What health systems expect from a SaaS vendor on HITRUST
Health systems increasingly ask SaaS vendors for a HITRUST validated assessment, and the vendor must show the result in a form the health system can rely on. A vendor security reviewer at a hospital usually wants three things: a validated assessment rather than a self-declared questionnaire, a certification the reviewer can check, and a report scoped to the services the health system actually buys. The right HITRUST level depends on the contract, so the first task is to read the security exhibit and the data handling terms to see whether the customer names e1, i1 or r2, or only asks for HITRUST in general.
The division of roles matters in this conversation. The vendor owns its controls and the evidence behind them. An implementation partner such as DeployOpen can prepare the systems, configuration and evidence for a self-hosted platform, but it does not score the assessment or issue anything. Only an authorized External Assessor performs the validated assessment, and HITRUST performs quality assurance and issues the certification. Reviewers will check the assessor against HITRUST's directory, so a vendor should confirm that its assessor is listed before scheduling fieldwork, and should ask the customer whether it expects a specific assessment scope.
Before committing to a level, the vendor should confirm with the customer which deliverable it will accept and how it will receive it. Vendors should check whether the customer's third-party risk program uses the Health3PT approach and its vendor directory, and which results distribution method the customer's GRC or vendor risk platform supports. Any figures in the customer's questionnaire, such as fees, timelines or validity expectations, should be confirmed against HITRUST's current documentation rather than taken from a sales conversation.
How the Health3PT vendor directory and results sharing work
As the vendor, you control what each customer receives. HITRUST issues the certification report and two copies of the certification letter: one letter includes the scope of the assessment, and the other contains only the letter. That split lets you share the scope detail with a relying party that needs it and send the lighter letter to customers that only need confirmation of status. Health3PT, a healthcare third-party risk initiative, approved HITRUST as its first assurance supplier for its Recommended Practices, and it operates a vendor directory that lists vendors with completed and in-progress HITRUST certifications. Listing in that directory is a decision for your organization to make and maintain.
- Pick the letter per recipient: Send the scoped letter only where the customer's risk process needs the scope. Use the unscoped letter for status confirmation.
- Plan directory status: Decide whether your listing should show a completed certification or an in-progress one, and update it when your status changes.
- Track corrective action plans: Health3PT practices include CAP tracking, so keep open items current for customers who review them.
- Keep the report under control: Share the full report only through the channel the customer agreed to, not by ad hoc email.
Before your next renewal, confirm with each health system which letter and which channel its team expects.
Your team needs results you can rely on and a way to receive them that fits your vendor risk workflow. HITRUST's Results Distribution System delivers HITRUST-signed assessment results to relying parties through an API. It also integrates with GRC and vendor risk platforms such as ServiceNow, which means results can flow into the systems where your third-party risk records already live instead of arriving as PDFs attached to emails. Health3PT's practices cover risk tiering, reliable assurances, CAP tracking and assurance updates, so your team can align vendor reviews to a shared framework rather than building a separate questionnaire for each supplier.
- Check the signature: Confirm that the result you receive is HITRUST-signed and that its scope matches the services the vendor provides to you.
- Use the API where available: Ask whether your GRC or vendor risk platform can ingest results through the Results Distribution System.
- Tier vendors consistently: Apply your risk tiers the same way across suppliers, using the same assurance evidence.
- Watch assurance updates: Set a process to receive updated results and open CAPs between formal reviews.
- Record the scope: Note exactly which systems and services the certification covers, so gaps are visible.
Ask each vendor which letter they will provide and whether results will come through the Results Distribution System or another route.
Procurement's job is to make sure the contract names the assurance the health system needs and the delivery channel that makes it verifiable. A vendor may hold a completed certification, an in-progress one or only a directory listing, and these differ in what they prove. A completed certification has a validity period and a scope. An in-progress entry does not give the same assurance. Contract language should state the certification level, the scope, the expected delivery method and the obligation to notify you of changes in status. Health3PT's directory helps you find candidates, but it does not replace reviewing the certification record itself.
