What is a HITRUST certification, and who issues it?
A HITRUST certification comes from a validated e1, i1 or r2 assessment, scored by an Authorized HITRUST External Assessor and issued by HITRUST after its central quality assurance. Your organization owns its controls and scores each requirement statement itself. Only the External Assessor tests those scores and submits the assessment, and only HITRUST reviews it and issues the report and letters. If your customer or contract asks for HITRUST, the first decision is which assessment level that customer actually names, because the level determines what gets validated and what gets issued.
An implementation partner such as DeployOpen can help prepare the systems, configurations and evidence that the assessor will sample, but it does not validate, score on the assessor's behalf, or issue anything. Before you sign any engagement, confirm in writing which parts are readiness work and which parts are validated fieldwork. Also confirm that the External Assessor firm appears in HITRUST's directory, since only those firms may perform validated assessments submitted for certification. Readiness Licensees and consultants can support preparation but cannot take part in validation.
The outcome depends on three things: the scope of the assessment, the assessment level, and whether the assessment met HITRUST's certification thresholds. If it meets them, you receive the certification report and two copies of the certification letter, one that includes the assessment scope and one that contains only the letter, so you can share each relying party only what it needs. If it does not meet them, HITRUST issues a validated-only report that says the thresholds were not met and includes no certification letter. Ask your assessor how a result would be presented before fieldwork begins, and read the HITRUST Assessment Handbook for the exact issuance rules.
How a validated assessment becomes a HITRUST certification
The sequence runs from the organization's own scoring of each requirement statement to a HITRUST issuance decision, with each party owning a distinct output. The External Assessor validates and submits, but HITRUST decides whether a certification is issued.
Score each requirement statement in MyCSF
The organization owns this step. Its team works through the requirement statements for the chosen assessment level (e1, i1 or r2) in MyCSF, scoring the maturity of each control and recording the evidence it relies on. Work starts only after the controls have been operating long enough to produce that evidence. The output is a completed self-assessment that the External Assessor can test. You know it is done when every in-scope statement has a score and an evidence trail.
Select an External Assessor and agree fieldwork
The organization engages an Authorized HITRUST External Assessor organization, which is the only type of firm that may perform a validated assessment submitted for certification. The assessor reviews the scope and scoring and plans its testing. The output is a signed engagement and a fieldwork plan. Ask the assessor to confirm its authorization in HITRUST's directory before work begins.
Validate scores through assessor testing
The External Assessor independently tests the organization's scores by examining documents, interviewing staff, observing processes and sampling evidence. The fieldwork window for a validated assessment is at most 90 days. The assessor records a finding for each statement, confirming, adjusting or rejecting the self-assigned score. The output is validated scoring for each requirement statement, and the organization can see where scores changed and why.
Sign the representation letter and corrective action plans
The organization's authorized officer signs a representation letter confirming that the information it provided is accurate and complete. Where validated scores fall short, the organization enters corrective action plans that name the remediation, the owner and the timing it commits to. The output is a signed representation letter and a set of corrective action plans. Without the signed letter, the assessment cannot move to submission.
Submit the validated assessment to HITRUST
The External Assessor submits the completed validated assessment, along with its testing record and the organization's representation letter, to HITRUST. The assessor's role ends with a submission that it is responsible for, and it does not decide whether certification is granted. The output is a submitted assessment waiting for HITRUST quality assurance. You know it is done when HITRUST confirms receipt in MyCSF.
Run HITRUST quality assurance
HITRUST performs central quality assurance on every submitted assessment. It runs more than 250 automated quality checks through its Assurance Intelligence Engine, within a centralized quality assurance process of six layers. HITRUST may return questions to the assessor or the organization before it proceeds. The output is an assessment that has passed HITRUST's quality review, ready for the reporting decision.
Receive the HITRUST report and issuance decision
HITRUST makes the issuance decision. If the assessment meets the certification thresholds, HITRUST issues the certification report and two copies of the certification letter, one with the assessment scope and one with the letter alone. If it does not, HITRUST issues a validated-only report that states the thresholds were not met and includes no certification letter. The output is either a certification or a validated-only result. The assessor reports its findings but does not issue the certification.
What the organization, the implementation partner, the assessor and HITRUST each own
The organization being assessed owns its controls, its scope and its results. It is the party that operates the security program day to day, decides how each requirement statement is met, and scores its own maturity before any outside testing begins. Nothing in a certification shifts that accountability to a consultant, a platform vendor or an assessor.
