HITRUST Certification Explained: e1, i1, and r2, Cost, Timeline, and How to Prepare
A plain guide to HITRUST certification for healthtech, SaaS, and service providers handling health data: what each assessment covers, who can certify you, what drives the cost, and how long it takes. We also help you decide whether your customer really needs HITRUST, or whether ISO 27001, SOC 2, or HIPAA evidence will meet the requirement.
What Is HITRUST Certification?
HITRUST certification is a validated assessment of an organization's security controls against the HITRUST CSF. An authorized External Assessor tests the controls, and HITRUST quality-reviews the work before it issues the certification. US hospitals, health plans, and life sciences companies often ask their vendors for it as proof that health data is protected.
The HITRUST CSF brings requirements from HIPAA, NIST, ISO 27001, PCI DSS, and many other sources into one control framework. That is why one HITRUST certification can answer a lot of customer security questionnaires at once, and why work done for those frameworks is rarely wasted when HITRUST comes later.
Accredify Global does not perform HITRUST assessments or HITRUST readiness work. We certify ISO 27001 under UAF accreditation and deliver SOC 2, HIPAA, and NIST CSF work, which is often what a customer will accept instead of HITRUST, or what you build on first.
Who Can Certify You, and Who Can Help You Prepare
HITRUST issues every certification. It quality-reviews each validated assessment in its MyCSF platform before a certificate is granted.
Only HITRUST-authorized External Assessors can perform validated assessments. HITRUST also licenses Readiness Licensees. HITRUST states that only External Assessors and Readiness Licensees are authorized to do HITRUST readiness work for clients. You can also run a self-assessment in MyCSF yourself, which is useful as a trial run but does not lead to certification on its own.
Check before you sign. HITRUST publishes a directory of authorized firms. Ask any provider whether they are listed, and in which role. Independence rules also stop an assessor's team from writing your policies or running your controls for an assessment it validates.
Sources: HITRUST assessor and licensee programs · HITRUST directory of authorized firms · HITRUST independence requirements · HITRUST CSF v11.7 advisory
HITRUST e1 vs i1 vs r2: Which Assessment Do You Need?
The right assessment depends on the data you handle, your risk profile, and the exact words in your customer's contract.
| Assessment | Scope of requirements | Validity | Usually suits |
|---|---|---|---|
| e1 (essentials) | A foundational cybersecurity baseline: 43 requirement statements in CSF v11.7 | 1 year | Startups and lower-risk vendors |
| i1 (implemented) | A leading-practice baseline of 182 requirement statements | 1 year | Established vendors with maturing programs |
| r2 (risk-based) | Requirements tailored to your risk factors and regulations, with maturity scoring | 2 years, with an interim assessment | Large or high-risk environments, and contracts that name r2 |
Requirement counts change as HITRUST updates the CSF, and each assessment uses the CSF version current when it is created.
Do You Need HITRUST, or Will ISO 27001 or SOC 2 Do?
HITRUST is a big commitment. Read the customer's exact wording first; it often allows an alternative.
| What the customer says | What it usually means | Practical next step |
|---|---|---|
| "HITRUST r2 certification required" | Only an r2 meets the clause | Contact a HITRUST-authorized External Assessor |
| "HITRUST or equivalent" | ISO 27001 or SOC 2 is often accepted | Ask the customer which equivalents they accept |
| "Independent evidence of security controls" | Any recognized independent report or certificate | ISO 27001 or SOC 2 |
| "HIPAA compliance" | A risk analysis and safeguards, with no official certificate | A HIPAA risk analysis and evidence |
| International health customers | ISO certificates are better known outside the US | ISO 27001, with ISO 27701 for privacy |
Send us the clause or questionnaire. In a free scoping review we'll tell you plainly whether HITRUST is the only answer.
Book a free scoping reviewWho Needs HITRUST Certification?
HITRUST is not only for hospitals. It is most often requested from the vendors that hospitals, health plans, and life sciences companies rely on.
Platforms that store or process patient data and face health system vendor reviews.
Claims, billing, revenue cycle, and care management vendors with contracts that name HITRUST.
An e1 gives early-stage teams a validated starting point for enterprise deals.
Hosting and IT providers serving healthcare, often sharing controls with customers.