- Name the level and scope: Write the required HITRUST assessment and the in-scope services into the contract.
- Define delivery: Specify whether results come through the Results Distribution System, the vendor's secure portal or another agreed channel.
- Require notice of changes: Ask vendors to tell you about lapses, significant changes or a revocation.
- Separate directory from certification: Treat a directory entry as a lead to verify, not as proof.
- Plan for renewal: Put the renewal date and interim expectations into the contract calendar.
Before signing, confirm with the vendor which channel and letter they will use for your account.
Where HITRUST Insights Reports fit for HIPAA questions
Health system questionnaires often ask for HITRUST evidence without naming the deliverable. HITRUST offers ten Insights Reports alongside its validated certifications, and they answer different questions. The cards below explain the HIPAA report, the other reports briefly, and the checks to run with the buyer before you send anything.
The HIPAA Insights Report
HITRUST's HIPAA Insights Report is the one most relevant to health system security questionnaires, because it maps evidence to HIPAA Security Rule questions. Ask the buyer whether they want this report or a validated certification, since the two are not interchangeable. Confirm the current report format and version with HITRUST before you prepare evidence, and check which scope your platform and hosting environment fall into.
Insights Report is not certification
An Insights Report describes how your controls relate to a set of requirements, but it does not carry the validated scoring, QA review and certification letter that an e1, i1 or r2 produces. Only an authorized External Assessor performs validated assessments, and HITRUST issues the certification. Before you send anything, ask the buyer in writing whether an Insights Report satisfies the request or whether they require a validated result.
Confirm the deliverable up front
Health system questionnaires often use the word HITRUST for several different deliverables. Ask the buyer to name the deliverable, the framework version, the scope and the date they need it. Record the answer in the security review ticket so the team does not produce a validated report when an Insights Report was expected, or the reverse. This check costs a short email and prevents rework on evidence collection.
The other nine Insights Reports
HITRUST also offers Insights Reports for PHIPA, NIST SP 800-171, CMMC Level 1, Ransomware, NY OHIP, GovRAMP, HICP, HPH CPG and AI Risk Management. Vendors selling to hospitals usually meet the HIPAA, HICP or HPH CPG questions first, while the others apply to specific jurisdictions, federal work or AI programs. Ask the buyer which of these, if any, appear in their program, and avoid promising reports you have not scoped.
Map reports to your evidence
Whichever report the buyer names, the same underlying evidence usually supports it: access reviews, change records, encryption settings, backup tests and incident procedures. Keep one evidence library tied to control owners and review dates, then map each report's requirements to that library. Keep mappings as internal working documents until HITRUST or the buyer confirms how a particular report expects them to be presented.
Share only what the buyer requests
Once the deliverable is confirmed, send the report or summary that matches the request and nothing more. Restrict distribution to the buyer's named risk or security team, and track who received which version. Where a buyer's risk platform accepts HITRUST-signed results, ask whether they use the HITRUST results distribution system before exchanging PDFs by email.
How a SaaS vendor moves from first health system request to shared results
The sequence turns a health system's questionnaire into a validated HITRUST certification that the vendor can share with each relying party in a controlled way. Each step ends with a named output, so the vendor knows when to move on.
Confirm the assessment and Health3PT practices requested
Ask the health system in writing which HITRUST assessment it expects (e1, i1 or r2) and whether it asks for alignment with the Health3PT Recommended Practices. Health3PT is a healthcare third-party risk initiative, and its implementation guidance is approved by HITRUST as an assurance supplier. Confirm whether the request names a specific version of the CSF and whether the customer accepts a validated result or needs a specific certification letter. The output is a short written requirements note signed off by the vendor's security lead, which sets the target for every later step.
