Is HITRUST Only for HIPAA-Covered Entities?
No. Any organisation can pursue HITRUST certification. In practice, most certified organisations are not covered entities at all. They are business associates and technology vendors: SaaS platforms, cloud providers, revenue cycle and BPO firms, analytics and AI companies, and offshore IT service providers that handle data for US healthcare customers. Non-healthcare sectors also use it. …