How do we use HITRUST in third-party risk management?
HITRUST gives a relying party a structured, assessor-issued result it can read in place of sending its own questionnaire, but the vendor's assessment still has to be checked for scope, assessment type and validity before anyone relies on it. A health system or other regulated buyer with many vendors can use a HITRUST report or letter as the starting point for due diligence, then test whether the certified scope actually covers the service and data the buyer is purchasing. The result is only as useful as that match, so a certification for a vendor's data center may say little about the SaaS module the buyer uses, and a validated-only result is not the same as a certification.
The value of HITRUST depends on the buyer's own service, data and risk tiering, so the answer differs from one organization to the next. A buyer that tiers vendors by the sensitivity of the data they hold will likely ask for a different assessment type, or a different depth of review, for a claims processor than for a scheduling tool. Health3PT practices, which are covered in more detail elsewhere on this page, give a shared vocabulary for tiering and assurance, but each buyer still has to decide which vendors need a full certification, which need a targeted or narrower review, and which need no further assurance. Confirm with your own risk team which tiers map to which evidence before you update vendor questionnaires.
The buyer owns its vendor risk decisions and the vendor owns its controls. Neither a buyer nor an implementation partner can issue a HITRUST report or letter. Only an authorized HITRUST External Assessor organization performs the validated assessment, and HITRUST performs central quality assurance before results are issued. Ask each vendor for the current letter, its scope statement, its expiration date and the name of the assessing firm, and check that firm against HITRUST's list of authorized assessors. Where a CAP or open gap is listed, record it in your own risk register with an owner and a review date.
How Health3PT practices shape HITRUST-based vendor reviews
Health3PT is a healthcare third-party risk initiative that more than 150 organizations have joined, and it approved HITRUST as the first assurance supplier for its Recommended Practices and Implementation Guide. The four practices below are the parts a relying party is most likely to apply when reviewing a HITRUST-certified vendor.
Risk tiering
Health3PT practices start by grouping vendors by the risk they carry, based on the data they handle and the services they provide. The tier decides how deep the review goes and which assurances are sufficient. Before you rely on a HITRUST certification, check that the vendor's assessment scope covers the service and data flows you are buying, not only the vendor's headline certification. HITRUST says it supports this tiering approach, so ask the vendor how its assessed scope maps to your tier. Confirm current tier definitions directly with Health3PT.
Reliable assurances
Health3PT expects relying parties to accept assurances that are independently produced and consistently scoped. A HITRUST validated assessment is performed by an authorized External Assessor and reviewed by HITRUST before a report is issued, which gives you a common basis for comparing vendors. Check the assessment type, the validity period and whether the result is a certification or a validated-only report. Ask whether the assessor is on HITRUST's authorized list and whether any requirements were excluded or carved out.
CAP tracking and assurance updates
A corrective action plan (CAP) records the gaps a vendor has found and the work it has committed to fix. Health3PT practices include tracking those CAPs and receiving assurance updates over time, rather than treating the certification date as the end of the review. Set a schedule to request updated CAP status and any refreshed results, and record the dates each open item is due. A vendor that cannot show progress on its CAPs between assessments should prompt a closer look at its controls.
Health3PT vendor directory
Health3PT maintains a vendor directory that lists vendors with completed HITRUST certifications and those with in-progress certifications. Use it as a starting point for identifying candidate vendors, not as proof of a vendor's assurance level. An in-progress entry means the assessment has not yet produced a result, so request the status and expected completion from the vendor. Compare what the directory lists against the vendor's own letter and report, and confirm listing criteria and update practices with Health3PT before you build a review step around them.
How a relying party moves from vendor intake to a decision
This sequence turns a vendor's HITRUST material into a documented, scoped and monitored third-party risk decision that the relying party can defend to its own governance, auditors and regulators.
Tier the vendor by data and service criticality
Before requesting any HITRUST material, the third-party risk team assigns the vendor a risk tier based on the categories of data the vendor will touch, such as protected health information, and how critical the purchased service is to clinical or business operations. The business owner and security function sign off on the tier. The output is a tier record that states the data types, the service being bought and the level of assurance the tier requires, so later steps have a clear standard to measure against.
