# HITRUST CSF: The Healthcare Compliance Framework Built for Certification
The HITRUST Common Security Framework (CSF) is a certifiable security and privacy framework built specifically for healthcare and healthcare-adjacent organizations. Developed by the Health Information Trust Alliance (HITRUST), a private organization founded in 2007, the framework addresses a structural gap that HIPAA alone cannot fill: HIPAA defines security requirements but provides no certification mechanism and no authoritative way for a covered entity to verify that a business associate is actually meeting those requirements.
HITRUST solves this by creating a unified, certifiable framework that incorporates HIPAA, NIST CSF, ISO 27001, PCI DSS, GDPR, HITECH, and applicable state-specific regulations into a single assessment catalog. An organization that earns HITRUST certification has been evaluated by a HITRUST-authorized external assessor against a defined, reproducible set of requirements that satisfies all of those constituent frameworks simultaneously.
The result is a compliance currency that healthcare organizations can exchange. A hospital system requiring that all of its vendors demonstrate security maturity can accept a HITRUST r2 certification letter in lieu of conducting its own audit for each vendor, because the certification was issued by an independent third party against a published standard. This is exactly what HIPAA Business Associate Agreements (BAAs) cannot accomplish on their own.
As of HITRUST CSF version 11.3, the framework contains 49 control categories organized across 14 domains, with requirement counts varying by assessment type, risk factors, and the organization's specific implementation scope. The three assessment types represent different levels of rigor and produce different assurance outputs.
HITRUST structures its assurance program around three assessment types that represent a maturity continuum. Each is distinct in scope, cost, timeline, and the assurance product it produces.
e1 Assessment (Essential, 1-Year Validated Report)
The e1 assessment covers 44 requirements representing foundational cyber hygiene: multi-factor authentication, anti-malware, patch management, data backup, access control basics, encryption at rest and in transit, vulnerability scanning, and incident response planning. These 44 requirements are non-negotiable across all organizations regardless of size, system complexity, or risk factors.
The e1 produces a validated report, not a certification letter. This distinction matters: the e1 demonstrates that an organization has implemented baseline controls and has been assessed against them, but it does not carry the same assurance weight as the i1 or r2 certifications. Think of it as a documented starting point.
Cost range: $15,000 to $30,000, including assessor fees and HITRUST scoring fees. Timeline: 2 to 4 months for a first-time assessment with a reasonably mature security program.
i1 Assessment (Implemented, 1-Year Certification)
The i1 covers 182 requirements, representing an implemented security program. The i1 is designed to assess whether an organization has actually operationalized its security controls, not just documented them. Requirements span all 14 HITRUST control domains, with particular depth in access control, configuration management, audit logging, incident response, and third-party risk.
The i1 produces a one-year certification letter issued directly by HITRUST (not by the assessor alone). This certification letter is increasingly accepted by healthcare covered entities as vendor qualification evidence. Annual reassessment is required to maintain the certification. The i1 is the practical entry point for healthcare vendors seeking to satisfy the majority of enterprise procurement requirements without the full resource commitment of an r2.
Cost range: $30,000 to $75,000. Timeline: 4 to 8 months for a first-time assessment. Organizations with mature documentation and automated evidence collection complete faster.
r2 Assessment (Risk-Based, 2-Year Certification)
The r2 is HITRUST's gold standard. Unlike the e1 and i1, which have fixed requirement sets, the r2 requirement count is tailored to the organization's specific risk profile. HITRUST calculates the applicable requirement set based on organizational factors (number of staff, number of individuals whose data is processed), the information types handled, regulatory factors, and system factors (cloud hosting, physical facilities, third-party services). For most mid-size healthcare vendors, this produces a requirement set of approximately 375 to 450 requirements, though complex organizations with multiple system types and extensive PHI processing can reach 600+ requirements.
The r2 requires a HITRUST-authorized external assessor (a "3PAO" in HITRUST terminology, though HITRUST uses the term "Authorized External Assessor"). The assessor validates evidence, tests controls, and submits a completed Control Reference Framework to HITRUST. HITRUST's Quality Assurance team then reviews the submission independently before issuing the certification letter. This two-layer review (assessor plus HITRUST QA) is what gives the r2 its assurance credibility.
