HITRUST Compliance Services

CyberCrest provides HITRUST compliance services as an Authorized External Assessor Organization for HITRUST. We assess your readiness against the HITRUST CSF requirements, guide your remediation, and perform the validated assessment. Our expert guidance covers your ePHI environment at each stage, starting with the readiness assessment.

METHODOLOGY

Our HITRUST Compliance Methodology

In the HITRUST certification process, HITRUST's timing rules set how early testing can begin, so we plan each step around them.

Scope and Readiness Assessment

We hold a kickoff call, walk through your environment, and size the engagement. Your team settles the scope with us and picks HITRUST's e1 (entry-level), i1 (moderate), or r2 (highest assurance) assessment. We score your controls against its requirements and mark the gaps.

Remediation Support

Your team closes the gaps with our guidance and review at each fix. The HITRUST Assessment Handbook lets the assessor test a new or remediated control only after 90 days in operation and a policy after 60 days in force.

Validated Assessment

In MyCSF, HITRUST's assessment platform, your team enters its scores and any corrective action plans. Our assessors test the evidence within the 90-day fieldwork window the Handbook sets, review and validate those plans, and submit the assessment to HITRUST.

HITRUST Certification

HITRUST runs a quality assurance review of the assessment and opens QA tasks for both the External Assessor and your team. We address the tasks that concern our testing and support your team while it addresses its own.

SERVICES

Our HITRUST Certification Consulting Services

We tailor our HITRUST compliance services to your environment and to the HITRUST Alliance's Common Security Framework.

HITRUST Readiness Assessment

Our readiness assessment process evaluates your organization's current controls against HITRUST CSF requirements. We identify gaps, assess compliance maturity on HITRUST's own scoring levels, and recommend a specific fix for each gap ahead of fieldwork for the formal HITRUST assessment.

Security Gap Remediation

For each identified security gap, we set out a customized fix in a remediation roadmap. We prioritize risks, recommend effective controls, and guide the implementation your team carries out. The gap assessment report maps each gap to the HITRUST requirement it belongs to.

Assessment by an Authorized External Assessor

Certified professionals on our team test your controls against the HITRUST CSF requirements that apply to your assessment and scope, and validate the scores your team entered in MyCSF. The HITRUST Assessment Handbook has the External Assessor validate every requirement statement.

HOW WE HELP

How Our HITRUST Compliance Consulting Helps You Meet the Requirements

We review your documents and your controls together, because an r2 scores your written policy and procedure as maturity levels of their own, next to how each control is implemented. The HITRUST Assessment Handbook makes measured and managed optional r2 levels, and an e1 or i1 scores the implemented level only.

Risk Management and Security Controls

Our review starts with how your organization identifies and ranks its risks. Under the HITRUST Assessment Handbook, the HITRUST CSF requires a formal risk management program, including periodic risk assessments and documented security controls. We specify what each control has to achieve to align with HITRUST CSF requirements.

Access Control and Identity Management

We test how user access, multi-factor authentication (MFA), and least privilege are enforced across your organization. For each gap, we recommend how to close it under HITRUST's access control requirements.

Incident Response and Business Continuity

Your team writes and tests the incident response plan and business continuity strategy that HITRUST expects, and our consultants review both against the HITRUST requirement statements for responding to incidents and maintaining business continuity.

Audit Logging and Monitoring

HITRUST's audit logging and monitoring requirements set what your logs must capture. We check your logs and how your team monitors them, and point out what is missing before fieldwork.

DELIVERABLES

What You Receive from a CyberCrest HITRUST Engagement

Each stage of the engagement ends in a document you keep, starting with the gap assessment report.

Gap Assessment Report

The report of your readiness assessment: an executive summary and a prioritized list of the gaps found, each mapped to the HITRUST requirement statement it belongs to, with a risk rating attached. It shows where your controls stand before remediation starts.

Remediation Roadmap

The order of work for closing the gaps: which control each gap calls for, which gap comes first, and who on your team owns each fix. Your team can track progress against it until fieldwork begins.

Validated Assessment Submitted to HITRUST

Your validated assessment, submitted to HITRUST on your behalf, with the corrective action plans your team entered in MyCSF. Our assessors have tested your scores and validated those plans before submission.