Request the HITRUST letter and report
The relying party asks the vendor for its current HITRUST letter and, where the tier requires it, the full validated report, and asks that both be delivered through a controlled channel rather than an informal email attachment. Where the vendor and relying party both use GRC or vendor risk platforms, HITRUST's Results Distribution System can deliver HITRUST-signed results directly. The output is a dated copy of the documents held in the relying party's records, with the source channel noted.
Verify scope against the purchased service
The reviewer compares the scope statement, included facilities, systems and any carve-outs against the exact service the organization is buying, including hosting locations and subservice organizations that handle its data. They also confirm the assessment type, that the certification is current, and that the assessor was an Authorized HITRUST External Assessor organization. The output is a written scope finding that states whether the certification covers the service, or which gaps must be closed with compensating assurance before proceeding.
Review domain scores and open corrective action plans
The reviewer reads the domain-level scores against the thresholds in the report and checks every open corrective action plan and identified gap. Each gap is assessed for its effect on the data and service in scope, and the reviewer asks the vendor for remediation ownership and status. The output is a gap register that lists each open item, its relevance to the relying party's data, and whether the item is accepted, requires a contractual commitment or blocks the decision.
Set update triggers and monitoring obligations
The relying party defines the events that will prompt a fresh review, such as a new certification cycle, an interim assessment, a significant change to the vendor's environment, a security incident, or a change in the vendor's certification status. It also records how the vendor will notify it of those events and how the status will be checked over time, using the vendor directory or the Results Distribution System where available. The output is a monitoring schedule and notification clause agreed with the vendor, tied to the tier from step one.
Record the decision and its conditions
The accountable owner approves, conditionally approves or declines the vendor, and records the reasons, the accepted gaps, the compensating controls and the monitoring triggers. The record names who made the decision and when the file must be revisited. It should also state that the relying party owns its own risk decision, since HITRUST certification is evidence that informs that decision rather than a substitute for it. The output is a signed third-party risk file that an auditor or regulator can follow from intake to decision.
How the Results Distribution System replaces PDF and email exchanges
The Results Distribution System (RDS) is HITRUST's API-enabled platform for delivering HITRUST-signed assessment results to relying parties, and it integrates with GRC and vendor risk platforms such as ServiceNow. For a third-party risk team, the practical change is that the signed result reaches your intake workflow as structured data from HITRUST, rather than as a PDF forwarded by the vendor by email. That shifts the question from whether you hold the right file to whether your system of record holds the current, HITRUST-issued result for the right scope.
Digital delivery changes three things in practice. At intake, you can match the result's scope, assessment type and dates against the service you are buying before anyone opens a document, and attach the record to the vendor file automatically. On re-review, a new or reissued result replaces the old one in the same record instead of living in a folder of superseded attachments. For corrective action plans, your team can track CAP status and open items against the vendor's remediation commitments in the platform where your risk register already sits, so follow-up does not depend on someone remembering to ask. Confirm with HITRUST how the platform notifies you when a result changes, and whether your ServiceNow or GRC configuration needs an integration owner on your side.
Before you rely on RDS as your only path to a vendor's results, confirm with HITRUST which relying parties are eligible, which result types and letter versions the platform delivers, and how vendors grant you access. Ask whether results from earlier assessments, validated-only results and results for scopes that exclude your service are visible, and how revocations or suspensions are reflected. Also ask your vendors to confirm that they have authorized your organization, since the platform does not replace the scope and validity checks your team still has to perform.
What one HITRUST assessment can cover across other frameworks
HITRUST maps its CSF to more than 60 authoritative sources, so one validated assessment can answer several obligations at once. The cards below cover the frameworks buyers ask about most, and the checks a relying party should make before it accepts a mapping.
NIST SP 800-53 mapping
HITRUST maps its CSF to NIST SP 800-53 Rev. 5, which federal and federally aligned vendors often must meet. A relying party should confirm which mapping version the vendor's assessment used, because the CSF refreshed its NIST SP 800-53 mapping in v11.9.0. Check that the mapped controls fall inside the assessed scope of the service you buy, not just the organization's general security program.