The r2 produces a two-year certification letter, with an interim validation assessment required at the one-year mark. This extended certification window is a meaningful advantage for vendors: the cost of maintaining certification is spread over two years rather than one, reducing the annualized compliance burden.
Cost range: $75,000 to $200,000 for the initial assessment, depending on scope complexity, assessor rates, and the organization's remediation needs discovered during the assessment. Organizations with significant gaps at assessment initiation will incur remediation costs on top of assessor fees. Timeline: 12 to 18 months for a first-time r2. The extended timeline reflects the comprehensive documentation preparation, evidence collection, assessor fieldwork, and HITRUST QA review process.
HITRUST CSF v11.3 organizes its requirements across 14 control domains, each with PDM domain mapping:
Information Protection Program [RGA]: Governance, risk management, security policy, and compliance management. This is the programmatic foundation that governs all other domains.
Endpoint Protection [SPH, VSD]: Malware protection, endpoint detection and response, mobile device management, and removable media controls. Direct overlap with NIST 800-53's SI and MP families.
Portable Media Security [DPS]: Physical and electronic media handling, transport, sanitization, and disposal. Maps to CDA's Sovereign Data Protocol (SDP), which governs where data lives and how it is physically protected.
Mobile Device Security [IAT, SPH]: Mobile device management policies, device authentication, encryption requirements for mobile endpoints, and remote wipe capabilities.
Wireless Security [VSD]: Wireless network segmentation, encryption requirements, rogue wireless detection, and visitor network isolation.
Configuration Management [SPH]: Baseline configuration standards, change management procedures, configuration drift detection, and hardening standards for operating systems and applications.
Vulnerability Management [VSD]: Vulnerability scanning frequency requirements, patching SLAs by severity (critical: 30 days, high: 60 days, medium: 90 days), penetration testing requirements, and remediation tracking. The specific SLAs are testable assertions that map directly to PCA automated validation.
Network Protection [VSD, DPS]: Network segmentation requirements, firewall rule management, intrusion detection and prevention, and DMZ architecture for internet-facing systems processing PHI.
Transmission Protection [DPS]: Encryption in transit requirements, email security, and secure file transfer protocols. The requirement for TLS 1.2 or higher is a direct, testable control.
Password Management [IAT]: Authentication requirements, multi-factor authentication for privileged access, password complexity and rotation policies, and privileged access management. This domain maps directly to CDA's Zero Possession Architecture (ZPA) methodology.
Access Control [IAT]: User access provisioning and deprovisioning, role-based access control, privileged account governance, and access certification reviews. One of the most evidence-intensive domains, particularly the access certification review requirement.
Audit Logging and Monitoring [TID]: Log retention requirements (minimum 90 days hot, one year total), security event monitoring, alert tuning, and log integrity protection. Maps to NIST 800-53 AU family and PCA's continuous evidence collection capability.
Education, Training, and Awareness [SPH]: Annual security awareness training, role-based training for staff with elevated access, and phishing simulation requirements. One of the most commonly deficient areas in vendor assessments.
Third-Party Security [RGA, VSD]: Vendor risk assessment requirements, Business Associate Agreement management, periodic vendor reassessment, and contractual security requirements for subprocessors. The OAF (Orbital Alliance Framework) cross-domain protocol maps directly to this domain.
One of HITRUST's most practically useful features is the inheritance model. If an organization hosts its systems on an infrastructure platform (AWS, Azure, Google Cloud, or a managed hosting provider) that holds its own HITRUST certification, the organization can inherit certain controls from that certification rather than demonstrating them independently.
AWS, Microsoft Azure, and Google Cloud all maintain HITRUST r2 certifications. For a healthcare SaaS company hosting on AWS, the AWS HITRUST certification covers physical security, data center environmental controls, hardware disposal, and certain network infrastructure controls. The SaaS company does not re-test those controls; it inherits them and focuses its assessment on the controls it owns directly.
Inheritance requires formal documentation: the organization must list the inherited controls, identify the inheriting organization and their certification, and confirm that their use of the platform aligns with the scope of the platform's certification. A cloud tenant that stores PHI in regions not covered by the platform's HITRUST scope cannot inherit those controls.
