Who requires HITRUST certification, and why customers ask for it
A HITRUST requirement almost always comes from a customer or a third-party program, not from a law. A questionnaire item, a contract clause or a healthcare vendor review asks for a HITRUST certification, and the certification itself is issued by HITRUST after a validated assessment performed by an authorized External Assessor. The answer to what your customer wants depends on the customer, the contract and the assessment level, so confirm three things before you plan any work: which of the e1, i1 or r2 the requester named, which relying parties will read the result, and whether they accept inheritance or a bridge letter in place of a fresh assessment. Ask for the exact wording of the clause, because a request for "HITRUST certified" and a request for a specific level lead to different scopes and budgets. The CSF is built to answer several obligations at once. It harmonizes more than 60 authoritative sources, including ISO/IEC 27001, NIST SP 800-53, HIPAA and PCI, so one assessment can be mapped to several customer questionnaires and regulatory requests. That is why health systems, payers and other large buyers ask for it: they can compare vendors on one scoring basis instead of reading a different questionnaire for each supplier. Your organization still owns its controls and must run them every day. An implementation partner can prepare systems, documentation and evidence, but only the External Assessor performs the validated assessment and only HITRUST issues the report and certification. For a vendor, the practical question is who will read the result and what they will do with it. Healthcare buyers often run third-party risk programs such as Health3PT, and some industries, notably software, healthcare, business services and financial services, hold most HITRUST certifications, so your peers may already be familiar with the format. Map each requesting party to the document it expects, such as a letter, a validated report or a shared results record, and confirm with each one how they receive results. Doing this early prevents rework when a customer asks for a different level than the one you began.
Which industries hold most HITRUST certifications
Four sectors accounted for more than 90% of the organizations HITRUST certified in 2024. Vendors selling into healthcare or technology should expect their buyers to ask for HITRUST, because those buyers already run vendor reviews that look for it.
Software and technology
Software and technology firms made up 37.3% of organizations HITRUST certified in 2024, the largest share of any sector. Many of these vendors certify because they host or process data for healthcare customers, so the certification becomes a product credential they show in procurement. If you sell SaaS into healthcare, check whether your largest customers already list HITRUST in their vendor questionnaires before you choose an assessment level.
Healthcare and medical
Healthcare and medical organizations accounted for 25.9% of certified organizations in 2024. Providers, payers and their suppliers use HITRUST to evaluate vendors that touch protected health information, and this sector is where the certification is most often written into contracts. Ask each health system customer which assessment level and scope it expects, and whether it accepts results through a shared platform.
Business services
Business services firms made up 19.1% of certified organizations in 2024. These include outsourced operations, billing, claims and consulting providers that handle client data on behalf of regulated organizations. Their certifications often answer the same question asked of software vendors: can the client trust how data is secured by a third party? Confirm which customers in this group ask for the certification and at what level.
Financial services
Financial services organizations made up 9.3% of certified organizations in 2024, the smallest of the four leading sectors. Banks and fintech firms use HITRUST alongside their own regulatory obligations when they assess vendors that hold customer data. A vendor selling into this sector should ask whether a HITRUST result would replace or supplement the questionnaires and audit reports the buyer already requests.
How Health3PT shapes what health systems ask vendors
Health3PT is a healthcare third-party risk initiative joined by more than 150 organizations, and it shapes how many health systems ask their vendors for assurance. HITRUST was approved as the first assurance supplier for Health3PT's *Recommended Practices and Implementation Guide*, so a HITRUST certification can serve as the assurance a health system accepts under that framework rather than a separate questionnaire for each vendor. For a vendor, the practical question is whether the customers on its list use Health3PT practices, and if they do, which certification level and report they expect to see.