ISO/IEC 27001 alignment
The CSF's core structure is based on ISO/IEC 27001 and 27002, so a vendor's ISO certification and its HITRUST results often overlap in management system and control areas. Overlap does not transfer the ISO certificate to the vendor's HITRUST scope. Ask whether the ISO certification covers the same facilities and services as the HITRUST assessment before you rely on one to stand in for the other.
HIPAA safeguards
For health systems, HIPAA is usually the obligation that drives vendor review, and HITRUST maps to it. A mapping shows where the vendor's controls address HIPAA safeguards, but it does not replace your own risk analysis or the vendor's business associate agreement. Confirm that the scope includes the systems that store or transmit electronic protected health information for your contract.
FedRAMP and PCI mappings
HITRUST also maps to FedRAMP and PCI, which matter when a vendor hosts government workloads or handles cardholder data. These mappings are useful for narrowing the questionnaire, but the buyer must confirm the FedRAMP baseline or PCI version the mapping references. Where the vendor's payment or federal environment sits outside the HITRUST scope, that gap needs its own evidence.
Targeted assessment for selected sources
A HITRUST targeted assessment is a self-assessment built only from requirement statements mapped to the authoritative sources the entity selects, such as NIST SP 800-171, FedRAMP or HIPAA. It is non-certifiable, so a buyer should not treat it as a HITRUST certification. Ask which sources were selected and whether the output is a self-attested result tied to those sources only.
Mapping version and scope checks
A mapping only helps when the buyer confirms the mapping version, the framework version it cites, and whether the assessed scope covers the service being bought. Requests should name the vendor's assessment type, the included facilities and any carve-outs. Without these checks, a mapped control can look covered when the controls actually tested were for a different environment.
What the 99.41% breach figure does and does not tell a relying party
The 99.41% figure in HITRUST's 2025 Trust Report says that 99.41% of HITRUST-certified environments did not report a security breach to HITRUST in 2024, up from 99.36% in the prior report. A relying party should read this as a statement about the certified population HITRUST sees, not as a measure of any one vendor's security. HITRUST calculated the percentage from breaches reported to it, so the denominator and the numerator both come from HITRUST's own program data. It is not an independent sample drawn by a third party, and breaches that were never reported to HITRUST, or environments outside its program, do not appear in it.
The figure also does not prove that a given vendor is breach-free. A certification covers a defined scope, a defined assessment type and a defined period, and a vendor's breach history for the service you buy may fall outside all three. Before you rely on the statistic, confirm with the vendor whether the certified environment is the same system that processes your data, whether any carve-outs exclude the hosting or subprocessors involved, and whether the certification is current. The Trust Report is a reasonable reason to expect certified organizations to be broadly well controlled, but it cannot replace a check of the vendor's own incident history.
Use the figure as context for your own review, not as a score. Ask the vendor directly whether it has had a security incident affecting customer data in the last few years, how it was notified and remediated, and whether any corrective action plan from its assessment addresses the same weakness. Then compare those answers with the scope, the validity dates and the domain results in the vendor's report. If the vendor's answers and the report do not match, the statistic should carry no weight in your decision.
What to verify in a vendor's HITRUST result before relying on it
A HITRUST result describes the environment and services that were assessed, not the vendor as a whole. The first check is whether the systems, facilities and services in the assessment match the service your organization buys. A certified platform can leave out a product line, a region or a hosting arrangement, and those gaps matter most when they touch the data you send.
- Named services: Confirm the product, service or environment in the scope statement is the one you will use, under the same name and version.
- Facilities and hosting: Check whether data centers, subservice organizations and cloud regions in your data flow appear in scope or are excluded.
- Carve-outs: Identify any controls or components the vendor excluded and whether you can accept that exclusion for your data.
- Inherited controls: Where the vendor relies on a cloud provider's results, confirm how that reliance is documented and whether the provider's scope fits your needs.
