What is HITRUST Certification?

HITRUST offers three information protection assessments, all of which allow an organization to assess the maturity of their information protection program. All three assessments can be performed as readiness or validated assessments.

HITRUST readiness assessments are designed to allow an organization to identify the controls that they will be assessed against, understand their current state maturity, and plan remediation where needed.

HITRUST validated assessments allow organizations to achieve HITRUST Certification. As a result, these assessments are subject to rigorous control validation procedures by HITRUST Authorized External Assessors and quality assurance procedures by HITRUST to ensure every report is rely-able.

All HITRUST assessments:

• are threat adaptive, meaning that they are regularly updated by HITRUST to ensure they address the most common cyber threats based upon data received from a leading threat intelligence provider.
• are scored using a control maturity model which allows an organization to demonstrate compliance
• utilize the HITRUST CSF, a leading information protection framework which is built upon over 40 authoritative sources, such as ISO 27001, NIST SP 800-53, CCPA, HIPAA and GDPR, and MyCSF, our innovative Software-as-a-Service delivery platform that allows organizations to rapidly perform assessments
• benefit from shared, nested CSF controls so past assessment work can be leveraged and reused

How do I obtain a HITRUST Certification?

HITRUST Certification represents the gold standard in information protection assurances. This achievement demonstrates your organization is taking the most proactive approach to data protection and risk migration and adhering to the highest information security standards. HITRUST Certification is globally recognized, and applicable to all industries, throughout the supply chain. Certification allows your organization to prove you have undergone a rigorous control maturity assessment. HITRUST Certifications are the result of completion of a validated assessment where the necessary scoring threshold to achieve certification has been met.

Why would I need a HITRUST Certification if my application and data are hosted in a HITRUST-Certified cloud environment?

Security assurances and implementation of sufficient controls always remain the responsibility and accountability of cloud tenants, whether hosted in cloud environment is HITRUST-Certified or not. Only the cloud tenants ultimately control who, how, or when their data and applications are accessed. Therefore, as a cloud tenant, you are on the hook for ensuring your own customers can safely use the application and not risk unauthorized access to their data. Fortunately, when hosting in a HITRUST-Certified cloud environment, cloud tenants have the opportunity to save significant time, money, and effort by relying on (or “inheriting”) up to 60% of HITRUST CSF controls already covered by HITRUST-Certified cloud providers that secure the underlying cloud infrastructure and physical security that host tenant applications and data.

Who uses, recommends, and accepts HITRUST Certification?

• 81% of US hospitals and health systems
• 83% of US health plans
• 75% of Fortune 20 Companies

HITRUST Selected for TEFCA Security Certification
Health 3rd Party Trust Initiative

What assessment do I need?

HITRUST offers three primary assessments, which vary by levels of assurance, complexity, effort, time to complete, and expense. Each level builds on the next, providing you the option to leverage previous, active certifications to enhance your level of assurance, and to meet and exceed what one customer requires in favor of an approach that will satisfy multiple requirements of multiple organizations with whom you do business. We recommend starting with a conversation with one of HITRUST’s certification experts in order to consider and understand your options. You can also learn more about HITRUST’s certifications on our website.

How do I choose an assessor?

External Assessors are organizations that have been approved by HITRUST for performing assessment and services associated with the HITRUST Assurance Program and the HITRUST CSF, a comprehensive security framework that incorporates the existing security requirements of organizations. They are critical to HITRUST’s commitment to providing trained resources to organizations of varying size and complexity to assess compliance with security control requirements and document corrective action plans that align with the HITRUST CSF.

HITRUST External Assessor Organizations have been thoroughly vetted and have demonstrated the ability to perform HITRUST Assessments. Visit HITRUST’s External Assessor search page to learn more.