Organizations handling clinical and research data that need more than a HIPAA self-assessment.
HITRUST's AI Security Assessment covers deployed AI. See our AI governance work.
The Path to HITRUST Certification, Step by Step
Six steps most organizations follow, and who does each one.
Security Work That Also Counts When HITRUST Comes Later
The HITRUST CSF draws on the same sources as the frameworks below, so strong controls and evidence built for them are rarely wasted.
What Accredify Global delivers
- ISO 27001 certification under UAF accreditation
- SOC 2 reports with a licensed CPA partner firm
- HIPAA risk analysis and safeguards review
- NIST CSF 2.0 assessments
- Penetration testing and vulnerability scanning
What we don't do
- HITRUST validated assessments or certification
- HITRUST readiness assessments or CSF control mapping for clients
- Submitting anything to HITRUST on your behalf
Those need a firm HITRUST has authorized. You can find one in HITRUST's own directory.
HITRUST Requirements: The Areas Every Assessment Touches
HITRUST requirements span the whole security program. These areas come up in almost every assessment.
Governance, risk management, policies, and roles that run security.
Provisioning, least privilege, multi-factor authentication, and access reviews.
Hardening, malware protection, segmentation, and secure baselines.
Scanning, timely patching, penetration testing, and controlled changes.
Logging, incident response, backups, and tested recovery.
Vendor risk, business associate agreements, and privacy practices.
Assessors look for more than written policies. Expect to show procedures, proof that controls are implemented across the systems in scope, samples showing they operated over time, and risk assessment records. For r2, they also look for evidence that controls are measured and managed.
HITRUST Certification Cost and Timeline
There is no single price for HITRUST certification. The total depends mostly on the assessment you choose and how large and mature your environment is.
Where the cost comes from
- MyCSF access — paid to HITRUST
- Validated assessment — paid to your External Assessor
- Readiness help — optional, from a HITRUST-licensed firm
- Remediation — tools, staff time, and fixes
- Scope — systems, locations, and controls you can inherit from cloud providers
How long it takes
| Readiness and remediation | Weeks to months, depending on maturity |
|---|---|
| Controls operating before testing | Commonly at least 90 days for i1 and r2 |
| Assessment and HITRUST review | Set with your External Assessor |
| Certification validity | 1 year (e1, i1); 2 years (r2) |
HITRUST vs SOC 2, ISO 27001, NIST CSF, and HIPAA
How HITRUST compares with the frameworks healthcare buyers ask about alongside it.
| Framework | What you get | How it relates to HITRUST |
|---|---|---|
| SOC 2 | A CPA firm's attestation report | Common with tech buyers; HITRUST is more prescriptive and more common with health systems |
| ISO 27001 | An accredited international certificate | Strong control overlap; ISO 27001 suits international buyers, HITRUST suits US healthcare |
| NIST CSF 2.0 | A voluntary framework with no certificate | The HITRUST CSF maps to NIST |
| HIPAA | A US law, with no official certification | HITRUST is a common way to show validated HIPAA-related safeguards |
For a deeper comparison of the two most common alternatives, read ISO 27001 vs SOC 2.
How to Choose a HITRUST Provider: Five Checks
Questions worth asking any firm that offers HITRUST work, and what a good answer looks like.
| Question to ask | What a good answer looks like |
|---|---|
| Are you in HITRUST's directory, and in which role? | External Assessor for validated assessments; Readiness Licensee or External Assessor for readiness |
| Will the same team help us remediate and then assess us? | No. Independence rules need a separate team, and assessors can't write your policies |
| Which assessment do you recommend, and why? | A reason tied to your customer's contract, not to the biggest engagement |
| Can we reuse ISO 27001 or SOC 2 work? | Yes, with a clear view of what still needs adding |
| Will you guarantee certification? | No. HITRUST makes the decision after its quality review |
Frequently Asked Questions About HITRUST Certification
Straight answers on e1, i1, and r2, cost, timeline, and who can certify you.
What is HITRUST certification?
HITRUST certification is a validated assessment of an organization's security controls against the HITRUST CSF. An authorized External Assessor tests the controls, and HITRUST quality-reviews the assessment before it issues certification. US healthcare organizations commonly ask vendors for it as proof that health data is protected.
