How do you read a HITRUST certification report?
Start with the certification letter, not the report. The letter names the scope of the assessment, the facilities inside it, the assessment type and the validity period. Those four details decide whether the certification covers the service you are buying. Only after you have confirmed them should you read the domain results and any corrective action plans, because a strong score for a system outside your service tells you nothing about the one you depend on. A certified entity receives the full report plus two copies of the letter: one that includes the scope and one that contains only the letter, so the organization can share just what each relying party needs. If you receive only a report with no letter, or a report that states the thresholds were not met, you are holding a validated-only result and no certification exists.
Read the scope against your use case. Ask which systems, applications, data flows and facilities the vendor's service depends on, then confirm each one appears in scope. Facilities must be places the organization or its service providers control, so an in-scope location that is an employee's home or a shared office should prompt a question. Check whether the certified entity is the organization you contract with or a related company, and whether a cloud provider's controls are inherited or carved out. For each open question, ask the vendor to confirm it in writing rather than relying on the letter's summary. Confirm too that the assessment was performed by an Authorized HITRUST External Assessor, since only that route leads to a certification issued by HITRUST.
Then read the results with the vendor's own corrective action plans in view. Each domain is scored against a threshold, and shortfalls appear either as corrective action plans, which the organization owes a plan to close, or as gaps, which carry less weight in the certification. Ask for the plans, their owners and their target dates, and decide whether any open item affects your data or your service. Revalidate the letter's validity period and any r2 interim assessment timing, and check whether a security event affecting the assessed environment could lead HITRUST to investigate and revoke the certification. Your reading changes with your role: a customer buying a narrow service needs a tight scope match, a regulated bank may need the full corrective action picture, and a health system managing many vendors needs a repeatable intake checklist.
What is inside a HITRUST report and its two letters
A HITRUST assessment produces one full report and two letter versions, each built for a different reader. Together they let the certified entity show a relying party what it needs to see without exposing the full assessment.
The full certification report
The full report is the complete record of the validated assessment, including scope, scoring by assessment domain, and the results behind the certification decision. The certified entity holds it and decides who receives it. Read it for the assessment type, the assessment date range, and whether the certification thresholds were met. Relying parties rarely need every page, but they should know it exists and that it is the source for the letters.
The letter with the assessment scope
This letter names the systems, services, and facilities covered by the assessment, along with the certification status. It is the version a relying party needs to confirm that the service it buys falls inside the assessed environment. Check that the named services match your contract, and that any excluded components are listed as carve-outs rather than silently omitted.
The letter with only the certification
This letter states the certification and its validity period without the scope details. The certified entity can share it widely with prospects and customers who only need to confirm that an assessment was passed. It does not show what was tested, so it cannot answer whether a specific service is covered. Ask for the scoped letter when that question matters.
Named in-scope facilities
The facilities listed in the scoped letter are places the organization or its service providers control. A reader should confirm that every site handling its data appears on the list. Employee homes and coworking offices cannot be in scope, so their absence is expected, but a data center missing from the list is a question to raise before relying on the certification.
Domain scores across 19 domains
The report scores the assessment across 19 assessment domains, from 01 Information Protection Program to 19 Data Protection & Privacy. Each domain is compared with a threshold, so a single weak domain can block certification even when the overall picture looks strong. Check every domain score, not only the headline result, and note which domains rely on inherited controls.
Corrective action plans and gaps
Where a requirement falls short, the report separates corrective action plans from gaps. A corrective action plan is a documented commitment to fix a shortfall, while a gap is a shortfall that does not require one under the scoring rules. Read these entries closely: they show what the organization knows is still weak and whether it has a dated plan to address it.
Does the HITRUST report scope cover the service you buy?
Test scope before you read a single score. A HITRUST report can show strong domain results and still tell you nothing useful if the systems, services or facilities it covers are not the ones your vendor uses to serve you. Start with the certification letter that names the scope of the assessment, and match each system, service and location it lists against the service you plan to buy. Confirm the assessment type (e1, i1 or r2) and check the organization's stated boundaries, meaning what it says is inside its environment and what it says is outside. A high score on a boundary that excludes your data path does not answer your risk question.