Decide scope and cloud inheritance position
The vendor's security and engineering leads define which products, environments, data flows and people fall inside the assessment boundary. They then decide whether the hosting cloud provider is carved out, meaning its controls are assessed separately, or inherited, meaning the provider's existing HITRUST results are reused under a documented shared responsibility matrix. Scope is recorded in MyCSF with the external assessor's input. The output is an agreed scope statement and a list of inherited or carved-out controls with the evidence each position depends on.
Prepare controls and evidence before fieldwork
The vendor's control owners map each requirement statement in scope to a policy, procedure, configuration or log that shows it operates. Gaps are fixed and the controls are allowed to run long enough to produce the history an assessor will sample. Work is done by the vendor, with the platform or implementation partner preparing systems and evidence, but the vendor owns every control. The output is an evidence index linked to each in-scope requirement, with known gaps recorded for the assessor rather than hidden.
Complete the validated assessment with an authorized assessor
An Authorized HITRUST External Assessor organization performs the validated assessment, testing evidence and interviewing staff within a fieldwork window of at most 90 days. The assessor scores each domain and records any corrective action plans. The vendor answers evidence requests and tracks open items in MyCSF. Consultants and readiness licensees may prepare the vendor but cannot submit the validated result. The output is the assessor's completed submission ready for HITRUST quality assurance.
Receive the certification report and letters
HITRUST performs central quality assurance on the assessor's submission before it issues the report. The vendor reviews the draft report for factual accuracy, then receives the certification report and two copies of the certification letter. One letter includes the scope of the assessment, and the other contains only the letter, so the vendor can share the right document with each relying party. The output is the signed certification package, stored under version control with its validity dates recorded.
Share results through the agreed channel
The vendor sends each health system only the document it needs, through the channel agreed in the requirements note. Where the customer uses a GRC or vendor risk platform, HITRUST's Results Distribution System can deliver HITRUST-signed results through an API instead of PDF and email exchanges. The vendor logs each recipient, the document version and the date shared. The output is a sharing register that proves which relying party received which result.
Track corrective action plans and renewal
The vendor works through every corrective action plan from the assessment, records closure evidence and reports progress to customers that requested it. Health3PT practices include tracking corrective action plans and assurance updates, so the vendor should expect follow-up questions on open items. Renewal dates are tracked against the certification validity period, and r2 interim assessments are scheduled ahead of their deadline. The output is a maintained plan of record that keeps the certification current and the customer's risk view accurate.
What a vendor should have in place before a health system review
Health system reviews test whether a vendor can prove its controls work for the systems that touch patient data, not just whether a certificate exists. The cards below cover the items a review team will probe first, and each one lists how your own team can check it before the questionnaire arrives.
Scoped service boundary for PHI
Define exactly which product, environments, data stores and support tools handle protected health information, and name the ones that do not. Health system reviewers compare this boundary against the assessment scope to decide whether a report covers the service they will buy. Check: have a product owner and a security lead each draw the data flow for one patient record from ingestion to deletion, then confirm both drawings match the scope statement.
Controls that operate over time
A point-in-time snapshot shows a control existed on one day. Reviewers want evidence that access reviews, vulnerability scans, backup restores and change approvals ran across a continuous period. Check: pull the last several cycles of each recurring control and confirm that every cycle has a dated record, an owner and a documented exception when a cycle slipped.
Third-party and cloud responsibilities
Most healthcare SaaS platforms depend on a cloud provider, a hosting partner and several sub-processors. Write down which party operates each control, and collect the reports or inheritance statements that support each claim. Check: for every control in your shared responsibility matrix, confirm that a named party owns it and that you hold current evidence from that party.
Corrective action tracking
Health systems ask how findings are recorded, prioritized, assigned and closed, because open items are where healthcare reviews most often stall. Track each corrective action plan with a target date, an accountable owner and verification evidence that the fix works. Check: select three findings from your last internal review and confirm each one has a closure record that a third party could follow without asking you questions.