HITRUST says it supports several Health3PT practices, including risk tiering, reliable assurances, corrective action plan (CAP) tracking and assurance updates. Health3PT also launched a vendor directory that lists vendors with completed and in-progress HITRUST certifications. Listing can make a vendor easier to find for health systems working under the initiative, but a vendor should not assume that an in-progress entry carries the same weight as a completed certification with its report. Before submitting anything, confirm the directory's current listing rules with Health3PT directly, and ask each health system customer which tier it assigns to your service and what assurance update cadence it expects.
Ask each health system to confirm in writing which Health3PT practices apply to its program, how it tracks open CAPs, and how it expects to receive updated assurance after a significant change. Then compare those expectations with your certification timeline and your results sharing setup. Health3PT's practices and directory rules can change, so treat any summary here, including HITRUST's July 2023 description, as a starting point to verify with the health system and Health3PT before you commit to a plan.
How HITRUST results reach the customers who ask
A HITRUST result moves through four hands before a customer can rely on it: the External Assessor, HITRUST quality assurance, the vendor and the relying party. Each handoff produces a named output, so the customer can confirm what was certified and when.
Assessor completes the validated assessment
An Authorized HITRUST External Assessor organization tests the vendor's controls against the requirement statements in the chosen assessment (e1, i1 or r2) and scores them in MyCSF. Fieldwork runs within the fieldwork window HITRUST sets, and the assessor submits the validated assessment for review. The output is a submitted assessment package, not yet a certification, and the vendor should confirm the assessor's name appears in HITRUST's directory before work starts.
HITRUST performs quality assurance
HITRUST reviews the submitted assessment centrally before anything is issued. This review checks that the scoring and evidence meet HITRUST's standards, and reviewers may return questions to the assessor and vendor. The output is a QA outcome, and the assessment only moves forward once HITRUST accepts it. Vendors should ask their assessor for the expected QA reservation and status updates rather than assuming a date.
HITRUST issues the report and certification letter
After QA, HITRUST issues the assessment report and, where the result qualifies, the certification letter. These documents carry HITRUST's signature, which is what distinguishes them from an assessor's internal workpapers or a vendor's self-prepared summary. The vendor should confirm the certification status and expiry date on the letter and check that the report name, assessment type and CSF version match the customer's request.
Vendor publishes results to the Results Distribution System
The vendor authorizes HITRUST's Results Distribution System to share the signed results with the relying parties it chooses. RDS is an API-enabled platform, so relying parties receive the results directly rather than through PDF attachments and email threads. The output is a distribution record that shows which relying parties have access. Vendors should confirm with each customer which recipients it uses and whether it needs an integration.
Relying party imports results into its risk platform
The customer's third-party risk team receives the HITRUST-signed results in its GRC or vendor risk platform, such as ServiceNow, through the RDS integration. Because the data arrives in structured form, the team can track the assessment type, scores and expiry against its vendor inventory. The output is a vendor record in the customer's own system. Where the customer does not use a supported platform, it should ask the vendor for the signed report and confirm the same details manually.
Customer checks status before relying on the result
The customer verifies that the certification is current and matches the scope it needs, using the signed results and HITRUST's public status information. It checks the assessment level, the systems and services in scope, the expiry date and any interim assessment or bridge requirements. The output is a documented reliance decision. If the status changes, such as a lapse or revocation, the customer should expect an update through the same channel.
What vendors use certification for beyond the contract
The most common reason a vendor pursues HITRUST is that a customer names it in a contract, a security questionnaire or a procurement checklist. The customer's security or vendor risk team usually wants to know which assessment level was completed, the scope, the date of certification and whether the certification is current. Contract language often specifies a minimum level, so the vendor should confirm that the level named in the agreement matches what it has achieved or plans to achieve.
- Assessment level: Confirm whether the contract asks for an e1, i1 or r2, since the three levels differ in requirement count and validity.
- Scope statement: Confirm which systems, facilities and services sit inside the assessed scope, and whether the customer's data flows through them.
- Validity dates: Confirm the certification date and when it lapses, including any interim assessment due for an r2.
- Report access: Confirm how the customer will receive the signed result and whether the contract requires a specific sharing route.
