HITRUST CSF e1, i1 and r2
HITRUST CSF: the three assessments and how certification works
Health plans and health systems often ask their suppliers for HITRUST certification. This page explains the three assessment types, what the assessor tests and how HITRUST issues the certificate.
In short
The HITRUST Common Security Framework (CSF) brings requirements from ISO 27001, NIST, HIPAA, PCI DSS and many other standards into one control set. You choose the assessment type (e1, i1 or r2) according to the level of assurance your customers ask for. An authorised external assessor tests your controls, and HITRUST reviews that work and issues the certification.
What HITRUST CSF is
HITRUST CSF is both a control framework and a certification programme. The framework maps requirements from over 40 standards and regulations (ISO 27001, NIST 800-53, HIPAA, PCI DSS, GDPR, SOC 2, and others) into a single set of control objectives. The certification programme gives you a validated, third-party assessment against those objectives.
SOC 2 lets you set much of the scope yourself. HITRUST decides which controls apply from your organisation's risk factors, such as size, the types of data you hold and the regulations you fall under. That leaves you less room to choose, but you know earlier what the assessor will test.
e1, i1 and r2: which assessment you need
HITRUST offers three assessment types, each giving a different level of assurance. Which one fits depends on what your customers ask for and on your risk profile.
| Assessment | Controls | Assurance level | Typical use |
|---|---|---|---|
| e1 (Essentials) | ~44 requirement statements | Basic | Lower-risk vendors, initial baseline |
| i1 (Implemented) | ~182 requirement statements | Moderate | Mid-risk vendors, healthcare subcontractors |
| r2 (Risk-based) | Up to 2,000+ requirement statements | High | Enterprise healthcare, financial services, government |
How HITRUST certification works
An authorised external assessor carries out the assessment, but HITRUST makes the certification decision. The assessor tests your controls, scores each requirement and submits the results to HITRUST for quality review. HITRUST checks the scoring, may ask for more evidence, and then issues the certification.
Because HITRUST reviews the assessor's work before anything is issued, the assessor cannot pass you on their own. Buyers in healthcare give weight to that second review.
Who needs HITRUST, and when
HITRUST is most often required in healthcare, where large health plans and health systems use it to assess their suppliers. Some buyers in financial services and government also ask for it, because one assessment covers requirements from several standards.
In practice, you start when a customer or partner asks for it. If a request for proposal, a supplier security assessment or a business associate agreement names HITRUST, that is your starting point.
- Healthcare technology vendors selling to health plans or health systems
- Business associates handling protected health information (PHI)
- Financial services vendors where customers accept HITRUST as assurance
- Companies that want one assessment to answer several regulatory requirements
HITRUST alongside SOC 2, ISO 27001 and HIPAA
HITRUST's control framework incorporates requirements from SOC 2, ISO 27001, HIPAA, PCI DSS, NIST and others. If you already hold SOC 2 or ISO 27001 evidence, much of it will map to HITRUST CSF control objectives.
HITRUST does not replace a SOC 2 report or an ISO 27001 certificate for customers who require those by name. It can reduce the number of separate assessments you go through where customers accept HITRUST instead.
The path to certification
Readiness follows the same steps for every assessment type. Only the number of requirements changes.
-
01
Scope and assessment type
Confirm which assessment (e1, i1 or r2) your customers require. Define the systems and data types in scope.
Your compliance lead, with implementation support on request
-
02
Readiness
Map your existing controls to HITRUST CSF requirements, close the gaps and collect evidence.
Your team, with evidence kept in Certifyi
-
03
Validated assessment
An authorised external assessor tests and scores each requirement.
External assessor
-
04
HITRUST review
HITRUST reviews the assessor's work, may ask for more evidence, and issues the certification.
HITRUST Alliance
Who does what
Software, implementation support and the independent assessor are different jobs. This is how they divide.
| Task | Your team | Certifyi | Authorised external assessor + HITRUST Alliance |
|---|---|---|---|
| Scope and assessment type | Decide, from customer requirements | Not involved | Confirms assessment type |
| Controls | Implement and operate them | Holds controls, policies and evidence | Not involved until the assessment |
| Evidence | Upload it or request it | Keeps it on the control it supports, with every action logged | Validates and scores it |
| Review | Not involved | Not involved | HITRUST reviews scoring and issues certification |
| The certificate | Not involved | Not involved | HITRUST issues the letter of certification |
How Certifyi helps
Keep HITRUST evidence with your other frameworks
Only HITRUST issues the certificate. Certifyi is where you get ready for the assessor: the controls, the evidence behind them and the policies they will read, kept with the SOC 2 or ISO 27001 work you already have.
-
Tamper-evident activity log
Evidence sits on the control it supports, and every change to it is recorded in the tamper-evident activity log, so when HITRUST's review asks for more you can see what was added and when.
-
Requests for missing evidence
Ask colleagues or suppliers for what is missing through a request tied to the control.
-
Policies with review cycles
Write, review and track acknowledgement of the policies your assessor will read.
Questions
HITRUST, answered
Is HITRUST only for healthcare?
No. HITRUST started in healthcare, and some buyers in financial services and government now ask for it too. It suits any organisation that wants one assessment to cover requirements from several standards.
How long is a HITRUST certificate valid?
It depends on the assessment. An r2 certificate is valid for two years, with an interim assessment at the one-year mark to confirm that controls still operate; if the interim is not completed, the certification lapses. e1 and i1 certificates are valid for one year.
Does HITRUST replace SOC 2?
Not for customers who require a SOC 2 report by name. Many healthcare customers do accept HITRUST in place of SOC 2. Ask each customer which they will take.
What is MyCSF?
MyCSF is HITRUST's own web platform for assessments. You scope the assessment in MyCSF, score each requirement and attach evidence, and your external assessor tests it and submits it there for HITRUST's quality review. HITRUST then issues the report and certification.
What is the difference between e1, i1 and r2?
e1 tests essentials (about 44 requirement statements, basic assurance). i1 tests implementation (about 182 statements, moderate assurance). r2 is the full risk-based assessment (up to 2,000+ statements, high assurance). The right choice depends on what your customers require.
Can we reuse ISO 27001 or SOC 2 evidence?
Yes. HITRUST CSF incorporates ISO 27001 and SOC 2 requirements, so controls and evidence you already have for those programmes will cover a good part of the HITRUST control objectives. The assessor still tests them against HITRUST's own requirement statements.
How long does HITRUST certification take?
It depends on the assessment type and your starting point. After the validated assessment is submitted, HITRUST's own review typically takes 4 to 8 weeks. How long the rest takes depends on your readiness, which is worth looking at together before you commit to a date.
Scope your HITRUST assessment in a 30-minute call.
Bring your customer requirements and the assessment type they expect. We can check whether e1, i1 or r2 is the right fit, and walk through what the assessor would see in Certifyi.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them