- Control ownership: The organization decides and operates the controls that satisfy each requirement statement, including those that run in cloud or vendor environments it has scoped in.
- Self-scoring: The organization scores each requirement statement itself before the External Assessor tests it.
- Representation letter: The organization signs the representation letter, which attests that its scores and descriptions are accurate and complete.
- Corrective action plans: Where requirements are not fully met, the organization records corrective action plans with owners and dates.
- Independence boundary: The organization cannot validate its own scores for certification. Its role ends at scoring, evidence and attestation.
Before starting, confirm with your assessor which scope, inheritance and carve-out decisions you will own and document in writing.
An implementation partner helps the organization get ready. It can prepare systems, configure the platforms that produce evidence, collect and organize that evidence, and run readiness reviews that show where gaps remain. This work is valuable, but it is preparation, not assurance.
- System preparation: The partner can deploy, configure and harden the systems in scope, such as logging, access control and backup, inside the client's own environment.
- Evidence collection: The partner can arrange evidence so the organization and the assessor can find, sample and verify it.
- Readiness work: The partner can run gap reviews against the CSF before a validated assessment, so the organization can close issues early.
- No independent scoring: The partner does not score the organization's requirements for issuance and cannot stand in for the assessor's validation.
- No report issuance: The partner does not issue reports, letters or certifications. Only HITRUST issues those.
If a partner offers to produce scores or a certificate, treat that as a warning sign and check the engagement terms with the assessor.
The External Assessor performs the independent validation. It is an organization approved and trained by HITRUST, and it is the only type of entity authorized to perform validated assessments submitted for certification. The assessor tests the organization's scores against evidence within a fieldwork window of at most 90 days for e1, i1 and r2.
- Authorized status: Only organizations listed as Authorized HITRUST External Assessors can perform the validated assessment that leads to certification. Confirm the firm's status in HITRUST's directory before engaging it.
- Independent testing: The assessor tests the scores through its own procedures, sampling and inquiry, rather than accepting the organization's word.
- Submission: The assessor submits the completed assessment to HITRUST for quality assurance.
- Independence boundary: The assessor cannot be the same firm that prepared the organization's controls or evidence in a way that compromises its objectivity. Ask for the firm's independence statement and the staffing rules that apply.
Ask the assessor, in writing, which preparation services it will accept and which would affect its independence.
HITRUST operates the central quality assurance process and is the party that decides whether a validated assessment meets the certification thresholds. Once it is satisfied, HITRUST issues the certification report and letters, or a validated-only report if the thresholds were not met. HITRUST does not perform the testing itself.
- Quality assurance: HITRUST runs automated and manual quality checks on each assessment and report before anything is issued.
- Threshold decision: HITRUST determines whether the scores meet the certification thresholds. Where they do not, it issues a validated-only report with no certification letter.
- Report and letters: A certified entity receives the certification report and two letter copies, one with the assessment scope and one without it, so each relying party sees only what it needs.
- Expiration control: HITRUST sets and enforces expiration dates and does not extend them.
- Independence boundary: HITRUST does not validate the organization's controls for the organization, and it does not sell preparation services for the assessment it certifies.
When reviewing a vendor's certification, check that the letter comes from HITRUST and that the expiration date is still in the future.
What a certified organization receives, and what each document is for
A HITRUST outcome arrives as a set of documents, and each one has a different audience. Reading them correctly determines what you can share with a customer, what you must keep internal, and how a relying party should judge your scope.
The certification report
The certification report is the full record of the validated assessment, including the scores assigned to each requirement statement and the results across the assessment domains. It is the document your assessor, your own compliance team and any detailed reviewer will read. Because it contains control-level detail, treat it as confidential and share it only under a suitable agreement. Confirm the exact contents for your assessment level in the Assessment Handbook before you plan your evidence pack.
Letter with the assessment scope
The first certification letter states what the certification covers: the systems, services, locations and organizational boundaries included in the assessment. This is the document that answers the question every relying party should ask, which is whether the service they buy falls inside the certified scope. A certificate without a clear scope can mislead a customer about what was tested. Check that the scope names the exact product or service your customer uses before you rely on it.
Letter with the certification statement only
The second letter contains only the certification statement, without the scope detail. You can give it to a relying party who needs proof of certification but does not need to know your internal architecture or the boundaries of the assessment. The split lets you disclose the minimum necessary, which matters when a customer asks for proof in a procurement questionnaire. Remember that a letter without scope does not tell the reader what was covered, so pair it with the scope letter when the buyer needs that detail.