Check the facilities list closely. The facilities in an assessment's scope are named in the certification letter, and an in-scope facility must be a place the organization or its service providers control. Employee homes and coworking offices cannot be in scope, so if you see a remote-work arrangement described as covered, ask how the organization controls those locations and whether that control is what the assessor tested. If a facility you expect is missing, ask whether it was excluded deliberately, whether it sits under a service provider's assessment, or whether it was never part of the boundary. Each answer leads to a different next step.
Look for carve-outs. A third party that performs part of the service may be excluded from the assessed environment, and the report will not test its controls. Ask the vendor to name every carve-out, the function it performs, and whether that provider holds its own HITRUST or other independent assurance report covering the relevant service. Record the answers in your file before you move to domain scores, because a passing result says nothing about a component the assessor never examined. If the carve-out sits on your data path, treat it as an open scope question for the vendor rather than a detail to resolve later.
What the domain scores must reach to pass a HITRUST assessment
This table compares the three validated HITRUST assessments by what each one scores and the average each domain must reach to pass. Read it alongside your report: a domain can clear its threshold and still carry corrective action plans or gaps for individual requirements.
| Assessment | What is scored | Domain average needed to pass | What the reader should check |
|---|---|---|---|
| e1 | Implemented maturity level for each requirement | Core statements in each domain must average at least 83 | Whether any domain passed narrowly, and which core requirements sit below fully compliant with control references averaging below 80 |
| i1 | Implemented maturity level for each requirement | Core statements in each domain must average at least 83 | The same domain averages and corrective action plans, plus whether the scope and facilities match the service being bought |
| r2 | Policy, procedure and implementation maturity for each requirement | Each domain must average at least 62 | Per-requirement scores against the 71 corrective action plan threshold, and any shortfalls recorded as gaps even where the domain passed |
How corrective action plans and gaps differ for e1, i1 and r2
The e1 and i1 assessments score the Implemented maturity level, so the question an assessor asks of each core requirement is whether the control is in place and operating. When a core requirement falls short of fully compliant, HITRUST looks at the average score of the control references behind it. If that average is below 80, the shortfall needs a corrective action plan (CAP). If the average is 80 or higher, the shortfall is recorded as a gap instead. The split matters because a gap is a documented weakness that does not carry a remediation obligation in the report, while a CAP is the organization's own commitment to fix a specific weakness.
- Test for a CAP: the core requirement must score below fully compliant and its control reference average must be below 80.
- Test for a gap: the core requirement falls short, but the control reference average is 80 or higher.
- Who writes the CAP: the certified organization writes it. The assessor records it and does not assess how well the plan is being carried out.
- Reading the domain: check whether the domain average still clears the e1 or i1 threshold, because a domain can carry several CAPs and gaps and still be scored in the report.
- Questions to ask: which core requirements have open CAPs, what the target dates are, who owns each item, and whether any CAP covers a system that is inside the scope you are buying.
A CAP is the organization's plan, not the assessor's opinion on remediation progress. Confirm with the certified entity how each open CAP has moved since the report was issued, and ask for the evidence it has collected, not only the original plan.
The r2 assessment scores policy, procedure and implementation maturity, so a shortfall can come from a missing policy, an undocumented procedure or an implementation gap. The CAP test is different from the e1 and i1 test. A CAP is required when a requirement scores below 71, its Implemented level is below fully compliant, and its control reference is required for certification and averages below 71. Shortfalls that do not meet all of those conditions are recorded as gaps. Because the test has three parts, a requirement that scores low but is not required for certification may appear as a gap rather than a CAP.
- Three conditions for a CAP: the requirement score is below 71, the Implemented level is below fully compliant, and the control reference is required for certification and averages below 71.
- Gaps elsewhere: any other shortfall is recorded as a gap, including shortfalls on references that are not required for certification.
