens if I ignore a HITRUST contract requirement?
You risk breach of contract, loss of renewal, exclusion from RFPs and downgrade in the customer’s vendor risk tiering.
About Finstein
Finstein is a HITRUST Authorized External Assessor supporting vendors in India, the US, the UK and the Middle East that sell into US healthcare. Send us your customer’s security clause and we will tell you exactly which HITRUST level it requires, at no charge.
HITRUST #HITRUSTCSF #HIPAACompliance #HealthcareCybersecurity #Cybersecurity #HealthcareIT #GRC #Compliance #DataSecurity #RiskManagement #Finstein #FinsteinCyber