Questionnaire versus report coverage
A health system questionnaire often asks about policies, staff training and incident response in ways a HITRUST report may not address directly. Map each question to the report section, a sub-processor attestation or a supporting document, and mark gaps openly. Check: take one recent questionnaire from a health system customer, assign each question to a source, and confirm that unmapped questions have a named owner for an answer.
Questions vendors ask before a health system review
What do health systems usually require from a SaaS vendor?
Most health systems ask vendors to show how they protect patient data, how they manage their own subcontractors, and how they respond to security incidents. Many then place the vendor in a risk tier based on the data and services involved, and that tier decides how much evidence they request. Health3PT, a healthcare third-party risk initiative joined by more than 150 organizations, publishes Recommended Practices that include risk tiering, reliable assurances, corrective action plan tracking and assurance updates. HITRUST approved as the first assurance supplier for those practices. Requirements still differ by system, so ask each buyer which assurances their program accepts for your tier and whether it follows Health3PT. Keep your evidence current so one packet can answer several reviews.
Does a HITRUST certification replace a security questionnaire?
Usually not on its own. A HITRUST certification gives a health system an independently assessed, quality-checked result, and some reviewers accept it in place of detailed control questions. The buyer's program decides what it accepts, so confirm that before you assume the questionnaire is gone. The certified entity receives the certification report plus two copies of the letter: one with the assessment scope and one with only the letter, so you can share what each relying party needs. HITRUST's Results Distribution System can deliver signed results by API to GRC and vendor risk platforms, which replaces PDF and email exchanges. Expect follow-up questions on anything outside the assessed scope, such as subprocessors, data location or a specific feature, and keep a short answer set mapped to your scope statement.
Is a Health3PT listing required to sell to health systems?
No, not according to the researched material for this page, and a health system may or may not ask for one. Health3PT's vendor directory lists vendors with completed and in-progress HITRUST certifications, so a listing can help buyers find your assurance evidence. Before you pursue one, ask your health system customers whether their programs use Health3PT practices and whether an in-progress entry would satisfy them. A listing also makes your assurance status visible to other organizations that use the directory, so keep the entry accurate and update it when your certification status changes. HITRUST's implementation article explains how it supports the Health3PT practices.
How long does preparation take before a health system review?
The honest answer depends on your scope, how mature your current controls are and how many systems the review covers, so our timeline guide is the right place to plan the schedule. Two rules shape the calendar for a HITRUST validated assessment. The assessor's fieldwork window is at most 90 days for e1, i1 and r2, and systems and controls must operate long enough, under HITRUST's incubation rules, to produce evidence before testing. Preparation before that window is where most of the time goes: a gap review, policy and procedure updates, and evidence collection. Ask any partner for a written schedule that separates these phases and names who is responsible for each one, including the assessor's calendar and HITRUST's quality assurance time.
What must the vendor supply, and what do the assessor and HITRUST do?
You own the controls and the evidence. Your team defines scope in MyCSF, operates the controls long enough to produce records, answers assessor requests and fixes findings. An Authorized HITRUST External Assessor performs the validated assessment and scores it. HITRUST performs central quality assurance before it issues the report and certification, and only those parties issue reports or certifications. An implementation partner such as DeployOpen can plan scope, implement and harden self-hosted platforms inside your own infrastructure, document controls and assemble evidence. It does not issue reports, attestations or certifications. Ask any partner to list in writing which deliverables it owns and which stay with your team.
Where do healthcare vendors most often need corrective action plans?
HITRUST's 2025 Trust Report found that healthcare and medical organizations had the highest average number of corrective action plans per r2 assessment in 2024. Software and technology organizations had the highest average per i1 assessment, and financial services had the lowest across both. A corrective action plan records a gap found during assessment, the fix and the date it will close. Health systems often track these plans over time, which is why Health3PT's practices include corrective action plan tracking. Before you submit, run your own gap review and focus effort on the areas it shows are weakest, rather than assuming the problem is in a single area. Confirm with your buyer how they want open plans reported between assessments.
Do we need a HITRUST Insights Report for HIPAA?