The Report HITRUST Issues

HITRUST issues a certification report after its quality assurance review when your scores meet the threshold in the HITRUST Assessment Handbook, and a validated-only report when they do not, plus a NIST CSF certification report where the assessment qualifies.

Achieve HITRUST Compliance with CyberCrest

Speak with one of our HITRUST assessors to talk through your scope and the assessment that fits it.

TALK TO AN EXPERT

WHY US

Why Choose CyberCrest as Your HITRUST Consulting Firm

We bring cybersecurity and regulatory compliance expertise to HITRUST's compliance requirements as an External Assessor on HITRUST's own register.

Authorized HITRUST External Assessor

We are listed on HITRUST's register of External Assessors. External Assessors are the only organizations whose validated assessments HITRUST accepts for certification. Anyone can confirm the listing on HITRUST's Find an External Assessor page.

Readiness and Validation Under HITRUST's Independence Rules

One External Assessor firm may take you from the readiness assessment to the validated assessment. Under the HITRUST Assessment Handbook and External Assessor Requirements, no assessor who implemented or operated your controls in the last 12 months may work on your validated assessment. Your team writes and owns the policies and procedures being assessed, and we review them.

CCSFP and CHQP Credentials

Our consultants hold HITRUST's Certified CSF Practitioner (CCSFP) and Certified HITRUST Quality Professional (CHQP) credentials. The Handbook also requires CCSFPs in the lead roles of every validated assessment and a CHQP for the assessor's own quality review before submission.

Guidance Through Remediation

Your team carries out the remediation, technical and administrative alike. For each fix we specify what it has to achieve against its HITRUST requirement, and we review the result before fieldwork begins.

TESTIMONIALS

Hear from Our Clients

I have worked with CyberCrest on multiple compliance engagements over the past several years including HITRUST, NIS 2 and ISO 27001. Without exception, CyberCrest has consistently exceeded expectations for my clients through a combination of highly experienced consultants, and a practical approach to achieving compliance. They are willing to roll up their sleeves and help organizations fully understand and address their compliance challenges, not just function as external auditors.

Paul Lucidi

—

Founder and President, CyberAge Consulting LLC

“I have used the CyberCrest team for a variety of critical information security compliance engagements over the years including successfully attaining ISO 27001 and HITRUST certifications. All of our engagements have exceeded expectations!”

Craig Guinasso

—

Senior Director, Technology & CyberSecurity, Alector

"We have worked with CyberCrest on multiple penetration testing and cybersecurity risk and maturity assessments. The CyberCrest team has consistently produced high quality deliverables at fair prices. We give their client prospects our strongest recommendation."

David Wise

—

Managing Partner, Aberdeen Advisors

ABOUT HITRUST

About the HITRUST Certification

The certification shows that an organization's security controls meet the Common Security Framework (HITRUST CSF), which HITRUST's r2 page says maps to more than 60 authoritative sources. It rests on a validated assessment by an External Assessor. No HIPAA rule requires it. HHS states in its FAQ on certification that there is "no standard or implementation specification that requires a covered entity to 'certify' compliance" with the HIPAA Security Rule.

With HITRUST certification, you can:

Meet healthcare industry security requirements and win new business
Build trust with customers by demonstrating a commitment to security
Improve your organization’s cybersecurity posture

ASSESSMENT TYPES

HITRUST e1, i1, and r2: Which Assessment Fits Your Organization

HITRUST's three certifiable assessments give entry-level, moderate, and the highest assurance. The HITRUST Assessment Handbook says each builds on the one before it: every e1 requirement is in the i1, and every i1 requirement is in the r2 baseline.

HITRUST e1 (Essentials, 1-year)

Entry-level assurance from 43 foundational cybersecurity controls, valid for one year. HITRUST's e1 page says an e1 can be completed in a matter of weeks. It says the e1 is designed for startups, small businesses, and companies with lower risk profiles.

HITRUST i1 (Implemented, 1-year)

Moderate assurance from a fixed set of 182 curated controls, valid for one year. In year two, an eligible organization can renew through HITRUST's i1 Rapid Assessment, which the i1 page says focuses on about 60 core controls. The same page says most companies complete an i1 within 6 to 12 months.

