What is HITRUST CSF certification, how do its e1, i1 and r2 assessments differ, and how does it relate to HIPAA compliance?

## What HITRUST is The **HITRUST CSF** is a control framework published by the HITRUST organization. HITRUST describes it as a threat-adaptive control library that harmonizes **more than 60 frameworks and standards**, so that one assessment can be mapped to many obligations. Two distinctions matter in an interview: - HITRUST is a **private assurance scheme**, not a law or a regulation. - The **HIPAA Security Rule** (45 CFR part 164, subpart C) defines no certification of its own. Nothing in it makes a HITRUST, ISO or any other certificate equal to compliance. ## The three core assessments Per HITRUST's own public assessments page: | Assessment | Scope | Validity | Aimed at | |---|---|---|---| | **e1** | 43 foundational security controls | 1 year | Startups and organizations with limited risk profiles or less complexity | | **i1** | 182 control requirements, leading security practices | 1 year | Organizations with established security programmes ready to show leading practices | | **r2** | Tailored, risk-based, the highest level of control requirements | 2 years | Organizations that must show compliance with authoritative sources such as HIPAA and the NIST CSF, or need expanded tailoring | HITRUST presents the portfolio as **traversable**: work from an e1 or i1 can be applied toward a more comprehensive i1 or r2. It also allows **inheritance** of controls from certified cloud service providers, which matters for a company whose infrastructure sits in the cloud. Other characteristics HITRUST describes: - Assessments are carried out by authorized **external assessors** and quality-assured centrally by HITRUST before certification. - Controls are scored on a **maturity model** rather than a simple pass or fail. - HITRUST also offers reports that translate assessment results into the language of specific standards, including HIPAA. ## How it relates to HIPAA A HITRUST certification helps with HIPAA in three ways and replaces it in none. 1. **Coverage mapping.** Because the CSF harmonizes HIPAA with other sources, an r2 in particular can be scoped to include the Security Rule's standards, giving an organized control set. 2. **Vendor assurance.** A covered entity choosing a business associate can use a vendor's certificate as evidence of its security practices during due diligence. 3. **Evidence for regulators and customers.** An independently assessed control set is persuasive documentation. What it does **not** do: - It does not satisfy the **required risk analysis** in `164.308(a)(1)`. The entity must still perform its own accurate and thorough assessment of risks to its ePHI. - It does not replace **business associate contracts** under `164.308(b)` and `164.314(a)`. A certified vendor that handles ePHI still needs a written contract. - It does not settle **addressable** decisions under `164.306(d)(3)`; those must still be documented by the entity. - It does not change the **Breach Notification Rule**: a certified organization that suffers a breach of unsecured PHI still notifies under subpart D. ## Reading a vendor's certificate When a covered entity receives a vendor's HITRUST report during business associate due diligence, the useful questions are: - Which assessment was it (e1, i1 or r2), and is it still within its validity period? - Which systems and locations were in scope, and do they include the service being bought? - Which controls were inherited from a cloud provider, and which the vendor operates itself? The answers decide how much weight the certificate carries in the entity's own risk analysis. ## Choosing an assessment For a young health-tech company, HITRUST itself positions the e1 as the entry point and the r2 as the most demanding. The practical question is what the organization's customers ask for, since the tiers differ in depth and in how long a certificate lasts. Because the work is reusable, a staged path from e1 to r2 is common. The HIPAA duties run in parallel whatever tier is chosen. A strong answer defines HITRUST as a certifiable, harmonized framework, gives the three assessments with their control counts and validity periods, and is explicit that HIPAA compliance is a legal obligation that no certificate discharges.