- Contract wording: Confirm whether the agreement requires certification, a report or only an assessment in progress.
Before relying on a clause, have counsel or the contract owner confirm the exact wording of the required assurance.
Health3PT is a healthcare third-party risk initiative that publishes Recommended Practices and an implementation guide used by health systems and their vendors. HITRUST was approved as the first assurance supplier for those practices, and Health3PT maintains a vendor directory that lists vendors with completed and in-progress HITRUST certifications. Health system third-party risk teams use the directory to find vendors whose assurance already maps to Health3PT expectations, which can shorten repeated questionnaire cycles.
- Who asks: Health system third-party risk and vendor management teams that participate in Health3PT.
- What they need to see: A current HITRUST status that the directory can display, along with the assessment details used for their review.
- Status category: Confirm whether the vendor is listed as completed or in progress, because the two states carry different assurance weight.
- Practice alignment: Confirm how risk tiering, corrective action plan tracking and assurance updates are handled in the vendor's program.
- Listing criteria: Confirm current listing requirements directly with Health3PT, since directory acceptance is not guaranteed by certification alone.
Treat directory presence as a route to visibility, not as a substitute for the buyer's own review.
HITRUST's Getting Started checklist lists access to cyber insurance through the HITRUST Shared Risk Facility as one business use of certification. The idea is that insurers may consider verified security controls when they underwrite cyber coverage. Whether any insurer offers terms, pricing or eligibility because of a certification is a matter for that insurer and the vendor's broker, and this page makes no promise about insurance outcomes.
- Who asks: Cyber insurers and brokers that participate in the shared risk facility arrangement.
- What they need to see: The certification level, validity period and report or letter that confirms the result.
- Eligibility rules: Confirm which certification levels and conditions the facility currently accepts, directly with HITRUST.
- Lapse impact: Confirm what happens to the vendor's insurance position if a certification expires, is revoked or is not renewed.
- Data sharing: Confirm what information the insurer receives, how it is delivered and who consents to the release.
Ask the broker to put any coverage or pricing effect in writing before the certification is treated as an insurance benefit.
Which HITRUST level customers usually ask for
Customers most often ask for the r2, but the level that matters is the one written into your contract or questionnaire. In 2024, 62.1% of HITRUST validated assessments were r2, 21.9% were i1 and 16% were e1, according to the HITRUST 2025 Trust Report. Over 60% of new HITRUST customers, however, chose the e1. Those two numbers describe different things: the r2 dominates the completed assessments that carry the most assurance, while the e1 is the most common entry point for vendors that are new to HITRUST. A requirement for HITRUST in a vendor questionnaire does not tell you which of those paths the customer expects.
The e1, i1 and r2 form a traversable portfolio. Every e1 requirement appears in the i1 baseline, and every i1 requirement appears in the r2 baseline, so work done for a lower level carries forward instead of being discarded. In v11.9 the e1 has 44 requirement statements and the i1 has 182. Before you start, ask the requesting customer to confirm the level in writing, and ask whether they want a validated report, a certification letter, or a recent interim assessment. Those are different deliverables, and a contract may name any of them. If the customer accepts an e1 today with a plan to move to an i1 or r2 later, get that path and its timing in writing as well.
Confirm the level, the report type and the date the customer needs to see it before scoping. Also check whether the requirement is tied to a specific CSF version, since version changes can affect the baselines your assessor will test. Once the request is clear, the level determines the scope of your readiness work, the evidence you need to collect and the assessor effort you should expect to quote. Ask your assessor to confirm how the chosen level maps to the customer's requirement before fieldwork begins.