Validated-only report
If an assessment does not meet the certification thresholds, HITRUST issues a validated-only report instead. It states that the thresholds were not met and includes no certification letter, so it cannot be presented as a certification. This output still has value internally, because it documents validated results and the gaps that remain. Do not describe a validated-only result to a customer as certified, and expect a customer that asks for a certificate to notice the difference.
Confirming the current document set
The set of documents can differ by assessment level, and HITRUST updates its guidance over time. Before the final report review, confirm with your External Assessor which documents your e1, i1 or r2 will produce and what each contains. Check the current requirements in the Assessment Handbook and the outputs available for your assessment in MyCSF. Record the confirmed document list in your assessment plan so the scope letter and statement letter match what you later share.
What a validated-only result means for a HITRUST buyer
A validated-only result means the assessment was carried out and checked, but the organization did not meet HITRUST's certification thresholds. When that happens, HITRUST issues a validated-only report that states the thresholds were not met and contains no certification letter. For a buyer, the practical rule is simple: a HITRUST certification exists only when a certification letter exists. Do not treat the word "HITRUST" in a vendor's security questionnaire, deck or contract response as proof of certification. Ask for the document itself, check that it is a certification report with its letter, and confirm the report date and expiry.
The Handbook describes the validated-only outcome as a report that records the result, not a pass. Relying parties should read the scope statement, the assessment type (e1, i1 or r2), the report date and the conclusion language before deciding anything. A validated-only report still tells a reader that an External Assessor tested the organization's claims and that HITRUST performed quality assurance on the work. It does not tell the reader that the organization is certified, and it should not be filed or forwarded as if it did.
If a vendor receives a validated-only result, its next steps are to work through the corrective action plans recorded in the assessment, fix the gaps, and plan a new validated assessment. That new assessment is a fresh engagement with its own fieldwork window and quality assurance. Before the assessment starts, ask your assessor which output you will receive if the thresholds are not met, whether the report will show the gaps, and how the result will be shared with your customers. Those answers determine how your customers' third-party risk teams will read the outcome.
How long e1, i1 and r2 certifications stay valid
This table compares the three HITRUST certification levels on how long each certification stays valid from the report date and what the entity must do before it expires. Read each row as a deadline: the renewal work has to be finished, with a signed representation letter, before the expiration date, and HITRUST does not extend that date.
| Assessment level | Validity from report date | What happens at renewal |
|---|---|---|
| e1 certification | 12 months | Recertification fieldwork must finish with a signed representation letter before expiry, or a certification gap begins |
| i1 certification | 12 months | Recertification fieldwork must finish with a signed representation letter before expiry, or a certification gap begins |
| r2 certification | 24 months | An interim assessment is due in the 90 days before the first anniversary of the report date |
| r2 interim assessment | Due in the 90 days before the first anniversary | Keeps the r2 on track for recertification at the two-year mark |
| Expiration date | Fixed from the report date | HITRUST never extends expiration dates, so plan renewal work to finish early |
| Certification gap | Starts if renewal is not complete by expiry | The entity cannot rely on the expired certification and must rebuild status through a new validated assessment |
| Validated-only result | No certification period | No certification letter is issued, so there is no validity period to renew |
How a certification gap happens and why expiry cannot be extended
A certification gap opens when recertification fieldwork is not finished, with a signed representation letter, by the date the current certification expires. Until that point the entity is treated as certified. After it, there is no valid certification for the period between expiry and the eventual new report, and a customer checking status in the period cannot count on the old letter. Under the HITRUST Assessment Handbook, e1 and i1 certifications run for 12 months and r2 certifications for 24 months, both counted from the report date, not from the day the assessor finished testing. Confirm the exact expiry date printed on your current report and letters before planning anything else.
Planning from the report date matters more than planning from the last fieldwork date because the expiry clock does not move with your work. A team that starts recertification when fieldwork was last completed can find that the clock ran out during scheduling, quality assurance or the time needed to finish corrective action plans. Work backward from the expiry date, allow time for the assessor's fieldwork window and for HITRUST's quality review, and treat the representation letter as the event that must land before expiry. If your customers have contracts that name certification status, confirm with your account team how they will be notified if a gap is possible.