- Data flow match: Compare the scope against the data types you will share, including any sensitive or regulated categories.
If the scope does not describe your service, ask the vendor in writing which environment was assessed before you rely on the result.
HITRUST certifications come in different assessment types, and each carries its own validity period. The e1 and i1 certifications last one year, and the r2 certification lasts two years, with an interim assessment due in the 90 days before the first anniversary. A result that was valid when issued may no longer be current at the time you review it, so the date check is as important as the assessment type.
- Assessment level: Confirm whether the result is an e1, i1 or r2, and whether that level matches the risk of the data and service involved.
- Issue and expiry dates: Calculate the expiry from the issue date using the term for that assessment type, and compare it with today.
- Interim assessment: For an r2, check whether the required interim assessment has been completed on schedule.
- Version reference: Note which CSF version the assessment used, since later versions can change baselines.
- Targeted assessments: A targeted assessment is not a certification, so it carries no certification validity period and should be reviewed as a self-assessment against the sources it maps to.
If the expiry date has passed or no interim assessment is evidenced, request the current result before relying on it.
A validated assessment is performed by an authorized external assessor and reviewed by HITRUST before a report is issued. A targeted assessment is a non-certifiable self-assessment built from requirement statements mapped to sources the entity selects, such as NIST SP 800-171, FedRAMP or HIPAA. Both can be useful, but they do not provide the same assurance, and a vendor should not present one as the other.
- Result type: Confirm whether the document you received is a validated certification report or a targeted assessment output.
- Certification wording: Check whether the letter states that the vendor is certified, and whether the wording matches the assessment type.
- Mapped sources: For a targeted assessment, identify which sources were selected and whether they cover the obligations you need to evidence.
- Limits of reliance: Ask what the vendor's own statements can and cannot claim based on a targeted result.
- Sufficiency: Decide internally whether a self-assessment is enough for the data and service, or whether you need a validated result.
Treat any document that does not clearly identify its assessment type as incomplete until the vendor confirms it.
Only Authorized HITRUST External Assessor organizations may perform the validated assessments submitted for certification, and HITRUST performs central quality assurance before it issues reports. Checking the assessor is a way to confirm that the result came through the required process, and it is a simple lookup against HITRUST's published directory.
- Assessor name: Confirm the assessing firm named in the report or letter is an authorized External Assessor organization.
- Directory lookup: Verify the firm on HITRUST's Find an External Assessor page, and record the date you checked.
- Independence: Ask whether the assessor also prepared the vendor for the assessment, since that relationship affects how much weight the result can carry.
- Report source: Confirm the result was delivered through the channel HITRUST uses for signed results, not a copied or edited file.
- Authorization changes: Recheck the assessor status at intervals, because authorization is not permanent.
If the assessing firm does not appear in the directory, or the vendor cannot name it, the result should not be treated as a validated certification until resolved.
A certification can stop being reliable before its expiry date. Its status can change because of a security incident, a significant change to the environment, a failure to complete a required interim assessment or other conditions set out in HITRUST's process. A result that looks current on paper may therefore no longer represent the vendor's current position, so status must be checked at the time of reliance.
- Current status: Check the certification status with the vendor and, where available, through the HITRUST channels that report it.
- Incident disclosure: Ask whether the vendor has experienced a security incident affecting the assessed environment since the certification was issued.
- Significant changes: Ask whether the assessed environment has changed materially, such as a new hosting provider or a major platform migration.
- Interim status: For an r2, confirm the interim assessment result and whether any open corrective actions remain.
- Contract terms: Require notice of status changes in the contract, so you learn of a suspension or revocation without waiting for renewal.
The buyer decides how much weight a current, unsuspended certification should carry in its own risk assessment, and that decision should be recorded alongside the evidence reviewed.
Where HITRUST-based vendor reviews go wrong
A HITRUST letter looks like a finished answer, which is why vendor reviews often stop too early. The four failures below share one root cause: the reviewer accepts a document without checking what it covers, what kind of assessment produced it, and whether it is still in force.
