Essentials · 1-year
A foundational set of cybersecurity requirements (44 under CSF v11).
Usually fitsLower-risk vendors, or a first step.
Healthcare assurance
HITRUST, scoped to what you actually need.
Pick the right assessment, scope it tightly and reach validation with evidence that clears HITRUST quality assurance the first time.
- HITRUST CSF v11.x
- e1 · i1 · r2
- AI security add-ons
- Who it is for
- Health-technology, healthcare SaaS and revenue-cycle providers
- Typical trigger
- A health system or payer makes HITRUST a contract condition
- Our role
- Scoping, readiness, remediation and the run to validation
- Outcome
- HITRUST certification, issued after quality assurance
The business challenge
One framework. Three very different levels of effort.
Choose an r2 because it sounds complete and you can spend a year on evidence nobody asked for. Choose an e1 and you may find your customer wanted an r2 all along.
We start from the requirement in your buyer’s contract. Then we scope in MyCSF, claim every piece of cloud inheritance available and remediate to the standard HITRUST quality assurance expects.
Client outcomes
What prepared organizations gain
01
The right assessment type
A documented choice, grounded in what your customers require.
02
A defensible scope
Systems, data flows and r2 risk factors applied correctly.
03
Inheritance used in full
Less evidence to produce wherever your providers already cover it.
04
Evidence that clears QA
Prepared to the standard your assessor and HITRUST expect.
Interactive guide
e1, i1 or r2?
Four questions. This is the first conversation we have with every HITRUST client, condensed.
A starting point. The customer that asked for HITRUST has the final word on the tier.
How HITRUST works
Three tiers, one rigorous process
Based on HITRUST CSF v11. We confirm the current version when we scope your assessment.
Implemented · 1-year
A broader, fixed set of leading-practice requirements.
Usually fitsModerate-risk technology vendors.
Risk-based · 2-year
Tailored by risk factors and scored for maturity, with an interim assessment.
Usually fitsHigh data volumes, or when customers specify it.
- MyCSF
- Scoping choices in HITRUST’s platform determine the requirements you must meet.
- Quality assurance
- HITRUST reviews the assessor’s work before it certifies. Weak evidence adds weeks.
- ai1 · ai2
- AI Security Assessment add-ons for organizations deploying AI systems.
Our methodology
Readiness that anticipates quality assurance
- Discover
Requirement & scope
Confirm what your customers require and settle the tier.
- Assess
Readiness
Requirement-level gaps and expected scores.
- Remediate
Close gaps
Policies, procedures, controls and inheritance.
- Validate
Assessor-ready
Evidence organized in MyCSF and tested in a pre-assessment.
- Sustain
Interim & renewal
Evidence kept current through the certification period.
Deliverables
What you receive
Assessment-type recommendation
Why e1, i1 or r2 fits, and what the alternative would cost.
Readiness gap report
Requirement-level findings with expected scores.
Inheritance map
What your providers cover, and what stays with you.
Assessor handover pack
Evidence indexed to requirements and ready for fieldwork.
Accreditation & scope
From first scoping call to certificate
What MarkTillson delivers
- Readiness assessment and gap analysis
- Scoping and MyCSF preparation
- Remediation and documentation
- Pre-assessment against HITRUST QA expectations
- Management of the validated assessment through to submission
How certification is issued
- Validated e1, i1 or r2 assessment by an Authorized External Assessor
- HITRUST quality assurance review and certification decision
Framework mapping
Alongside the frameworks you hold
HITRUST harmonizes dozens of authoritative sources, so much of your existing evidence works twice.
| Control area | HITRUST CSF | HIPAA Security Rule | SOC 2 | ISO/IEC 27001 | NIST CSF 2.0 |
|---|---|---|---|---|---|
| Risk analysis & management | Directly addressed | Directly addressed | Directly addressed | Directly addressed | Directly addressed |
| Access control & authentication | Directly addressed | Directly addressed | Directly addressed | Directly addressed | Directly addressed |
| Encryption of health data | Directly addressed | Partially addressed | Partially addressed | Partially addressed | Partially addressed |
| Third-party assurance | Directly addressed | Partially addressed | Directly addressed | Directly addressed | Directly addressed |
| Maturity scoring | Directly addressed | Not addressed– | Not addressed– | Partially addressed | Partially addressed |
| AI system security | Partially addressed | Not addressed– | Not addressed– | Not addressed– | Partially addressed |
Directly addressed Partially addressed or different evidence expectations , Not a primary objective. AI coverage applies when the AI Security Assessment is included. HIPAA compliance is ultimately a legal determination.
Industry considerations
Where HITRUST is asked for
Scope centers on the production platform that holds PHI. Strong cloud inheritance can cut the effort considerably.
High data volumes push r2 risk factors upward, and clearinghouse connections widen the scope.
Re-identification risk and data-use agreements decide which systems fall in scope.
Add the AI Security Assessment, and pair it with ISO/IEC 42001 when buyers want broader AI governance.
Common findings
What derails readiness
Risk factors misapplied
Understated volumes change r2 requirements late in the day.
Policies without procedures
Intent with no documented “how” drags scores down.
Unclaimed inheritance
Requirements tested by hand that your providers already cover.
Untracked AI usage
AI features handling health data with no inventory or review.
Engagement journey
Requirement to certification
-
01
Confirm
Requirement, tier and scope agreed.
OutputRecommendation memo
-
02
Readiness
Requirement-level gap assessment.
OutputGap report
-
03
Remediate
Documentation, controls and inheritance.
OutputRemediated controls
-
04
Validate
External Assessor fieldwork and submission.
OutputValidated assessment
-
05
Certify
HITRUST quality assurance and decision.
OutputHITRUST certification
FAQ
Questions buyers and vendors ask
How does certification work?
An Authorized External Assessor validates your e1, i1 or r2 assessment and submits it to HITRUST, which runs quality assurance and issues the certification. We take you from scoping to that decision and manage the validated assessment along the way.
Does HITRUST mean we are HIPAA compliant?
It is strong evidence of your safeguards. HIPAA compliance also covers privacy and breach notification, and it is ultimately a legal determination.
We have SOC 2. Do we still need HITRUST?
If a customer requires it, yes. Much of your SOC 2 evidence is reusable, and we plan both together so the work is done once.
Should we start with e1 and move up?
Yes, when your customers accept an e1. If they specify an r2, starting lower rarely shortens the path.
How long is certification valid?
Under current rules, e1 and i1 run for one year. An r2 runs for two years with an interim assessment.
Related
Continue exploring
Speak with an expert
Which HITRUST path do your customers need?
Send us the clause from the contract or questionnaire. A senior practitioner will tell you exactly what it requires and how fast you can get there.