This inheritance model also applies to "shared responsibility" controls, where the organization partially satisfies a requirement and the platform partially satisfies the remainder. HITRUST's scoring system accommodates partial inheritance through documented compensating controls and split-ownership assessments.
HITRUST's framework incorporates explicit mappings to HIPAA, NIST CSF, SOC 2, PCI-DSS, ISO 27001, and GDPR. When an organization completes a HITRUST assessment, the evidence collected and the controls validated map to requirements in all of those constituent frameworks. HITRUST maintains these crosswalks and publishes them as part of the framework documentation.
In practice, this means a healthcare vendor that completes a HITRUST r2 can provide HITRUST-to-HIPAA mapping reports to covered entities reviewing their Business Associate Agreement compliance, provide HITRUST-to-SOC 2 mapping reports to enterprise procurement teams requiring SOC 2 evidence, and use HITRUST evidence to satisfy most NIST CSF implementation tier demonstrations, all from the same assessment exercise.
The incremental effort to add a SOC 2 audit after completing HITRUST r2 is significantly lower than pursuing both independently, because 60 to 70 percent of SOC 2 Common Criteria requirements are already covered by HITRUST controls with existing evidence.
HIPAA has a structural problem: it defines what is required but provides no mechanism for independently verifying that requirements are met. A covered entity can ask a business associate to sign a BAA, but the BAA is a legal instrument, not a security assessment. There is no HIPAA certification, no HIPAA certificate, and no independent body that issues verification that an organization has met HIPAA's Security Rule requirements.
This creates a trust gap in the healthcare supply chain. Hospital systems and health plans interact with hundreds of vendors who touch PHI: EHR integrators, billing systems, analytics platforms, cloud hosting providers, and medical device manufacturers. Auditing each vendor independently is not feasible. Accepting BAAs alone is legally necessary but operationally insufficient.
HITRUST fills this gap with a certifiable, third-party-verified assurance product. An r2 certification letter from HITRUST represents an independent assessment against a published standard conducted by an authorized assessor and reviewed by HITRUST's quality assurance function. It is the closest the healthcare industry has to a universal security certification.
The business case is also material. Enterprise healthcare procurement now routinely requires HITRUST certification (typically i1 minimum, r2 for sensitive integrations) as a condition of vendor onboarding. Organizations without HITRUST certification are excluded from bid lists, delayed in contracting, or forced to undergo individual security assessments by each customer, multiplying the cost and time burden across every sales cycle. An r2 certification, once obtained, functions as a reusable sales asset that eliminates individual customer security reviews for the duration of the certification.
For healthcare organizations managing multiple compliance obligations (HIPAA, state privacy laws, PCI-DSS if they process payments, SOC 2 for enterprise sales), HITRUST's unified framework significantly reduces the aggregate compliance cost relative to managing each framework independently.
HITRUST's 14 control domains map across all six PDM domains, but the primary owners are RGA (governance, third-party risk, compliance program management), DPS (transmission protection, portable media, PHI data lifecycle), IAT (access control, password management, mobile device security), and TID (audit logging, monitoring, incident response).
The VSD domain owns vulnerability management and network protection, which are among the most technically demanding HITRUST domains because of their specific SLA requirements. A finding that critical vulnerabilities have not been remediated within 30 days is not a documentation gap; it is a testable operational failure that CDA's Continuous Surface Reduction (CSR) methodology is designed to prevent.
The SPH domain owns configuration management, endpoint protection, and the awareness training domain. APC (Autonomous Posture Command) addresses the configuration baseline and drift detection requirements that HITRUST's Configuration Management domain requires.
RGA-R01 (Compliance Landscape Mapping, 16 hours): For healthcare organizations, this mission explicitly scopes the HITRUST obligation: which assessment type is appropriate, which PHI processing activities are in scope, which systems require HITRUST coverage, and whether an i1 or r2 is required based on customer requirements and risk profile. Many organizations initiate HITRUST work without this scoping step and discover mid-assessment that they selected the wrong assessment type.
