Menu
Key facts
- Controls
- e1: 44 controls. i1: 182 controls. r2: tailored from a 156-control baseline, typically 270–2,000+ depending on scope.
- Recertification cycle
- e1 and i1: 1 year. r2: 2-year certification.
- Ongoing oversight
- r2 requires an interim assessment in year 1 between certification audits
- Public registry
- HITRUST External Assessor directory ↗
- Common gap categories
- Access control (01.0); Risk management (03.0); Incident management (11.0); Privacy practices (13.0); Endpoint protection (08.0)
- Related standards
What is HITRUST?
The HITRUST Common Security Framework (HITRUST Alliance, current version v11.x, 2024) is a prescriptive, certifiable security framework that maps controls from HIPAA, NIST, ISO 27001, PCI DSS, GDPR, and others into a single unified model. It is primarily used in US healthcare and its supply chain.
Is HITRUST a certification or an attestation?
HITRUST issues a certification. A validated assessment report goes to HITRUST, which conducts quality assurance and issues the official certificate. The certification comes from HITRUST Alliance, not the external assessor firm.
Who needs HITRUST?
Required or strongly preferred by US health systems, payers, and pharma companies when onboarding technology vendors. Increasingly demanded in enterprise SaaS sales cycles as a proxy for HIPAA plus broader security assurance.
What does HITRUST cost and how long does it take?
e1: $20K–$70K over 3–4 months. i1: $60K–$200K over 6–12 months. r2: $150K–$300K+ over 9–24 months. All-in figures including MyCSF platform, HITRUST QA, and external assessor fees.
r2 costs can exceed $300K for large or high-risk-profile organizations (some sources cite $1M+). The $150K–$300K band reflects mid-market reality.