What relying parties check when they read a HITRUST result
The table lists the questions a health system or other relying party usually asks of a vendor's HITRUST result, the field or document where each answer should appear, and who confirms it. Work through the rows before accepting a result, because a certification label alone does not show scope, validity or inherited coverage.
| Question | Where the answer appears | Who confirms it |
|---|---|---|
| Which assessment level was completed (e1, i1 or r2)? | The HITRUST certification letter and the assessment type stated on the report | HITRUST issues the letter after quality assurance; the External Assessor performed the fieldwork |
| Is the result validated only, or certified? | The report status and the letter wording, which distinguish a validated assessment from a certification | HITRUST, after its central quality assurance review |
| When does the certification start and expire? | Certification date and expiration date on the letter; for r2, the interim assessment timing | HITRUST records these dates; ask the vendor for the current letter in MyCSF or the results system |
| What systems, facilities and business units are in scope? | Scope statement and system descriptions in the report | The External Assessor documents scope; the vendor owns its accuracy and should confirm it matches the services you buy |
| Which controls are inherited from a cloud provider or other third party? | Inheritance and carve-out statements, plus the shared responsibility matrix | The inheriting vendor documents them; check the provider's own HITRUST result for the inherited scope |
| Did any requirement receive a N/A decision, alternate control or corrective action? | Requirement-level notes, N/A justifications and the corrective action plan section | The External Assessor reviews these; HITRUST quality assurance checks them before issuance |
| Has anything changed since the certification, such as a security incident or significant system change? | The vendor's notification to you and any updated letter or interim assessment record | The vendor reports it; ask HITRUST or the vendor for confirmation of current status |
Questions buyers ask about who requires HITRUST
Does a law require a HITRUST certification for vendors?
No general law requires HITRUST certification. HITRUST is a certifiable control framework that customers, health systems and healthcare third-party risk programs ask for through contracts, security questionnaires and vendor onboarding. Obligations under laws such as HIPAA can be mapped to the CSF, because it harmonizes more than 60 authoritative sources, so one assessment can speak to several obligations at once. Still, confirm any specific regulatory citation with counsel before writing it into a contract, policy or sales material. The most practical step is to ask the customer for the clause that names HITRUST, the assessment level it expects (e1, i1 or r2), and the scope it wants covered.
How much does a customer usually expect a vendor to spend on HITRUST?
The cost depends on the assessment level, the systems in scope, external assessor fees, HITRUST platform and report charges, readiness work, remediation, and how much of the scope can be inherited from cloud providers or other vendors. The cost guide on this site walks through each component and who is paid for it. Some costs are one-time, such as the first validated assessment and early remediation. Others recur, including the assessment at renewal, and r2 certifications carry an interim assessment before the first anniversary. When requesting a quote, ask for the assessor fee, the MyCSF subscription if needed, readiness work, and the expected remediation effort, each listed separately. DeployOpen does not publish a price list. It provides a quote from a written, fixed scope.
How long does it take a vendor to get HITRUST certified?
The total time depends on the assessment level, how ready the organization's controls and evidence are, and how quickly the assessor and HITRUST complete their steps. Fieldwork for an e1, i1 or r2 validated assessment must fit within a fieldwork window of at most 90 days, according to the HITRUST Assessment Handbook. Readiness work, system and control incubation, quality assurance and draft report review all come before certification and are not included in that window. The timeline guide on this site explains each phase. Certifications last one year for e1 and i1 and two years for r2. Ask the assessor for a written schedule that names each phase, the evidence deadlines and the points where the organization must respond.
Can a vendor prepare for HITRUST without an outside firm?
An organization can prepare its own controls, policies and evidence without outside help, since it owns those controls. The validated assessment submitted for certification is different. Only an Authorized HITRUST External Assessor organization may perform it, and HITRUST performs central quality assurance before it issues reports. Readiness work, including gap analysis and evidence organization, can be done by a consultant or readiness licensee, but that work does not produce a validated result. DeployOpen plans, implements, hardens and documents self-hosted open-source platforms, and prepares systems, controls and evidence for an assessment. It does not issue reports or certifications. Check any assessor against HITRUST's Find an External Assessor page before signing.
What does a HITRUST assessment need from our internal team?
