HIPAA vs HITRUST
How HITRUST certification relates to HIPAA, what the e1, i1 and r2 assessments are, and when a health tech vendor needs HITRUST rather than only HIPAA basics or SOC 2.
On this page
HIPAA vs HITRUST at a glance
HIPAA is the federal law; HITRUST is a private organization whose CSF framework and assessments (e1, i1 and r2) let companies show independently validated security controls. HITRUST maps its controls to the HIPAA Security Rule, and a HITRUST certification is strong evidence for customers, but it is not a HIPAA certification and does not cover every HIPAA duty, such as BAAs or breach notification. Healthcare customers — especially large health systems and payers — often ask vendors for it.
| HIPAA | Federal law; mandatory for covered entities and business associates |
|---|---|
| HITRUST | Private framework (CSF) and certification program; voluntary |
| Assessments | e1 (foundational, 1 year) · i1 (1 year) · r2 (risk-based, 2 years) |
| HIPAA mapping | HITRUST states the i1 maps to nearly all of the Security Rule |
| Does not replace | BAAs, breach notification, Privacy Rule compliance |
What each one is
HIPAA is law. If you are a covered entity or business associate, its Privacy, Security and Breach Notification Rules apply whether or not anyone audits you. HHS does not operate or recognize an official HIPAA certification program; private “certifications” are not government confirmation of compliance.
HITRUST is a private organization. Its CSF is a control framework that brings together requirements from HIPAA, NIST, ISO and others; its assessments are performed by approved external assessors and reviewed by HITRUST, which then issues a certification.
The three assessments
| e1 | i1 | r2 | |
|---|---|---|---|
| Positioned for | Foundational cybersecurity, lower-risk organizations | Leading security practices | Highest assurance, risk-based tailoring |
| Controls | Fixed set (HITRUST lists 43 core controls) | Fixed, curated set (HITRUST lists 182) | Tailored to your risk factors |
| Certification valid | 1 year | 1 year | 2 years |
HITRUST says the i1 includes requirements that map to nearly all of the HIPAA Security Rule, and that work done for one assessment can be reused toward the next.
What HITRUST doesn’t cover for you
Like SOC 2, a HITRUST certification is evidence of security controls. You still need signed BAAs, a working breach notification process, Privacy Rule compliance for how you use PHI, and your own documented risk analysis.
When a vendor needs it
HITRUST costs more and takes longer than HIPAA basics or SOC 2, so most early-stage vendors pursue it only when customers require it — typically large health systems and health plans. Since 2021, HHS must also consider recognized security practices in place for the prior 12 months when assessing penalties (Public Law 116-321); a mature, framework-based program helps there.
Next steps
- HIPAA for SaaS companies that are business associates →Scenario
- HIPAA for health app startups →Scenario
- HIPAA compliance software →Tool
- Business associate →Requirement
- Security risk analysis →Requirement
- HIPAA policies and procedures →Requirement
Frequently asked questions
Is HITRUST required for HIPAA?
No. HIPAA doesn't require any certification. HITRUST is a way to prove security controls to customers, many of whom ask for it.
HITRUST or SOC 2?
Depends on your customers. Large health systems and payers often ask for HITRUST; tech buyers usually accept SOC 2. Ask your top prospects before choosing.
Which HITRUST assessment should a startup start with?
HITRUST positions the e1 for lower-risk organizations and the i1 and r2 for higher assurance; work done for one can count toward the next. Choose based on what your customers require.