RGA-B02 (Compliance Program Build, 60 hours): HITRUST requires a documented information protection program before the assessment begins. This mission produces the policy framework, risk management process, and third-party risk program that HITRUST's Information Protection Program domain requires. Without this foundation, the technical controls in other domains cannot be properly governed.
RGA-H01 (Multi-Framework Compliance Alignment, 24 hours): Executes the HITRUST crosswalk against the organization's other compliance obligations. For a healthcare SaaS company with HIPAA, SOC 2, and HITRUST obligations, this mission identifies the unified control set and eliminates duplicated evidence collection. The typical outcome is a 40 to 50 percent reduction in the total unique control count.
DPS-C03 (Privacy Program Integration, 20 hours): HITRUST's requirements for PHI handling, data retention, and privacy notice align directly with this mission. Formalizing the privacy program as an operational function (not just a legal policy) is increasingly required by HITRUST assessors at the r2 level.
SPH-H01 (Automated Compliance Monitoring, 24 hours): Deploys the continuous monitoring infrastructure that satisfies HITRUST's Audit Logging and Monitoring domain and enables ongoing evidence collection for access reviews, vulnerability scan results, and configuration baseline checks. This is the operational layer that makes annual reassessment efficient.
RGA-C02 (Compliance Program Sustainment, 12 hours per quarter): HITRUST certification is a point-in-time assessment with an ongoing maintenance obligation. Interim validation (for r2) and annual reassessment (for i1) require continuous evidence. This C-COMMAND mission maintains the operational compliance posture between assessments so that reassessment is a validation exercise, not a remediation sprint.
CDA's PCA methodology is particularly well-matched to HITRUST because HITRUST's "assess once, report many" design principle mirrors PCA's framework crosswalk architecture. PCA builds a unified control library from which all applicable frameworks are satisfied. HITRUST organizations running PCA maintain continuous evidence for all 182 (i1) or 375+ (r2) requirements, with automated collection from cloud infrastructure, identity platforms, endpoint management, and log management systems.
The cost differential is significant. Organizations that approach HITRUST as a point-in-time exercise spend $75,000 to $200,000 on the r2 assessment plus an internal labor cost of 3 to 6 months of security team time for evidence preparation. Organizations running PCA reduce internal labor costs by 40 to 60 percent because evidence exists continuously rather than being assembled under deadline pressure.
For healthcare organizations beginning their HITRUST journey, CDA recommends starting with the e1 to establish baseline hygiene documentation, then advancing to i1 within 12 months as the security program matures. The r2 is appropriate when enterprise customer requirements specifically demand it or when the organization is processing PHI for health plans or large covered entities with formal vendor qualification programs.
HITRUST is healthcare's answer to the certification gap that HIPAA created. It is certifiable, third-party verified, and recognized across the healthcare industry in ways that a signed BAA is not.
The three assessment tiers represent real differences in rigor and business value. e1 is a documented baseline. i1 is a one-year certification suitable for most vendor qualification purposes. r2 is the gold standard for complex healthcare vendors and is increasingly required for EHR integrations, health plan partnerships, and federal healthcare programs.
Cost and timeline planning must be realistic. A first-time r2 takes 12 to 18 months and costs $75,000 to $200,000. Organizations that budget for 6 months and $50,000 will either extend timelines significantly or accept a scope reduction that undermines the certification's business value.
The inheritance model reduces the scope for cloud-hosted organizations. AWS, Azure, and GCP HITRUST certifications cover physical and infrastructure controls. A healthcare SaaS company on AWS should document inherited controls before beginning its own assessment, which typically reduces the applicable requirement count by 15 to 25 percent.
"Assess once, report many" is a real efficiency gain, not a marketing claim. HITRUST-to-HIPAA and HITRUST-to-SOC 2 mappings are published and maintained. Organizations that complete HITRUST r2 can satisfy most enterprise SOC 2 requirements with incremental additional effort, typically an additional 4 to 8 weeks and $20,000 to $40,000 beyond the HITRUST investment.
Continuous compliance maintenance between assessments is the difference between a $100,000 annual compliance program and a $200,000 one. Organizations that let controls drift between assessments spend the equivalent of a second full engagement remediating before reassessment.