Accepting a letter without checking scope
A HITRUST letter names the organization and the scope it was assessed against, but a vendor's certified environment may not include the platform, region or service you are buying. Compare the listed facilities, systems and services with your contract, and read the carve-out section to see which functions were excluded and who covers them. If a carved-out function handles your data, request that provider's own assurance. Ask the vendor to confirm in writing which of your services fall inside the certified boundary.
Treating a targeted assessment as certification
HITRUST also offers a targeted assessment built from requirement statements mapped to sources the entity chooses, such as NIST SP 800-171, FedRAMP or HIPAA. It is a self-assessment and cannot be certified, so it carries no HITRUST certification status even when the document looks similar. Check the assessment type named on the report before you record a certified status in your vendor inventory. Ask the vendor which assessment type they hold and what evidence they have for the framework you actually need.
Missing an r2 interim or expiry date
An r2 certification lasts two years, and an interim assessment is due in the 90 days before the first anniversary. A certification that was valid at contract signing can lapse during the term if no one tracks these dates. Record the certification date, the expiry date and the interim window in your vendor register, then set a reminder before the window opens. For e1 and i1, which last one year, track the single expiry date the same way and request the renewed letter before the old one lapses.
Ignoring open corrective action plans
A passing result can still carry corrective action plans (CAPs) for gaps the assessor identified. Those CAPs show what the vendor has promised to fix and by when, and they are the best early signal of control weakness. Ask for the current CAP list, then compare each open item with the risk it creates for your data and services. Health3PT practices, which HITRUST supports, include CAP tracking and assurance updates, so write a request for CAP status updates into your contract or review cycle.
Who owns each part of vendor assurance
This table compares the buyer, the vendor and the authorized external assessor across the decisions and artifacts in a HITRUST-based vendor review. Read each row as a question of who decides, who operates and who signs off, then check the vendor's certification against the assessor and report rows before relying on it.
| Responsibility | Buyer (relying party) | Vendor (certified organization) | Authorized external assessor |
|---|---|---|---|
| Risk tiering and scope of reliance | Decides how critical the service is and which assurance it requires, using its own Health3PT-aligned or internal tiering | Describes the systems, facilities and services inside the assessed scope | Tests whether the stated scope matches the assessed environment; does not set buyer risk tiers |
| Controls and day-to-day operation | Reviews control design and any gaps that affect the services it buys | Owns, operates and maintains every control in scope | Does not operate controls; tests them during fieldwork |
| Evidence collection | Requests evidence only where the contract or review requires it | Produces and retains the evidence the assessment samples | Selects samples, inspects evidence and records results in the validated assessment |
| Validated assessment fieldwork | Has no role beyond receiving the outcome | Schedules and supports fieldwork, typically within a window of at most 90 days | Performs the validated assessment; must be an Authorized HITRUST External Assessor organization |
| Report issuance and quality review | Receives signed results, typically through MyCSF or the Results Distribution System | Shares results it is permitted to share, without altering them | Submits the assessment; HITRUST performs central quality assurance before issuing the report |
| Corrective action plan follow-up | Tracks CAP items and assurance updates against its own thresholds | Owns remediation, timelines and CAP updates | Reviews whether gaps are scoped and documented; does not remediate for the vendor |
| Contract terms | Specifies assurance deliverables, notice of changes and right to review | Agrees to maintain certification, notify significant changes and provide results | Not a contract party; the assessment does not replace contractual obligations |
| Implementation support, if engaged | Engages a partner only for its own internal review work | Engages DeployOpen or another partner to prepare systems and evidence | Independent of the partner; cannot be the same party that prepared the evidence |
Questions relying parties ask about HITRUST and vendor risk
Does HITRUST replace our vendor security questionnaire?
Usually it reduces the questionnaire rather than removing it. A HITRUST certification gives you an assessor-validated view of a vendor's controls, scope and results, which covers much of what a generic questionnaire asks. You still need to confirm that the certified scope covers the specific service you buy, and you may still ask questions about items outside that scope, such as subprocessors, data residency or contract terms. Plan your questionnaire around the gaps the certification leaves open, and confirm with your legal and security teams which questions they require regardless of certification.
