HITRUST CSF Explained: What Healthcare Organisations Need to Know

The HITRUST CSF is a security and privacy control framework, widely used in US healthcare, that combines requirements from HIPAA, NIST, ISO 27001 and other standards into one set of controls that organisations can be independently assessed and certified against. Certification comes in three levels, e1, i1 and r2, which range from a foundational one-year assessment to a detailed, risk-based two-year certification (HITRUST, 2026). For healthcare organisations, it is most often met as a question from a hospital or health plan asking a supplier to prove it protects patient data, as part of wider third-party technology and cloud security checks.

This guide explains what HITRUST is, how the three assessments differ, how it relates to the rules you already know and what it means for everyday staff.

What is HITRUST?

HITRUST is a US organisation founded in 2007 that develops the HITRUST CSF and runs an assurance programme built on it (HITRUST, 2026). The framework is a library of security and privacy controls. Rather than writing new rules from scratch, HITRUST maps and harmonises requirements from more than 60 frameworks and standards, including HIPAA (the Health Insurance Portability and Accountability Act), NIST (National Institute of Standards and Technology) publications, ISO/IEC 27001, PCI DSS (Payment Card Industry Data Security Standard) and GDPR (General Data Protection Regulation) (HITRUST, 2026).

HITRUST describes the CSF as threat-adaptive: it reviews threat intelligence and breach data and updates control requirements as attack techniques change. The idea is that one assessment can answer many overlapping compliance questions at once.

The e1, i1 and r2 assessments

HITRUST offers three validated assessments. Each is tested by a HITRUST-approved external assessor and centrally reviewed by HITRUST before certification is issued (HITRUST, 2026).

Source: HITRUST e1, i1 and r2 assessment pages (HITRUST, 2026). The i1 recertification in year two focuses on a smaller core set of controls rather than the full 182.

Which one is right?

Usually, the customer decides. A large health system may ask a small scheduling app for an e1, while a cloud provider hosting millions of patient records may be asked for an r2. Many organisations start at e1 or i1 and move up as their security programme and customer demands grow.

How HITRUST relates to HIPAA, NIST and ISO 27001

HIPAA

HIPAA is federal law; HITRUST is a voluntary framework. HIPAA does not require HITRUST certification, and HHS (the US Department of Health and Human Services) states that it does not endorse or recognise private organisations' Security Rule certifications, which do not remove an organisation's own legal obligations (HHS, HIPAA FAQ). What HITRUST does is translate the HIPAA Security Rule's broad requirements into specific, testable controls, so an organisation can show how it meets them.

There is also a legal link worth knowing about. A 2021 amendment to the HITECH Act (Public Law 116-321) requires HHS to take into account whether a covered entity or business associate had recognised security practices in place for at least the previous 12 months when deciding fines, audit outcomes and other remedies under the Security Rule (HHS Office for Civil Rights, 2022). The law defines those practices by reference to NIST standards, the section 405(d) healthcare cybersecurity practices and other recognised programmes. It does not name HITRUST, but because the CSF maps to NIST, a mature HITRUST programme can help an organisation evidence that its practices were genuinely in use. Our article on the HITECH Act and HIPAA Security Rule training requirements covers the wider HITECH picture.

NIST

NIST publishes widely used US guidance, including the NIST Cybersecurity Framework and the SP 800-53 control catalogue. The HITRUST CSF incorporates NIST content, and HITRUST positions the r2 for organisations that need to show alignment with sources such as HIPAA and the NIST Cybersecurity Framework.

ISO 27001

ISO/IEC 27001 is the international standard for an information security management system. It is common in Europe and with global suppliers. HITRUST includes ISO 27001 and 27002 among its mapped sources, so organisations that hold both often reuse evidence between the two. For how ISO 27001 treats staff competence and awareness, see our guide to ISO 27001:2022 competence and awareness requirements.

Why vendors are asked for HITRUST

Hospitals and health plans rely on many outside suppliers, from billing and transcription firms to cloud hosting and software providers. Each one that handles patient data is a potential route for a breach, and reviewing every supplier with a bespoke questionnaire is slow for both sides. A HITRUST certification gives the customer an independently tested, standardised report they can compare across suppliers.

HITRUST publishes its own outcome data: its 2026 Trust Report states that 99.62% of HITRUST-certified environments remained breach-free in 2025 (HITRUST Trust Report, 2026). That is HITRUST's own figure about its certified customers, so it is best read as an indication rather than an independent study, but it explains why procurement teams increasingly ask for it.

What HITRUST means for staff training

HITRUST is not just an IT project. Many of its controls depend on how people behave every day, and assessors look for evidence that policies are followed in practice, not just written down. For non-technical staff, that usually shows up as:

• Security awareness training at onboarding and at regular intervals, with completion records kept as evidence.
• Acceptable use and clear-desk expectations, such as locking screens and storing paper records securely.
• Phishing awareness and a clear way to report suspicious emails.
• Incident reporting, so staff know who to tell when something goes wrong.
• Access discipline, including only viewing records you need for your role and reporting leavers or role changes promptly.

During an assessment, you may be asked to confirm you have completed training or to describe how you would report an incident. Honest, consistent answers matter more than perfect wording.

Frequently asked questions

Is HITRUST certification required by law?

No. HITRUST is voluntary. It becomes a requirement when a customer, partner or contract asks for it, which is common in US healthcare supply chains.

Does HITRUST certification mean we are HIPAA compliant?

Not automatically. It provides strong, independently tested evidence of security controls that map to HIPAA, but HIPAA compliance also depends on your privacy practices, policies and day-to-day conduct, and HHS does not endorse or recognise private certifications as proof of Security Rule compliance.

How long does a HITRUST certification last?

The e1 and i1 certifications last one year. The r2 lasts two years, with an interim assessment required after the first year (HITRUST, 2026).

Do organisations outside the US use HITRUST?

It is used most heavily in US healthcare, but suppliers elsewhere that serve US healthcare customers may be asked for it, and its mapping to ISO 27001 and GDPR makes it relevant internationally.

HITRUST gives healthcare organisations and their suppliers a common way to prove they protect patient data, and much of that proof depends on well-trained staff. Learnsignal's healthcare compliance CPD courses can help your team build that everyday awareness. This article is for general information and is not legal advice.