Ask your health system whether it wants this specific report before you commit to one. HITRUST offers ten Insights Reports, and the HIPAA report is one of them, alongside reports such as Ransomware, HICP and HPH CPG. Insights Reports are separate from the validated e1, i1 and r2 certifications, so a buyer who asks for a HIPAA report may be asking for something different from a certification. Confirm three things with the buyer and with HITRUST: what the report covers, how it is delivered to the relying party and whether it satisfies the request in the contract. Then decide whether it fits into the same evidence package you already prepare.
Can our implementation partner also serve as our HITRUST assessor?
No, and the two roles should stay separate. Only Authorized HITRUST External Assessor organizations may perform the validated assessments submitted for certification, and HITRUST reviews their work before it issues anything. An implementation partner can help you prepare systems, controls and evidence, but it cannot issue the report or certification. Assessor firms also face staffing and independence rules, so check any firm against HITRUST's directory and ask it to explain how it handles conflicts when it has worked on your environment. Keeping the roles apart protects your certification and gives your health system buyers an assessment they can rely on.
Which mistakes delay vendor HITRUST reviews
The most common cause of a delayed review is an unclear scope. A health system's security team will ask which products, hosting environments, data flows and support functions sit inside the certified scope, and if the answer differs between your sales deck, your questionnaire responses and the scope statement in your assessment, the review stops until someone reconciles them. Confirm the scope boundary in writing before the assessment starts, and make sure the systems that handle protected health information are named explicitly. Cloud infrastructure your platform depends on also needs a clear position, either as an inherited component with its own assurance or as an excluded carve-out that the customer's risk team can accept.
The second cause is offering a readiness document in place of a validated result. Internal gap assessments, self-attestations and readiness reports show preparation, but a relying party reviewing third-party risk generally needs a validated assessment scored by an Authorized HITRUST External Assessor and issued by HITRUST. Reviewers who receive the wrong kind of document will ask for the certification report, and the request adds weeks to the cycle. Check whether the customer's program accepts the e1, i1 or r2 result they need, and confirm the validity date of the certification before you send anything.
Sharing the wrong letter with the wrong party also causes delay. A certified entity receives a certification report and two versions of the certification letter, one that includes the assessment scope and one that contains only the letter, so each relying party sees only what it needs. Sending the scoped letter to a party that only needs confirmation, or the bare letter to a party that must see scope, invites a follow-up request. Keep a log of which letter went to which customer, and ask the customer which of its channels, such as a vendor risk platform, it uses to receive results. Finally, open corrective action plans from your assessment are a frequent source of stalled reviews. Health care organizations tend to scrutinize unresolved items closely, so close or document a credible remediation date for every open corrective action before the review begins.
How DeployOpen prepares SaaS platforms for HITRUST review
DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside the client's own infrastructure, so a SaaS vendor can show a health system buyer the controls and evidence behind its HITRUST work. DeployOpen prepares systems, controls and evidence; only an authorized External Assessor scores the assessment and HITRUST issues any report or certification.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- The written scope names the systems, environments and hosting accounts that a health system buyer's review would cover.
- Scope records which domains need evidence and which controls the vendor will inherit from cloud providers or other third parties.
How we build
- Systems are planned and configured in the client's own cloud accounts, data centers or air-gapped networks.
- Controls are implemented and hardened on self-hosted open-source platforms, with logging and access records kept for review.
- Security testing of applications, APIs and infrastructure is run so that findings can be tracked to closure before fieldwork.
How we hand over
- Control documentation and evidence are organized by requirement area so the client's assessor and internal team can trace each item.
- Backup, upgrade and operating procedures are written so the client's own staff can run the platforms after handover.
- Open findings and remediation status are listed so the client can decide which corrective actions to address before the assessor arrives.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the initial scope is delivered.
- Retainer work can keep evidence current between assessment cycles, including changes that affect the scoped environment.
- Before any engagement, ask DeployOpen to confirm in writing which services are in scope and which remain with the client or the assessor.
