Plan for 3 to 5 months for a HITRUST e1, 5 to 9 months for an i1 and 9 to 15 months for a first r2. The main variables are how much remediation you need, the mandatory 90 days that new controls must operate before testing, the 90 day limit on assessor fieldwork, and HITRUST’s…
Read More “How Long Does It Take to Get HITRUST Certified?” »
Some customers care a great deal and some not at all. US payers, large health systems, PBMs and health tech platforms that manage their own vendor risk programmes routinely require HITRUST. Small providers, non-healthcare enterprises and most international buyers rarely ask. The only reliable answer comes from checking your own contracts, RFPs and security questionnaires. …
Read More “Do Your Customers Actually Care About Your HITRUST Certification? ” »
HITRUST certification is not one-size-fits-all. Depending on your organisation’s risk profile, customer requirements and compliance maturity, you may need e1, i1 or r2. The challenge is choosing the right level without over-investing — or choosing a level that your customers will not accept HITRUST e1, i1 and r2 at a glance One important advantage is…
Read More “What Are the Different Levels of HITRUST Certification?” »
HIPAA is a US federal law that requires covered entities and business associates to protect health information. HITRUST is a private organisation whose framework, the HITRUST CSF, turns HIPAA and other standards into prescriptive, testable controls with an independent certification. HIPAA tells you what to achieve. HITRUST shows how, and proves it. What is HIPAA? …
SOC 2 is a flexible attestation report issued by a CPA firm against the AICPA Trust Services Criteria. HITRUST is a prescriptive, scored certification issued by HITRUST against the HITRUST CSF. Choose SOC 2 for broad SaaS and enterprise buyers. Choose HITRUST when selling to US payers, health systems or anyone handling large PHI volumes….
Read More “HITRUST vs. SOC 2: Which Certification Do You Really Need? ” »
No. HITRUST certification is not mandatory under any US federal law, including HIPAA. It becomes mandatory in practice when a customer, typically a payer, health system or large health tech platform, writes it into a contract, business associate agreement or vendor risk programme. For many healthcare vendors, that commercial requirement is as binding as a…
Read More “Is HITRUST Certification Mandatory for Healthcare Companies? ” »
HITRUST certification cost has four parts: HITRUST’s own fees, external assessor fees, remediation spend and internal effort. Publicly quoted all-in first-year ranges run from tens of thousands of US dollars for an e1 to well into six figures for an r2. Scope, assessment type and control maturity drive the number far more than company size. …
Read More “How Much Does HITRUST Certification Actually Cost? ” »
HITRUST certification is worth it when at least one of three conditions is true: a customer or prospect contractually requires it, more than roughly a quarter of your pipeline is US healthcare enterprise, or you hold large volumes of PHI. If none apply, a SOC 2 Type 2 report or a HITRUST e1 is usually…
Read More “Is HITRUST Certification Worth the Cost and Effort? ” »
HITRUST originally stood for the Health Information Trust Alliance. Today the organisation simply uses the name HITRUST. It is a private standards body, founded in 2007, that publishes the HITRUST CSF, a certifiable security and privacy framework that consolidates HIPAA, NIST, ISO 27001, PCI DSS and other standards into one set of controls that an…
Read More “What Does HITRUST Stand For and Why Should Your Business Care?” »
