HITRUST
HITRUST certification, made manageable
Healthcare customers increasingly require HITRUST. We guide you to the right assessment level and get you through validation with confidence.
At a glance
TypeCertification: e1, i1 or r2
Issued byHITRUST, via an authorized external assessor
Best forCompanies handling health data
Typical readinessVaries by assessment level
Overview
What it is
HITRUST is a certifiable framework that harmonizes requirements from HIPAA, NIST, ISO and other sources into one set of controls, the HITRUST CSF.
Assessments come in three levels: e1 (essential, foundational cybersecurity), i1 (implemented, leading practices) and r2 (risk-based, the most comprehensive). Assessments are performed in the MyCSF platform with an authorized external assessor and reviewed by HITRUST before certification.
You need this if…
- A health system or payer requires HITRUST certification
- You handle protected health information (PHI) and need to prove it
- You want a single assessment that maps to HIPAA, NIST and more
- You are unsure whether e1, i1 or r2 is right for you
The Lightwork Method
How we get you there
01
Level selection
Pick e1, i1 or r2 based on customer requirements and risk.
02
Readiness assessment
Score your current state against the applicable requirements.
03
Remediation
Close gaps in policy, process and implementation.
04
Evidence preparation
Organize evidence the way assessors and HITRUST expect it.
05
Validated assessment support
Coordinate with your external assessor through fieldwork and QA.
06
Maintain certification
Interim reviews and support to keep certification current.
Deliverables
What you walk away with
- Assessment-level recommendation
- Readiness scorecard and gap report
- Remediation roadmap with owners and dates
- Policy and procedure set aligned to the CSF
- Evidence packages organized for the assessor
- Corrective action plan (CAP) support
Timeline & pricing
Pricing depends on your scope and starting point. Contact us for a fixed-price proposal.
An e1 readiness effort can take a few months; an r2 typically takes longer, depending on scope and maturity.
We will give you a realistic timeline after scoping.
Can you certify us?
No. HITRUST certification requires an authorized external assessor and HITRUST quality review. We prepare you and support the process.
Is HITRUST the same as HIPAA compliance?
No. HIPAA is a law with no official certification. HITRUST is a certifiable framework that includes HIPAA requirements, which is why customers use it as proof.
Which level should we start with?
It depends on what your customers ask for. Many start with e1 or i1 and move to r2 when larger customers require it.
Bring your next audit into the light.
Book a free 30-minute consultation. We will map where you are, what your customers need and the fastest path to get there.