HITRUST does not extend expiration dates, so a gap cannot be fixed by asking for more time or by a letter from the assessor. The only protection is a completed recertification before expiry. The renewal guides in this set cover the interim assessment for r2, rapid recertification, bridge certificates and the steps that follow a lapse, and you should read them before the renewal window opens. Ask your External Assessor for a written timeline with the expiry date as the fixed endpoint, and ask HITRUST directly through HITRUST's assessments and certifications page which renewal options apply to your level.
Where buyers and vendors misread a HITRUST certification
Most HITRUST confusion comes from mixing up the result of a validated assessment with the certification itself. The cards below cover the misreadings we see most often, with the correct reading for each. Check the report type, the issuer, the expiry date and the document shared before relying on a HITRUST result.
Validated-only is not certified
A validated-only report means the assessment was completed and checked, but the scores did not meet HITRUST's certification thresholds. HITRUST issues it without a certification letter, and it says so on its face. Treat a validated-only report as evidence of work done, not as a passed result, and ask the vendor for the certification letter if a contract requires certification.
Consultants cannot issue certificates
A consultant, readiness licensee or implementation partner can prepare the environment, evidence and corrective action plans, but cannot issue a HITRUST certification. Only an Authorized HITRUST External Assessor performs the validated assessment, and HITRUST performs quality assurance and issues the report and letters. Check that the certification letter comes from HITRUST, not from the firm that helped prepare the work.
Expired certifications are not current
Certifications last 12 months for e1 and i1 and 24 months for r2, counted from the report date. HITRUST does not extend expiration dates, so an r2 whose recertification fieldwork and signed representation letter were not complete by expiry has a certification gap, even if the vendor says the work is in progress. Check the report date and calculate the expiry yourself before accepting a certification as current.
Scope letter often suffices
A certified entity receives the full report plus two letters: one that includes the assessment scope and one that contains only the certification letter. A relying party that needs only proof of certification should ask for the letter without scope, and a party that needs to confirm which systems were covered should ask for the scope letter. Requesting the full report by default exposes detail the relying party does not need.
Automated checks do not replace testing
HITRUST runs more than 250 automated quality checks on every assessment and report as part of a six-layer quality assurance process. These checks test the consistency and completeness of submissions, but they do not replace the External Assessor's own testing of the controls and evidence. A certification means both the assessor's validation and HITRUST's quality review were completed, so neither step can stand in for the other.
How to confirm an External Assessor is authorized before you engage
Only an Authorized HITRUST External Assessor organization can perform the validated assessment that a HITRUST certification depends on, so the first check before you sign anything is whether the firm holds that status today. HITRUST publishes a directory of External Assessors and Readiness Licensees on its Find an External Assessor or Readiness Licensee page. Search for the firm by name, confirm it appears with External Assessor status rather than Readiness Licensee status, and record the date you checked. Do not rely on a vendor's own statement, a sales deck or a logo on a proposal. Ask for the firm's directory listing to be confirmed in writing as part of the engagement, and recheck the directory before the fieldwork starts, since status can change.
Next, ask who will sign the validation work. The individuals who perform the testing and sign off on the assessment should be named in the proposal, and you should be able to confirm that the named people are part of the authorized External Assessor organization. Ask how the firm separates the people who prepare your evidence from the people who validate it. A firm that writes your policies, configures your controls and then validates those same controls has a conflict that HITRUST's independence rules are designed to prevent, and your customers may ask about it during their own review.
Finally, keep the roles separate in your contracts and project plan. A Readiness Licensee or consultant can help you prepare for the assessment, close gaps and organize evidence, but it does not perform the validated assessment that gets submitted for certification. If one firm is doing both preparation and validation, document who owns each deliverable and confirm that the External Assessor's own testing, not the preparer's work, produces the validated scores. The organization still owns its controls and representations, and only HITRUST issues the certification after its quality assurance review.
Questions buyers ask about HITRUST certification
Who issues a HITRUST certification?
HITRUST issues the certification, but only after an External Assessor has completed a validated assessment. The organization scores each requirement statement itself, and the External Assessor validates those scores through its own testing. The organization then signs the representation letter and enters corrective action plans for any gaps. The assessor submits the package to HITRUST, which performs central quality assurance before it issues the report and certification letters. Only Authorized HITRUST External Assessor organizations may perform validated assessments submitted for certification, so check the firm against HITRUST's directory before signing anything. Readiness Licensees can help you prepare, but they do not produce the validated result. Confirm the assessment level and scope with your assessor before fieldwork begins.
Does DeployOpen issue HITRUST certifications for clients?