A HITRUST assessment draws on several functions, so the organization should name an owner for each control area before readiness work begins. Security, IT operations, engineering, HR, legal and procurement usually each supply evidence. Typical needs include a current inventory of systems and data flows, approved policies and procedures, access reviews, change records, log samples, vulnerability management records, incident and training evidence, and documentation of any inherited controls from cloud or vendor providers. During fieldwork, staff must answer interviews and produce samples quickly, which is often the hardest part to plan. Ask the External Assessor for a written evidence request list and a named internal point of contact, and agree on how quickly each request will be answered.
What does a HITRUST certificate show a customer, and what does it leave out?
A HITRUST certification shows that an authorized External Assessor validated the stated scope against the CSF and that HITRUST quality checked the result before issuing it. It does not decide whether a customer approves the vendor. A customer still needs to read the scope statement, the assessment level, the issue and expiry dates, and any corrective action or validated-only language in the report. The certificate covers only the systems in scope, so a customer should confirm that its data and services fall inside that boundary. Many customers also keep their own risk reviews and contract terms. Results can be shared through HITRUST's Results Distribution System, which delivers HITRUST-signed results to relying parties and replaces many PDF and email exchanges.
What the organization owns and what an implementation partner prepares
The organization owns its controls, its evidence and its results. An implementation partner does not take over any of those. In a HITRUST engagement, the vendor decides which systems fall in scope, runs its own control operation, answers for its security posture to its customers, and decides whether to pursue a validated assessment at all. DeployOpen, as an implementation partner, works inside a fixed written scope to prepare the systems, configurations and evidence that the organization's own team will then stand behind. That work typically covers hardening self-hosted open-source platforms in the client's own cloud accounts, data centers or air-gapped networks, documenting how those controls operate, and organizing the artifacts an assessor will ask for. The written scope, deliverables and timelines are agreed before work starts, so the vendor can see exactly what it is paying for.
Only an authorized HITRUST External Assessor performs the validated assessment, and HITRUST performs central quality assurance before it issues a report or certification. DeployOpen does not issue HITRUST reports, letters or certificates, and it does not claim HITRUST authorization. No outcome is guaranteed. A failed domain, a rejected control or a validated-only result is a possible result of any assessment, whoever prepared the environment. Before engaging anyone, ask who on the proposed team is authorized to perform validated work, confirm the assessor's status against HITRUST's Find an External Assessor listing, and make sure the written scope states which tasks belong to the vendor, the partner and the assessor. Separately, DeployOpen runs security testing and private cyber ranges, which can help a team rehearse incident response or test controls before the assessor arrives, but that support sits alongside the certification, not inside it.
How DeployOpen prepares a vendor for a customer's HITRUST request
When a customer or contract asks for HITRUST, the vendor still owns its controls and its certification decision. DeployOpen works on the platforms and evidence behind that request, inside the vendor's own infrastructure, and hands over a documented result that the vendor's External Assessor can test.
How we scope
- We confirm which customer or contract requirement triggers the request and which HITRUST assessment level it names.
- We agree the systems, environments and hosted platforms in scope before any work starts, in a written scope.
- Engagements are fixed-scope, with deliverables and timelines set out in writing, and any quote follows from that scope.
How we build
- We implement and harden self-hosted open-source platforms in your cloud accounts, data centers or air-gapped networks.
- We configure logging, access control, backup and change records so they produce the evidence an assessor will sample.
- We run security testing against applications, APIs and infrastructure, and document the findings and fixes for review.
How we hand over
- We deliver control documentation, configuration baselines and evidence packages mapped to the agreed scope for your records.
- We walk your internal team and External Assessor through the evidence so the assessor can test it independently.
- We state clearly that DeployOpen prepares systems and evidence, while only an independent assessor issues the HITRUST result.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the initial engagement ends.
- Retainers can keep evidence current between HITRUST validated assessments, including interim and renewal cycles you plan.
- Ask us to confirm the support scope, response expectations and renewal terms in writing before you sign anything.
