HITRUST certification and cyber insurance

HITRUST's December 2024 announcement of the shared risk facility with Lloyd's of London said insurers would access detailed r2 certification data through an API in the Results Distribution System, in place of the questionnaires underwriters have traditionally sent. The intent is that underwriting relies on validated, HITRUST-signed results rather than a self-completed form. Underwriters still need to decide what they require, so the data they receive is a question to put to the facility and to the insurer directly.

• Data source: The results come from a validated r2 assessment that an authorized External Assessor performed and HITRUST quality-checked, not from the applicant's own description of its controls.
• Access path: The announcement describes an API connection in the Results Distribution System, which replaces manual document requests for the insured organization.
• Scope of data: Underwriters should confirm which domain scores, scope statements, exceptions and corrective action details are exposed through the API, and which remain in the PDF report.
• Refresh cycle: Because r2 certifications last two years with an interim assessment, underwriters should ask how the feed reflects a lapse, suspension or revocation during the term.

Confirm with the facility or insurer which fields are shared, what consent the insured signs and how the data is retained and used for pricing.

The Results Distribution System is HITRUST's API-enabled platform for delivering HITRUST-signed assessment results to relying parties. It replaces the PDF and email exchanges that many organizations have used to send their certification to customers, auditors and insurers. For the certified organization, the practical question is who receives results, which fields they see and how changes to the certification are propagated.

• Signed results: Relying parties receive HITRUST-signed results, so the copy they hold can be checked against HITRUST's record rather than an unverified file.
• GRC and vendor risk integration: The platform integrates with governance, risk and compliance tools and vendor risk platforms such as ServiceNow, so results can flow into existing third-party risk workflows.
• Fewer manual exchanges: Sharing through the platform reduces repeated uploads of the same report to each customer, insurer or assessor.
• Sharing control: The organization should decide which relying parties are granted access and confirm how access is granted, reviewed and withdrawn.
• Status changes: If the certification is suspended or revoked, the status shown to relying parties should be checked against the organization's own communications plan.

Before enabling any insurer access, confirm the exact data fields, sharing permissions and revocation process with HITRUST and with the insurer, and record the answers in the vendor risk file.

Neither the December 2024 announcement nor the Results Distribution System page lists every data field an insurer receives, so the answers have to come from the parties that run the programs. Organizations preparing for insurance applications should treat the data path as a term to negotiate and document, not an assumption. The questions below are a practical starting point for a conversation with the facility, the insurer and HITRUST.

• Fields shared: Ask which domain scores, control details, scope descriptions and dates the insurer receives through the API.
• Permissions: Ask what consent the organization gives, whether it can limit sharing and how it can view the access log.
• Eligibility: Ask which certification levels qualify today, since the announcement started with r2 and planned i1 and e1 later.
• Status events: Ask how a suspension, revocation or lapse is reported to the insurer and how quickly.
• Premium terms: Ask how the starting credit on premiums is calculated and whether it applies at renewal.

Record the written answers and reconcile them with the organization's own certification schedule and customer disclosures.

The organization that holds the certification owns its controls, its scope and its risk decisions. It decides whether to pursue an e1, i1 or r2, which systems fall in scope, and whether to share results with an insurer at all. It also owns the insurance decision itself: whether to apply to the shared risk facility, which carrier and policy to accept, and how to read the premium and coverage terms. Responsibility for accuracy stays here, because the organization answers for every control statement it makes in its assessment.

• Control ownership: Named owners for each control, the operating evidence and the periodic reviews that keep them true.
• Scope and level choice: Deciding which assessment level the insurer or customer will accept and which environments it covers.
• Insurance terms: Reviewing coverage, exclusions and conditions with its broker and counsel before accepting a policy.
• Lapse planning: Keeping a response plan for suspension or revocation, including notice to its broker and carrier.
• Accuracy of representations: Ensuring that anything it tells an insurer about its certification matches the HITRUST-issued documents.

Before signing, ask your broker which certification level the facility currently accepts and what it must provide to keep the terms in force.

An implementation partner such as DeployOpen helps prepare the systems, controls and evidence that an assessment will examine. Its work sits inside the organization's own infrastructure and under its direction. A partner can configure platforms, document procedures, build evidence collection, run readiness reviews and support the upkeep that keeps evidence current between assessments. It cannot score the assessment, sign a report or issue a certificate, and it should not present its own work as independent validation.

• Systems and configuration: Hardening and documenting the platforms that the controls depend on.
• Evidence preparation: Setting up logging, access records, change history and review records that an assessor can sample.
• Readiness support: Gap reviews against the requirement statements before the External Assessor begins fieldwork.
• Ongoing upkeep: Keeping evidence and documentation current when systems change, which matters for certification that must be maintained.
• Clear boundaries: Written scope that states the partner prepares evidence but does not issue reports or certificates.

Before engaging a partner, confirm in writing which deliverables it produces and that it has no role in scoring or issuing any HITRUST result.

Only an Authorized HITRUST External Assessor organization may perform a validated assessment submitted for certification. The assessor tests the controls, scores the results and submits them. HITRUST then performs central quality assurance before it issues the report and certification. These two parties are the only ones whose outputs carry HITRUST's validation, so an insurer or customer relying on a certification depends on their work, not on the organization's or the partner's own summaries.

• Assessor fieldwork: The External Assessor tests evidence within a validated assessment fieldwork window of at most 90 days for e1, i1 and r2.
• Independence rules: Assessor firms must meet HITRUST staffing and independence requirements, so the same firm should not both prepare and certify the environment.
• Quality assurance: HITRUST reviews submitted results centrally before any report is issued.
• Certification issuance: HITRUST issues the certification, which an insurer can verify through the Results Distribution System.
• Validity: e1 and i1 certifications last one year, r2 certifications two years, subject to the r2 interim assessment.

Before relying on a certificate, check that the External Assessor appears in HITRUST's directory and that the certification is current.

The insurer alone sets underwriting decisions, including whether to accept a risk, the premium, the coverage limits and any conditions. HITRUST's announcement of the shared risk facility describes insurers accessing r2 certification data through an API in the Results Distribution System in place of questionnaires, and it mentions a starting credit of 25% on premiums. Neither HITRUST nor DeployOpen decides how any individual insurer prices a risk, and the terms of each policy depend on the underwriter's own review.

• Underwriting authority: Each insurer or underwriter decides whether to bind coverage and on what terms.
• Data access: Insurers may retrieve certification data through the Results Distribution System rather than requesting questionnaires.
• Premium credit: The 25% starting credit mentioned by HITRUST is a figure from its announcement, and the final credit depends on the policy.
• Ongoing conditions: Policies may require notice of changes, suspension or revocation, so review those clauses carefully.
• Eligibility by level: Initial availability was limited to r2 with i1 and e1 planned, so confirm which levels each facility accepts today.

Ask the insurer or broker in writing which certification level, data access method and notice obligations apply to your policy.