Menu
HITRUST
Bottom line
HITRUST is a certification issued by the HITRUST Alliance, not the external assessor firm. Three tiers (e1, i1, r2) cover progressively rigorous assessments. All-in costs run $20K–$300K+ over 3–24 months, including MyCSF platform fees, HITRUST QA, and external assessor work.
One of 10 compliance framework explainers we maintain.
Key facts
- Controls
- e1: 44 controls. i1: 182 controls. r2: tailored from a 156-control baseline, typically 270–2,000+ depending on scope.
- Recertification cycle
- e1 and i1: 1 year. r2: 2-year certification.
- Ongoing oversight
- r2 requires an interim assessment in year 1 between certification audits
- Public registry
- HITRUST External Assessor directory ↗
- Common gap categories
- Access control (01.0); Risk management (03.0); Incident management (11.0); Privacy practices (13.0); Endpoint protection (08.0)
- Related standards
- HIPAANIST SP 800-53ISO 27001PCI DSSGDPR
What is HITRUST?
The HITRUST Common Security Framework (HITRUST Alliance, current version v11.x, 2024) is a prescriptive, certifiable security framework that maps controls from HIPAA, NIST, ISO 27001, PCI DSS, GDPR, and others into a single unified model. It is primarily used in US healthcare and its supply chain.
Is HITRUST a certification or an attestation?
HITRUST issues a certification. A validated assessment report goes to HITRUST, which conducts quality assurance and issues the official certificate. The certification comes from HITRUST Alliance, not the external assessor firm.
Who needs HITRUST?
Required or strongly preferred by US health systems, payers, and pharma companies when onboarding technology vendors. Increasingly demanded in enterprise SaaS sales cycles as a proxy for HIPAA plus broader security assurance.
What does HITRUST cost and how long does it take?
Range
$20K–$300K+ / 3–24 months
e1: $20K–$70K over 3–4 months. i1: $60K–$200K over 6–12 months. r2: $150K–$300K+ over 9–24 months. All-in figures including MyCSF platform, HITRUST QA, and external assessor fees.
One thing to watch
r2 costs can exceed $300K for large or high-risk-profile organizations (some sources cite $1M+). The $150K–$300K band reflects mid-market reality.
Sources
Last verified 2026-05-13. Found a stale or wrong source? Email hello@soc2auditors.org.