- Check the Implemented level: a requirement can meet the score test but still need a CAP if its implementation is not fully compliant, so read the maturity columns, not only the total.
- Interim assessment link: r2 certifications run two years with an interim assessment due in the 90 days before the first anniversary, so open CAPs are a normal point to check at that stage.
- Questions to ask: which requirements sit under the 71 threshold, which of those are CAPs and which are gaps, and whether the policy or the implementation is the weak element.
A CAP is the organization's plan, not the assessor's opinion on remediation progress. Ask the certified entity to show what has changed in each implementation since the assessment, and confirm whether the r2 interim assessment has already tested those changes.
The same shortfall can be treated differently depending on the assessment type. An e1 or i1 requirement with a control reference average of 80 is a gap, while an r2 requirement with a reference average of 75 may also be a gap, and a reference average below 71 on a required reference is a CAP. Readers comparing two vendors should therefore never equate a CAP in one report with a CAP in another without first checking the assessment type and the thresholds that applied.
- Different thresholds: the e1 and i1 use 80 on the control reference average, while the r2 uses 71 on the score and on the reference average.
- Different scoring models: the e1 and i1 score Implemented maturity, while the r2 scores policy, procedure and implementation maturity.
- Different counting: a CAP is a distinct item in the report, so count CAPs and gaps separately rather than adding them into one total.
- Same owner: in both models the organization owns the CAP and its evidence, and the assessor does not monitor the work.
- Questions to ask: which assessment type the report covers, whether the report is a validated-only result, and whether the open items were reviewed against the thresholds that apply to that type.
Before relying on any open item, confirm the assessment type on the certification letter and the report, because the same label can carry different meaning across e1, i1 and r2.
What a validated-only report and a revoked certification mean
A validated-only report means the assessment did not meet the certification thresholds. HITRUST issues it in place of a certification, it states that the thresholds were not met, and it includes no certification letter. If a vendor hands you a validated report and describes the vendor as HITRUST certified, that claim is wrong. Check the document for the certification letter before you accept any statement about certified status. A validated-only result still tells you the assessment was performed by an authorized External Assessor and reviewed by HITRUST, so it can inform your risk review, but it does not give you the assurance a certification letter carries. Ask the vendor what the failed thresholds were and whether a new assessment is planned.
Certification can also be revoked. HITRUST certification letters state that HITRUST may investigate and revoke a certification if a security event results in unauthorized access to the assessed environment. A letter dated in the past therefore does not prove the environment is still certified today. Ask the vendor directly whether any investigation or revocation has occurred or is open, and whether it has had a security event involving unauthorized access since the assessment. Then confirm the current status with HITRUST rather than relying on the vendor's word or on the letter alone, because the letter cannot show events that happened after it was issued. Record the date of your check and the answer in your vendor file, and set a reminder to repeat it before any renewal or interim assessment falls due.
How to verify a HITRUST certification before you rely on it
This sequence walks a relying party from the certification letter to the underlying results, so you confirm what was assessed, whether it still holds, and whether it can be trusted before you accept it as evidence for a vendor decision.
Start from the certification letter and its scope
Ask the vendor for the certification letter that carries the scope of the assessment, not only the letter without scope. The scope names the systems, the facilities and the services covered, and the facilities listed must be places the organization or its service providers control. Check that the assessed entity name matches the contracting entity you are buying from. You know this step is complete when you can list, in your own file, the in-scope facilities and the services they support.
Confirm the assessment type and service coverage
Identify whether the vendor holds an e1, i1 or r2 validated assessment, since each one covers a different depth of control testing. Then compare the scope against the service you are buying. If the product, a hosting region, a subsidiary or a key subprocessor sits outside the scope, the certification does not speak to that part of the risk. Record any gap and decide whether you need supplementary evidence, such as a separate assessment or a SOC 2 report covering that component. The output is a short note stating which services the certification covers and which it does not.
