HIPAA is not certifiable, which creates a problem: US healthcare organisations need a way to prove their vendors are secure. HITRUST CSF fills that gap - a certifiable framework that harmonises HIPAA with ISO 27001, NIST, PCI DSS and others into one scored control set.
What makes it different
- It is tailored to you. The applicable control set is generated from risk factors - organisation size, systems, data volumes, regulatory exposure. Two organisations get different requirements.
- Scoring is maturity-based, not pass or fail. Each control is scored across maturity levels, so partial credit is real and the target is a score, not a tick.
- It harmonises frameworks, so one assessment answers several obligations at once.
- It is prescriptive where HIPAA is deliberately flexible - which is why healthcare buyers like it.
The maturity dimensions
Each control is evaluated across levels that build on each other:
- Policy - is it documented and approved?
- Procedure - is there a defined process for doing it?
- Implemented - is it actually operating?
- Measured - is effectiveness measured?
- Managed - are measurement results acted upon?
This is where organisations underestimate the effort. Having a control implemented gets you part of the score. Reaching a certifiable total usually requires the measurement and management levels too - and that is a governance discipline, not a technical one.
Assessment options
HITRUST offers a tiered set of assessments, from lighter-weight verified assessments aimed at lower-risk scenarios through to the comprehensive certification used for high-assurance needs. The heavier the assurance, the more controls, the deeper the validation, and the longer the engagement. Confirm the current assessment names and requirements with HITRUST, as the portfolio has evolved.
Reuse your existing controls for HITRUST
GRC Copilot maps HITRUST CSF against your ISO 27001, SOC 2 and HIPAA controls, so you see the genuine delta and the maturity gaps rather than starting from a blank assessment.
Try GRC Copilot free Generate an AI-powered assessment Download checklist Book a demo
Who it is worth it for
- Vendors selling into US health systems. Many require HITRUST from suppliers handling patient data - it is often a procurement gate rather than a preference.
- Health plans and providers wanting demonstrable HIPAA alignment.
- Organisations juggling several frameworks who value harmonisation over running each separately.
It is generally not worth it if no customer asks for it. HITRUST is a significant investment, and ISO 27001 or SOC 2 satisfies most non-healthcare buyers at lower cost.
How it relates to what you may already have
- HIPAA - HITRUST incorporates its requirements and makes them assessable. It is not an official HIPAA certification, because none exists, but it is the closest recognised proxy.
- ISO 27001 - substantial control overlap. An ISMS gives you the policy and procedure maturity levels almost for free.
- SOC 2 - different instrument. Some organisations pursue both; HITRUST plus SOC 2 combined reporting is offered to reduce duplicate testing.
Practical preparation
- Confirm which assessment type your customers actually require before scoping.
- Complete the risk factor questionnaire early - it determines your control count.
- Map your existing controls across; if you hold ISO 27001, much of the policy and procedure maturity is already evidenced.
- Attack the measurement gap. Define metrics and periodic reporting for controls - this is usually the largest shortfall.
- Run a readiness assessment before validated assessment; corrective action plans are expensive under time pressure.
- Budget for the assessor engagement and the interim maintenance requirements.
Frequently asked questions
Is HITRUST the same as HIPAA compliance?
No. HIPAA is law with no certification; HITRUST is a private framework that incorporates HIPAA requirements and is certifiable. Certification demonstrates alignment - it is not a regulatory determination.
How long does certification take?
Typically many months end to end, driven by remediation and the maturity gaps rather than the assessment itself. Organisations with a mature ISMS move faster.
Do we need HITRUST if we have SOC 2?
Only if customers ask. Many US health systems specifically request HITRUST; outside healthcare, SOC 2 usually suffices.
Why is scoring maturity-based?
Because implemented-but-unmeasured controls decay. The model rewards organisations that measure and manage effectiveness, not just those that turned something on.
Key takeaways
- HITRUST is the certifiable proxy for HIPAA that healthcare buyers request.
- Your control set is tailored from risk factors - it varies by organisation.
- Scoring spans policy through measured and managed; measurement is the usual gap.
- Pursue it when customers require it, not speculatively.