HITRUST is the gold standard for healthcare security certification. It's also one of the most confusing frameworks to navigate, because there are three different certification levels and most companies don't know which one they need or what the differences actually mean.
Here's the plain English breakdown.
Why HITRUST exists
HIPAA tells you what to do but doesn't prescribe exactly how. SOC 2 is broad and not healthcare-specific. HITRUST was built to solve both problems: a certifiable framework that maps to HIPAA, SOC 2, ISO 27001, NIST, and other standards, specifically designed for organizations that handle healthcare data.
Large health systems (Kaiser, UnitedHealth, Anthem, Humana) and major payers increasingly require or strongly prefer HITRUST certification from their vendors. If you sell into enterprise healthcare, HITRUST will come up. The question is which level.
The three tiers
HITRUST e1 (Essentials, 1-year). The entry point. 44 control requirements covering the most fundamental security practices, designed for smaller organizations or those just starting their security journey. Assessment type: self-assessment with a HITRUST-approved external assessor validating a subset of controls. Cost: typically $15,000 to $30,000 including assessor fees. Timeline: 2 to 4 months from readiness to certification. Appropriate when a customer requires “HITRUST certification” without specifying the level, and your organization is small (under 50 employees) with a straightforward environment.
HITRUST i1 (Implemented, 1-year). The middle tier. 182 control requirements covering a broader set of security, privacy, and risk management practices — controls that are not just defined but implemented and operating. Assessment type: validated assessment with real testing, not just document review. Cost: typically $30,000 to $60,000 including assessor fees. Timeline: 4 to 6 months from readiness to certification. This is the sweet spot for most health tech companies selling into mid-market health systems and payers.
HITRUST r2 (Risk-based, 2-year). The full certification. 350+ control requirements tailored to your specific risk profile, with extensive external assessor testing including evaluation of control maturity (policy, process, implemented, measured, managed). Cost: typically $50,000 to $150,000+ including assessor fees, depending on scope. Timeline: 6 to 12 months from readiness to certification. Required when selling into large health systems, pharma companies, and major payers that specify “HITRUST r2” in their vendor requirements. The 2-year certification period (with an interim assessment at the 1-year mark) means less frequent full assessments than the annual e1 and i1.
Which one do you need?
Start with what your customers are asking for.
If nobody has specified a level and you're early in your healthcare sales motion, start with e1. It gets you certified, builds the muscle, and gives you something to show procurement teams. You can upgrade to i1 or r2 later.
If a specific customer requires i1 or r2, that determines your path. Ask them directly: "What level of HITRUST certification do you require?" Don't assume r2 when i1 would satisfy the requirement. The cost difference is significant.
If you already have SOC 2 and you're adding HITRUST, the overlap is substantial. Many of your SOC 2 controls map directly to HITRUST requirements. Your GRC platform (Drata, Vanta) likely supports HITRUST and can show you the gap between what you have and what you need. The incremental effort is real but it's not starting from zero.
The path from SOC 2 to HITRUST
Most of our health tech clients follow this progression:
Year 1. SOC 2 Type II. Build the security program, get the first report, start closing enterprise deals.
Year 2. SOC 2 Type II renewal plus HITRUST e1 or i1. Layer HITRUST on top of the existing program. The SOC 2 foundation covers 60 to 70% of HITRUST requirements.
Year 3+. SOC 2 Type II renewal plus HITRUST r2. Upgrade to r2 when customer requirements or deal size justifies the investment.
This approach spreads the cost and effort over time and avoids the shock of going from zero to HITRUST r2 in one year.
Common mistakes
Starting with r2 when i1 would suffice. Ask the customer what they need. Don't over-invest.
Underestimating the timeline. HITRUST assessments take longer than SOC 2. The HITRUST organization itself adds processing time for quality assurance review after the assessor submits the results. Build in buffer.
Choosing the wrong assessor. HITRUST requires an authorized external assessor. Not all assessors have the same depth of experience. Ask how many HITRUST assessments they've completed, specifically at your target certification level.
Not leveraging existing work. If you have SOC 2, ISO 27001, or a mature HIPAA program, the crosswalk to HITRUST is well-documented. Don't rebuild controls that already exist. Map them.
What we do
We manage HITRUST readiness and certification at all three tiers: e1, i1, and r2. We assess your current program, identify the gaps against your target certification level, build the remediation roadmap, prepare the evidence, and coordinate with your assessor through the full certification process.
For companies with existing SOC 2 programs, we map the crosswalk and focus remediation only on the delta. For companies starting from scratch, we build the security program and the HITRUST readiness simultaneously so you're not paying twice.
Farbod Fakhrai is the founder of Com-Sec, a cybersecurity and compliance consulting firm supporting startups and growth-stage companies, with deep expertise in healthcare and health tech.