Check validity against the assessment date
Compare the certification date with today. e1 and i1 certifications last one year, and r2 certifications last two years, with an r2 interim assessment due in the 90 days before the first anniversary. A certification that has lapsed, or an r2 that is due for its interim and has not been updated, should be treated as expired for procurement purposes until the vendor provides current documentation. Ask for the date of the most recent interim assessment where one applies. You know this step is done when you have recorded the expiry date and the next required milestone.
Read the domain results and open corrective action plans
Open the full report, not only the letter, and review the scores for each of the 19 assessment domains against the certification thresholds. Note any corrective action plans (CAPs) and gaps, since a CAP means a control reference is being fixed on a documented timeline, while a gap is a shortfall recorded without a CAP. Ask the vendor for the current status of each open CAP and whether any domain relevant to your data flows is weak. The output is a list of open items with their owners and status that you can weigh in your risk decision.
Confirm the assessor was authorized
Verify that the assessor who performed the validated assessment was an Authorized HITRUST External Assessor organization. Only these firms may perform validated assessments submitted for certification, and HITRUST performs quality assurance before it issues reports. Check the assessor's name against HITRUST's directory of authorized assessors, and ask the vendor to name the assessor on the report. If the report is a validated-only report, it states that the thresholds were not met and includes no certification letter, so it cannot be used as proof of certification. You know this step is complete when the assessor's authorization is confirmed and recorded.
Ask about revocation and security events
Ask the vendor whether it has experienced any security event since the assessment that resulted in unauthorized access to the assessed environment. HITRUST certification letters state that HITRUST may investigate and revoke a certification in that situation, so a recent event can change the status of the certification before its expiry date. Request written confirmation of the current status and any notifications the vendor has made to HITRUST. The output is a dated written statement that the certification remains in good standing, or a clear explanation if it does not.
Where readers misread a HITRUST report
A HITRUST report and letter carry several distinct signals about scope, result and status. Readers who skim one of them, or assume the others follow from it, end up relying on a certification that does not cover the service they buy. Each card below names one misreading, the correct reading and the question to put to the vendor.
Validated-only report treated as certified
A validated-only report means the assessment did not meet the certification thresholds. HITRUST issues it without a certification letter, and it says so in plain terms. Reading it as a certification because an assessment was completed is a common and serious error. Ask the vendor for the certification letter itself, and confirm the report states that certification was issued.
Letter read without its scope
The certification letter is the document that names the facilities and scope covered by the assessment. A letter without its scope attachment tells you a certification exists but not what it covers. Check that the named facilities and services match the environment that will hold your data. Ask the vendor for the scoped version of the letter, not only the short form.
High overall result hides failing domains
A strong overall score does not mean every domain passes. Each of the 19 assessment domains is scored against its own threshold, so one weak domain can sit beside strong ones. Review the domain-level scores and compare them against the minimums for the assessment type. Ask the vendor which domains scored closest to the threshold and why.
Open corrective action plans ignored
A corrective action plan records a requirement that fell short and the plan to fix it. An open plan means a known weakness remains in the environment, even when the certification is valid. Shortfalls recorded only as gaps carry their own risk. Ask the vendor for the list of open corrective action plans, their target dates and what evidence will close them.
Interim-dependent or expired status taken as current
An e1 or i1 certification lasts one year. An r2 certification lasts two years and depends on an interim assessment due in the 90 days before the first anniversary. A certificate whose validity has passed, or an r2 whose interim assessment has not been completed, is not current. Check the validity dates on the letter and ask the vendor when the next assessment is scheduled and who performs it.
Inheritance treated as full coverage
Inherited results only cover the controls the vendor's own assessment included. Carve-outs, and controls the vendor delegated to a provider without reuse, fall outside what the certification proves. The inheritance statement and shared responsibility matrix show where the boundary sits. Ask the vendor which controls were carved out, which ones you must cover yourself, and whether the carved-out providers are themselves certified.
Questions buyers ask when reading a HITRUST report
Who issues a HITRUST report, and can our vendor write it themselves?