No. DeployOpen does not issue HITRUST reports, letters or certifications, and it cannot promise an outcome. Its role is to prepare systems, controls and evidence for the assessment as an implementation partner working inside the client's own infrastructure. In practice, that can include deploying self-hosted open-source platforms, configuring logging and access controls, documenting how those systems operate and organizing evidence so an External Assessor can test it. The organization owns its controls and makes the scoring decisions, while the External Assessor performs the validated testing. Engagements are usually fixed-scope, with scope and deliverables agreed in writing before work starts. Ask any partner to show you, in writing, which steps it performs and which belong to the assessor and HITRUST.
Does a validated-only result count as certified?
No. A validated-only result means the assessment was completed and validated, but the scores did not meet the certification thresholds. In that case HITRUST issues a validated-only report that states the thresholds were not met, and it includes no certification letter. Customers should not treat that outcome as certified, and a vendor that describes it as certified is misstating the result. The report still shows scoring and gaps, which can guide internal work, but the organization cannot claim certification from it. The path forward is to address the gaps through corrective action plans and plan the next assessment with the assessor. Before accepting any claim, ask for the report itself and check whether a certification letter is included.
How long does a HITRUST certification stay valid?
e1 and i1 certifications are valid for 12 months, and r2 certifications are valid for 24 months, both counted from the report date. For r2, an interim assessment is due in the 90 days before the first anniversary. If recertification fieldwork is not finished, with a signed representation letter, by the expiry date, the organization has a certification gap. HITRUST does not extend expiration dates, so the planning window is fixed. A lapse has practical effects: customers, health system third-party risk programs and any insurer checking certification status will see that the certification is no longer current, and contracts that require current certification may be affected. Ask your assessor to set a recertification calendar at the start. Renewal effort depends on the assessment level, the scope and how much the environment has changed.
How much of the HITRUST work must our team do itself?
Most of the work stays with the organization. Your team must define the scope, score every requirement statement, gather evidence, document policies and procedures, and raise questions about N/A decisions and alternate controls with the assessor. It also signs the representation letter and owns corrective action plans. These tasks need people who know the systems in depth, not only the security team. An outside consultant or implementation partner can take a defined part, such as configuring platforms, building evidence collection or running readiness checks, but cannot replace the validated assessment. The costs you pay are External Assessor fees, HITRUST platform and report costs, internal staff time and any readiness or implementation work you buy. Ask for a written split of responsibilities in every quote so you can see which costs recur and which are one-time.
What should a customer request when a vendor claims HITRUST?
Request the current validated report and the certification letter, and check the details they contain. Confirm the assessment level (e1, i1 or r2), the scope, the report date and the expiry date. Check whether the scope covers the specific services you buy, because a certification for one product line does not automatically cover another. Vendors can issue two letter types: one that includes the scope and one that contains only the letter, so a vendor can share just what each relying party needs. Ask whether any cloud or other third-party controls were carved out or inherited, and how the vendor has handled significant changes or security incidents since the report date. Verify the status with the assessor or through HITRUST's directory, and direct these questions to the vendor first.
How DeployOpen prepares your systems and evidence before a HITRUST assessment
DeployOpen works on the systems and evidence behind a HITRUST assessment, not on the certification itself. We prepare self-hosted open-source platforms inside your own infrastructure so your team can answer requirement statements with traceable evidence. An authorized External Assessor validates the results and HITRUST issues any report or letter.
How we scope
- Agree in writing which assessment level, business units, systems and hosting environments the engagement covers before work starts.
- Map which domains your platforms touch, and identify where inherited results from a cloud provider or vendor may apply.
- Confirm with your External Assessor which requirement statements fall in scope and which are out of scope or marked N/A.
How we build
- Deploy and harden self-hosted open-source platforms in your cloud accounts, data centers or air-gapped networks.
- Configure logging, access control, backup and change workflows so each domain produces records an assessor can sample.
- Test the configured controls ourselves, so gaps surface before the External Assessor begins fieldwork.
How we hand over
- Deliver documented procedures, configuration baselines and an evidence index keyed to the requirement statements in scope.
- Train your control owners to produce, store and retrieve evidence in the form the assessor will request.
- Leave the representation letter, scoring and corrective action plans with your organization, since you own the submission.
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after the assessment.
- Plan the evidence refresh needed for an r2 interim assessment or a recertification cycle, with dates confirmed against HITRUST's published rules.
- Revisit configurations when a CSF version update or significant system change affects the controls you rely on.
