HITRUST: Is It Worth The Hype?

HITRUST compliance and HIPAA (and SOC 2 and ISO 27001)

One of the most commonly asked questions I’ve encountered when discussing HITRUST is: What is the difference between HITRUST and HIPAA?

As mentioned above, HIPAA is a federal law created by lawmakers (and thus, non-optional), whereas HITRUST is a framework designed by security professionals. There are many similarities and overlapping controls between HITRUST and HIPAA, especially around the controls of sensitive information.

Both frameworks outline requirements for this sensitive information, but HITRUST can show proof of this through certification. Those who seek out HIPAA compliance may consider pursuing an auditable framework, such as SOC 2 or ISO 27001, to demonstrate compliance instead.

However, HITRUST’s overlapping similarities are not just limited to HIPAA. There are significant similarities to other common frameworks, such as SOC 2 and ISO 27001.

HITRUSTsSimilarities to SOC 2

1. Protection of sensitive information. SOC2 and HITRUST aim to protect sensitive information. They both include controls representing various mechanisms of protection, including things like encryption and restricted access.
2. Technical and operational coverage. Both frameworks share a commonality: they include technical and operational controls. Auditors may test similarly, but the spirit of the controls is similar.

HITRUST similarities to  ISO 27001

1. Risk-based approach. ISO 27001 emphasizes thinking about risk in a broader context, like HITRUST does. This includes considering risk when evaluating every aspect of the organization, from personnel to technical operations.
2. Certification Process. Like HITRUST, ISO 27001 is a certification that lasts a set period of time. A company implements its controls and has them independently assessed for completeness and accuracy. Discrepancies will be noted. For ISO 27001, discrepancies are called non-conformities, and for HITRUST, they are called a corrective action plan. There is an opportunity for remediation to wholly meet the spirit of the control.

In obtaining HITRUST certification, one can rest assured that they are keeping up with their ongoing SOC2 and ISO 27001 compliance (if applicable.) However, it is worth mentioning some key differences between them as well, including.

1. The scope of the assessments/certifications. The scope of the assessments, meaning what will be evaluated for compliance, differs between the frameworks. HITRUST includes a more comprehensive scope because it encompasses components of many different frameworks.
2. The audit process itself. The audit processes differ greatly between the three auditable certifications — SOC 2, ISO 27001, and HITRUST. For HITRUST, a third-party assessor certified by HITRUST will perform a comprehensive review of the organization’s processes and controls. Once complete, HITRUST will issue a report detailing the findings and issue a certification.

Is HITRUST worth the hype?

It’s a loaded question and depends on your company’s goals and needs. Consider the following when deciding whether to invest time, resources, and money.

1. Investor/Customer Requirement. Some investors or customers looking to do business with a company will have HITRUST certification as a hard requirement. This is because many view this as the “gold standard” and a wholly encompassing certification that covers all the bases (including SOC 2, ISO 27001, and PCI controls.)
2. Processing, storing, or touching PHI. HITRUST is the ultimate commitment to protecting sensitive data, including PHI. Companies with access to PHI are at a higher risk of data breaches, so implementing the controls necessary to protect this information significantly reduces the risk.
3. Report. Unlike HIPAA, HITRUST allows customers who are required to adhere to regulations to have a report representing their compliance. Being able to demonstrate your commitment to the protection of sensitive information builds trust with prospective customers and partners.

However, many believe HITRUST is an unnecessary – and very expensive – certification. It may also be relevant to note that it’s a highly rigorous and time-intensive certification, so it’s important to be prepared with the time and human resources to dedicate to it. Additionally, given its newer profound presence in the space, there is also a lack of recognition from many. Thus, it appears to be most advantageous to those in the digital healthcare space or those who need to sell directly into the healthcare industry.

Pursuing third-party certifications is a choice made at the individual company level. Companies may consider their industry, what their prospects are looking for, and general market requirement trends when deciding whether to pursue HITRUST compliance or not.

Compliance as a trust mechanism

At the end of the day, obtaining a compliance certification will improve an organization. It builds trust with prospects and partners, protects data and company IP, and ultimately shows that you take security and privacy seriously. Each framework shows a commitment to the integrity and protection of sensitive information.

Ready to get HITRUST compliant?

If you want to comply with a framework like HITRUST, SOC 2, or ISO 27001, consider the experts at Thoropass to guide you through the process from beginning to end. With our thorough risk assessment, fast certifications, and automated workflow audits, Thoropass makes staying within compliance as straightforward as possible. Speak to a member of our team today to learn more.

Plus, if you use Amazon Cloud Services, like many of our customers, you can easily renew your Thoropass subscription within the AWS Marketplace and earn 5% back. Speak to a member of our team today to see if your organization is eligible!

FAQs about HITRUST Compliance

What are the different types of HITRUST assessments available?

Organizations can choose between three primary assessment types based on their risk profile and compliance needs: the e1, i1, and r2 assessments. The e1 Essentials Assessment focuses on foundational cybersecurity hygiene for lower-risk organizations, while the i1 Validated Assessment covers leading security practices with a moderate level of assurance. The r2 Validated Assessment is the most comprehensive option, offering a high level of assurance suitable for organizations with significant risk exposure or those requiring detailed regulatory mapping.

How long does the HITRUST certification process typically take?

The timeline for achieving certification varies significantly based on an organization's size, complexity, and current security posture, but the entire process generally spans three to four months. This duration includes the time required for a readiness assessment, remediation of any identified gaps, the validated assessment by a third-party assessor, and the final quality assurance review by the HITRUST Alliance. Companies with mature security controls may move faster, while those needing extensive remediation will require a longer lead time before effectively undergoing the audit.

Does obtaining HITRUST certification guarantee HIPAA compliance?

While HITRUST certification is widely considered the gold standard for demonstrating data security in healthcare, it does not legally guarantee HIPAA compliance. HIPAA is a federal regulation enforced by the Office for Civil Rights (OCR) rather than a certifiable standard. 

However, the HITRUST Common Security Framework (CSF) maps directly to HIPAA requirements, meaning that a certified organization has provided third-party validated evidence that they have implemented the necessary controls to meet regulatory standards. This makes the framework one of the most effective ways to prove a good-faith effort toward HIPAA adherence to partners and auditors.

Why might a healthcare company choose HITRUST over SOC 2?

Although both frameworks assess security controls, HITRUST is specifically designed to address the complex regulatory requirements of the healthcare industry, whereas SOC 2 is a more general trust services framework. Healthcare payers and providers often mandate HITRUST because it includes prescriptive controls that map directly to regulations like HIPAA, offering a higher degree of assurance regarding the protection of Protected Health Information (PHI). Consequently, digital health companies often find that HITRUST streamlines the vendor approval process more effectively than SOC 2 alone when selling to major healthcare enterprises.

‍