How long does a vendor review take to set up?
The setup effort depends mostly on how many vendors you review, how many tiers your program uses and whether the vendor already has a current certification you can retrieve. A vendor with a valid, in-scope certification needs document review and scope checking rather than a full questionnaire cycle. A vendor without one needs a longer exchange of evidence. Your program will also need a risk tiering model and a workflow for receiving updates. Ask your internal team to estimate their own effort from their vendor inventory, since no supplied figure sets a general duration.
What do we need to provide from our side?
Your side of the work is defining what the vendor must prove and who reviews it. In practice that means:
- A written list of the services, data types and integrations the vendor will handle, so you can compare them with the certified scope.
- Risk tiers and the minimum assurance each tier requires.
- A named reviewer who can judge carve-outs, inherited controls and corrective action plans.
- Access to a results channel, such as a managed distribution platform or a secure document exchange, that your GRC or vendor risk tool can use.
The more precise these inputs are, the less back and forth you will have with the vendor.
Can we read HITRUST reports ourselves?
Yes, if the vendor gives you access to the letter or report and you have the expertise to read it. Your team should check the assessment type, validity dates, scope and facilities, domain scores, and any corrective action plans or gaps. The sharing and access controls are set by the certified organization, so the vendor decides how you receive the material. Your reviewers will need training on how to interpret scores and scope statements. If you lack that capacity, an outside reviewer can read the report for you, but that reviewer does not replace the independent assessor's work.
How often should we request updates from vendors?
Request updates on a schedule set by the vendor's risk tier and by the certification's validity period. Certifications are not permanent: e1 and i1 certifications last one year, and r2 certifications last two years with an interim assessment due in the 90 days before the first anniversary. Build checks around those dates and also ask for notice of significant changes, security incidents or changes to scope. Track corrective action plans until they are closed, because an open plan is a signal to ask questions even when the certification is current.
Is an e1 enough for a low-tier vendor?
It may be, depending on what the vendor handles and how your tiering model defines low risk. The e1 is the entry-level validated assessment and is built from a smaller set of requirement statements than the i1 or r2, so it gives less assurance. Confirm the vendor's data exposure, integration depth and contractual obligations before accepting it. Health3PT practices describe tiering and assurance expectations, so review how your tiering maps to assessment levels rather than assuming one level fits every low-tier vendor.
Can a vendor outsource its HITRUST assessment?
A vendor can use outside help to prepare, but the validated assessment itself must be performed by an authorized HITRUST External Assessor organization, and HITRUST performs central quality assurance before issuing reports. Vendors commonly outsource readiness work, evidence preparation, control implementation and remediation planning, while the assessor performs the validated testing. Ask the vendor which firms helped, confirm that the assessor is authorized through HITRUST's directory, and check that the consultant did not perform the independent assessment. Those roles should stay separate.
How DeployOpen supports vendors and buyers on HITRUST readiness
DeployOpen helps vendors get ready for a HITRUST assessment, and the work starts with a written scope. Before any engagement begins, the scope, deliverables and timeline are agreed in writing, so a vendor knows which services, environments and requirement areas the work covers. For a third-party risk program, that scope should match the service the vendor's customers actually buy. DeployOpen can implement, harden, back up and document self-hosted open-source platforms inside the client's own cloud accounts, data centers or air-gapped networks, and prepare the configurations, logs and records that an assessor will later sample. Those are the systems and evidence that carry the vendor's controls, so they are where readiness work concentrates.
DeployOpen does not issue HITRUST reports, letters or certifications. Only an Authorized HITRUST External Assessor performs the validated assessment, and HITRUST performs its own quality assurance before any results are issued. Buyers should therefore treat DeployOpen as an implementation partner, not as a source of assurance, and should confirm the assessor's authorization on HITRUST's Find an External Assessor page before relying on any report. Hiring DeployOpen does not guarantee a passing result, a particular score or a certification outcome, because the organization owns its controls and the assessor decides what the evidence supports. Vendors should ask any partner to state its role in writing, including what it will not do.
