Guest blog by Shreesh Bhattarai, Director of HITRUST at A-LIGN
In today’s world, where data security, risk management, and regulatory compliance are paramount, Welvie and Kinetik have demonstrated how adopting HITRUST certification can serve as a strategic enabler for business growth while establishing a strong culture of managing threats and efficiently addressing applicable regulations. These organizations have successfully streamlined their compliance processes, improved operational efficiency, and unlocked substantial market opportunities by leveraging the HITRUST framework and collaborating with a trusted external assessor, A-LIGN.
Addressing modern risk management and compliance challenges
Both Welvie and Kinetik operate in industries where robust risk management is critical for compliance, operational integrity, and market credibility. The HITRUST CSF was the ideal choice to help them navigate evolving threats, artificial intelligence, and changing regulations, due to its comprehensive and integrated framework specifically tailored to address diverse industry requirements and emerging risks. Welvie, a leading healthcare decision-support company, faced fragmented risk management processes that were resource-intensive and lacked cohesion.
“Before HITRUST, our approach to risk management was disjointed, leading to duplicated efforts and inconsistent mitigation strategies,” said Rudi Perkins, CTO at Welvie.
Kinetik, a technology innovator in healthcare solutions, encountered similar challenges. Without a unified risk management framework, it struggled to anticipate and address the security expectations of its clients.
“We realized that without a comprehensive risk management framework like HITRUST, we couldn’t effectively identify, mitigate, or communicate risks, making it difficult to compete for major contracts,” shared Michelle Moreno, VP of Security, Compliance & Project Management at Kinetik.
How Welvie and Kinetik mastered HITRUST with A-LIGN’s expertise
The HITRUST certification process required careful planning, collaboration, and execution. Both organizations partnered with A-LIGN, leveraging its expertise to navigate the complexities of the HITRUST framework.
Preparation and gap analysis
HITRUST readiness assessments conducted by A-LIGN identified critical areas for improvement. This initial step provided a clear roadmap for aligning with HITRUST requirements as it emulated the desired validation assessment. The assessments revealed gaps in current practices, providing both Welvie and Kinetik with actionable insights into their compliance and information protection posture. A-LIGN’s deep expertise ensured that these gaps were not only identified but also addressed with a practical and strategic remediation plan tailored to the unique needs of each organization.
Policy overhaul
Pivotal to an optimized information security program, Welvie centralized its compliance documentation. This step eliminated redundancies that had previously hindered efficiency and created inconsistencies across departments. By consolidating and streamlining its policies, Welvie not only ensured regulatory compliance but also built a solid foundation for its broader risk management strategy. This centralization became a critical element in responding quickly to audits and client requests.
Process realignment
Similarly, Kinetik overhauled its evidence-gathering processes, which had previously been siloed and inefficient. By leveraging the HITRUST CSF’s comprehensive mapping to multiple regulatory frameworks, the organization created a unified and systematic approach that allowed evidence collected for one framework to be seamlessly applied across others. This significantly reduced redundant audits, saving substantial time, money, and effort. Additionally, it lowered the administrative burden on compliance teams, enabling them to concentrate on strategic priorities while maintaining a high standard of accuracy.
Leveraging HITRUST mappings
HITRUST’s integration with over 60 frameworks, including AICPA’s Trust Principles, ISO, HIPAA, and NIST, provided Welvie and Kinetik with a comprehensive foundation for compliance. By mapping controls across these frameworks, both organizations were quickly able to assess other compliance needs with minimal duplication of effort. This approach highlighted the value of HITRUST’s structured framework in harmonizing diverse regulatory requirements and reducing the complexity associated with managing multiple compliance obligations simultaneously.
Collaboration with A-LIGN: A key to success
A-LIGN’s impact on achieving the “Measured and Managed” criteria stands as a testament to its expertise and commitment to excellence. This advanced compliance requirement is among HITRUST’s most demanding, requiring not just adherence to standards but clear, demonstrable evidence of continuous monitoring and ongoing improvement in security activities. Recognizing the complexity of this requirement, A-LIGN took a proactive approach by tailoring specific strategies and providing hands-on support to ensure both organizations exceeded expectations in this critical area.
For Welvie, A-LIGN introduced performance tracking mechanisms and customized dashboards that quantified compliance improvements over time. "A-LIGN's guidance enabled us to go beyond baseline compliance and establish ourselves as a leader in governance and oversight," noted Angela Merek, Vice President of Account Services at Welvie.
Kinetik, on the other hand, leveraged A-LIGN’s expertise to integrate automation and real-time monitoring processes into its compliance programs. These enhancements helped meet HITRUST’s criteria and elevated its internal risk management framework. "A-LIGN turned what initially seemed like a daunting requirement into an opportunity to strengthen our security posture and deliver greater value to our clients," added Michelle Moreno, VP of Security, Compliance & Project Management at Kinetik.
The collaborative efforts of A-LIGN with both organizations resulted in exceptional outcomes, with high scores during audits and the establishment of “Measured and Managed” practices as foundational elements of their compliance strategies.
Achieving results: Efficiency, growth, and market leadership
The benefits of HITRUST certification extended far beyond compliance. Both organizations experienced transformative outcomes that positioned them as leaders in their respective markets.
Operational efficiency
- Welvie streamlined its compliance workflows, saving time and resources while improving team productivity.
- Kinetik reduced the timelines for completing SOC 1 and SOC 2 audits, leveraging the evidence prepared for HITRUST to meet multiple requirements simultaneously.
Market credibility and business growth
- For Welvie, HITRUST certification became a key differentiator, enhancing trust among healthcare clients who increasingly view HITRUST as a gold standard.
- Kinetik secured a multi-million dollar health plan contract directly attributable to its HITRUST certification. “It’s more than a certificate; it’s a market enabler,” emphasized Michelle.
Resource savings
- HITRUST’s consolidated framework allowed both organizations to maximize the reuse of evidence across certifications, significantly reducing compliance costs.
Conclusion: A framework for success
For Welvie and Kinetik, HITRUST certification was more than a risk and compliance milestone; it was a transformative journey that improved their operational efficiency, enhanced client trust, and unlocked substantial business opportunities. By adopting HITRUST’s comprehensive framework and collaborating with A-LIGN, these organizations have set a strong foundation for sustained success in a highly regulated environment.
The recently released HITRUST Trust Report further underscores the efficacy of the HITRUST framework. The Report, offering detailed insights and performance metrics, highlighted a 0.59% breach rate among HITRUST-certified environments in 2024 — a testament to the program’s effectiveness in mitigating information risk. It also revealed that 100% of threat indicators in the MITRE ATT&CK framework are addressed by the HITRUST CSF, underscoring its comprehensive nature.
"We have spent 17+ years building a reliable and relevant model and ecosystem that delivers powerful results through measurement and accountability to fuel continuous improvement and risk reduction," stated Daniel Nutkis, Founder and CEO at HITRUST.
Organizations with HITRUST certifications, like Welvie and Kinetik, benefit from a proven system that combines relevance and reliability. By regularly updating control specifications based on emerging threats and ensuring rigorous third-party validation, HITRUST enables organizations to address evolving risks confidently. As highlighted in the Trust Report, organizations undergoing subsequent HITRUST assessments experience, on average, a 54% reduction in required Corrective Action Plans (CAPs) compared to their initial certification.