Who issues HITRUST certification?
HITRUST issues the certification. An authorized External Assessor tests your controls and submits the assessment through HITRUST's MyCSF platform, and HITRUST quality-reviews it before certifying.
Who can do HITRUST readiness work?
HITRUST states that only firms it licenses as External Assessors or Readiness Licensees are authorized to do HITRUST readiness work for clients. Organizations can also complete a self-assessment in MyCSF themselves, which does not lead to certification on its own. HITRUST publishes a directory of authorized firms.
Does Accredify Global perform HITRUST assessments?
No. Accredify Global is not a HITRUST External Assessor or Readiness Licensee, so we do not perform HITRUST readiness or validated assessments. We certify ISO 27001 under UAF accreditation and deliver SOC 2, HIPAA, NIST CSF, and penetration testing work, which customers often accept instead of HITRUST or which you can build on first.
What is the difference between HITRUST e1, i1, and r2?
The e1 covers a foundational cybersecurity baseline of 43 requirement statements in CSF v11.7 and is valid for one year. The i1 covers a leading-practice baseline of 182 requirement statements and is also valid for one year. The r2 is tailored to your risk factors, includes maturity scoring, and is valid for two years with an interim assessment.
Which HITRUST assessment do we need?
It depends on your customers' contracts, the data you handle, and your risk profile. Startups and lower-risk vendors often begin with e1, maturing vendors choose i1, and large or high-risk environments, or contracts that name it, need r2.
Do we need HITRUST, or will ISO 27001 or SOC 2 be accepted?
Read the exact contract wording. If it names a HITRUST assessment, only that assessment meets it. If it says HITRUST or equivalent, or asks for independent evidence of security controls, many health customers accept ISO 27001 certification or a SOC 2 report. Ask the customer which equivalents they accept before committing.
How much does HITRUST certification cost?
There is no single price. Costs include MyCSF access, the External Assessor's fees, any readiness help from a HITRUST-licensed firm, and your own remediation effort. The assessment type, the systems in scope, and controls you can inherit from cloud providers drive the total.
How long does HITRUST certification take?
It depends on your starting point. For i1 and r2, controls commonly need to operate for at least 90 days before testing, then External Assessor fieldwork and HITRUST's quality review follow, on a schedule set with your assessor.
How long is HITRUST certification valid?
e1 and i1 certifications are valid for one year. An r2 certification is valid for two years, with an interim assessment required partway through.
What is the difference between HITRUST and HIPAA?
HIPAA is a US law with no official certification. HITRUST is a certifiable framework that includes HIPAA-related requirements, so a HITRUST certification gives validated evidence of the safeguards HIPAA expects.
What is the difference between HITRUST and SOC 2?
SOC 2 is an attestation report issued by a CPA firm against the AICPA Trust Services Criteria. HITRUST is a certification against the more prescriptive HITRUST CSF. Tech buyers often ask for SOC 2, while US health systems often ask for HITRUST.
Is ISO 27001 work useful if we need HITRUST later?
Yes. The HITRUST CSF draws on ISO 27001, NIST, HIPAA, and other sources, so an ISO 27001 management system, its risk assessment, and its evidence give you a strong base. A HITRUST-licensed firm can then show what still needs adding.
Is HITRUST only for hospitals?
No. It is often requested from healthtech and SaaS companies, payer and provider vendors, managed service providers, and other organizations handling health data.
What happens if we don't pass a HITRUST assessment?
If requirements do not meet HITRUST's scoring thresholds, certification is not issued and corrective action plans may be needed. Readiness work and a self-assessment before testing reduce that risk. No provider can honestly guarantee the outcome.
Not Sure HITRUST Is What Your Customer Really Needs?
Send us the contract clause or security questionnaire. We'll tell you whether HITRUST is the only answer, or whether ISO 27001, SOC 2, or HIPAA evidence will meet it, and send a tailored proposal for the work we deliver.
Book your free scoping review →Last reviewed by the Accredify Global compliance team. HITRUST, HITRUST CSF, and MyCSF are trademarks of HITRUST. Accredify Global is not a HITRUST External Assessor or Readiness Licensee and is not affiliated with or endorsed by HITRUST.