HITRUST r2 (Risk-based, 2-year)

The highest assurance HITRUST offers, with controls tailored to your risk profile, systems, and regulatory requirements. The Handbook also makes it the only one that can cover security and privacy together. An r2 certification is valid for two years, provided an interim assessment is completed and submitted to HITRUST in the 90 days before the first anniversary.

NIST CSF 2.0 Certification with an r2

Only an r2 can carry a HITRUST-issued certification against the NIST Cybersecurity Framework. Under HAA 2024-009 and the Handbook, the r2 must include the NIST CSF 2.0 factor, and the report follows when the r2 itself is certified and the NIST-mapped requirements average 70 or more on each Core Function and Category.

WHO IT APPLIES TO

Who Needs HITRUST Certification

A customer or business partner may make HITRUST CSF certification a condition of the contract. HITRUST's Getting Started checklist then asks you to choose the assessment type based on your business needs and risk profile.

Healthcare Providers and Payers

For healthcare organizations such as providers and payers, HIPAA compliance is the baseline and HITRUST certification is the next step in showing customers and partners how they protect the health information they hold.

Business Associates and Health Tech Vendors

Business associates, health tech vendors, and other service providers handle sensitive data on behalf of covered entities. Their healthcare customers can ask for HITRUST certification as assurance in their vendor reviews.

Organizations Outside Healthcare

HITRUST certification also serves organizations outside healthcare. Among the organizations that benefit from an r2, HITRUST's r2 page names vendors serving regulated industries such as finance and government, and enterprises that must comply with multiple cybersecurity frameworks.

Frequently asked questions

How much does HITRUST certification cost?

The cost of HITRUST certification depends on the assessment type and the size of the environment in scope. Control maturity and the remediation the readiness assessment uncovers change it too. The MyCSF subscription and report credit, where required, are separate purchases, as HITRUST's Getting Started checklist shows. We size each engagement before you commit, after a kickoff call and a walkthrough of your environment.

Is HITRUST the same as HIPAA?

No. HIPAA is a federal law, and the HITRUST CSF is a certifiable framework that maps HIPAA's requirements among many authoritative sources. In its FAQ on certification, HHS says it does not endorse or otherwise recognize private certifications regarding the HIPAA Security Rule, and they do not absolve covered entities of their legal obligations under it.

Is HITRUST mandatory?

HIPAA does not require HITRUST certification. The HIPAA Security Rule asks covered entities to evaluate their security periodically, and HHS's FAQ on certification states that no standard in it requires them to certify compliance. A customer or business partner can still require it in a contract.

How long does it take to become HITRUST certified?

It depends on the assessment and your readiness. HITRUST's e1 page says an e1 can be completed in a matter of weeks, and its i1 page says most companies complete an i1 within 6 to 12 months. In every validated assessment, HITRUST's Assessment Handbook lets the assessor test a new or remediated control as implemented only after it has run for 90 days.

Is HITRUST based on NIST?

Partly. HITRUST's r2 page says the HITRUST CSF maps to more than 60 authoritative sources, NIST among them, along with HIPAA, ISO, and PCI. Under HAA 2024-009, an r2 assessment can also carry a HITRUST certification against the NIST Cybersecurity Framework itself, so one r2 can answer a NIST CSF request too.

Is HITRUST better than SOC 2?

Neither is better in general; they are different documents. A SOC 2 report is an attestation that a CPA firm issues under the professional standards the AICPA sets for its SOC suite of services. A HITRUST certification follows an External Assessor's validated assessment and HITRUST's review. HITRUST's e1 page also points to guidance on how e1 controls overlap with SOC 2 requirements, for teams moving from SOC 2 to an e1.

How to get HITRUST certified?

HITRUST's Getting Started checklist asks you to name a project owner, choose the assessment type, and select an Authorized External Assessor. Your organization also arranges the MyCSF subscription and report credit it needs and defines the assessment scope with the assessor. Readiness, remediation, and the validated assessment follow.

Compliance and Data Privacy

Technical Services

Company

Contact

HITRUST Compliance Services

Our HITRUST Compliance Methodology