Only an Authorized HITRUST External Assessor can perform the validated assessment that gets submitted for certification, and HITRUST performs central quality assurance before it issues the report. The organization being assessed owns its controls and can prepare evidence, but it cannot issue the report or the certification letter itself. Consultants can prepare the environment and evidence, yet they do not sign the outcome. When you review a vendor's result, check that the assessor is on HITRUST's list of authorized External Assessors and that the report carries HITRUST's issuance, not just the vendor's own summary. The HITRUST assessments and certifications page describes the assessment types you may encounter.
How long is a HITRUST certification report valid?
Validity depends on the assessment type. e1 and i1 certifications last one year, and r2 certifications last two years, with an r2 interim assessment due in the 90 days before the first anniversary. A report is a snapshot of the environment, scope and CSF version assessed at that time, so a certification that is still in date can still be out of step with a vendor's current systems. Check the issue date, the expiration date, any interim assessment status, and whether significant changes have occurred since the assessment. Ask the vendor for its current status in the HITRUST system rather than relying on an older PDF.
What should we request if the scope letter is missing?
A certified entity receives the certification report plus two letter versions: one that includes the scope of the assessment and one that states only the certification. If you received only the short letter, ask the vendor for the scoped letter before you rely on the result. Without it, you cannot confirm which facilities, systems and services the certification covers. Request the scoped letter, the list of named facilities, and a written statement of which of your purchased services fall inside the scope. Facilities that are not in the scope, and any carve-outs, need to be understood before you decide whether the certification answers your risk questions.
Does a corrective action plan mean the vendor failed its assessment?
No. A corrective action plan (CAP) is a documented plan for specific requirements that scored below the threshold, and it is not automatically a failure. Under the HITRUST Assessment Handbook, e1 and i1 assessments require a CAP for each core requirement that falls short and whose control reference averages below 80, while shortfalls at 80 or above are recorded as gaps. r2 assessments apply a similar split at 71. Read the CAP to see which requirements are open, what the vendor plans to do, and the target dates it has committed to. The more useful question is whether the open items touch the data or services you depend on, and whether the vendor updates you as work closes. The HITRUST Assessment Handbook sets out the scoring rules.
How do we read a validated-only result?
A validated-only report means the assessment was completed but did not meet the certification thresholds. HITRUST issues it with a statement that the thresholds were not met, and it includes no certification letter. Treat it as evidence that the assessment took place, not as a certified result. Review which domains fell short, what the gaps and CAP items are, and whether the vendor has a credible plan and timeline to reach the thresholds on a later assessment. Do not describe a validated-only vendor as certified in your own vendor records, customer statements or contracts, because the certification claim is what the letter provides.
Can we review a vendor's HITRUST report without signing a non-disclosure step?
The certified entity controls who receives its report, so you should expect to go through the vendor's sharing process, which may include a non-disclosure agreement or access through the vendor's chosen channel. HITRUST's certification materials give the entity two letter versions so it can share only what each relying party needs, and the scoped letter is the version most relying parties need for their review. Ask the vendor which version it will provide and how access is granted. Do not treat a summary slide or a marketing statement as a substitute for the report itself.
How much internal effort does reviewing a HITRUST report take?
The effort depends on how many services you rely on, how many of the assessment domains touch your data, and how complete the vendor's documents are. A single-service vendor with a current scoped letter and no open CAP items is a short review. A platform with several in-scope services, carve-outs, inherited controls, and a long CAP list needs more time to map the scope against your contract, confirm the assessor and validity dates, and log open items for follow-up. Plan for one reviewer who understands the service, one who handles third-party risk, and a standing process to track CAP updates. Your internal effort is recurring, because you must recheck the status at each renewal and interim assessment.
Can DeployOpen issue or check a HITRUST report for us?
No. DeployOpen plans, implements, hardens and documents self-hosted open-source platforms in a client's own infrastructure, and it can prepare systems and evidence for a HITRUST assessment. It does not issue HITRUST reports, letters or certifications. Only an authorized External Assessor can perform the validated assessment, and HITRUST issues the outcome. If you run your own platform, DeployOpen can help you organize the evidence and scope so that an independent assessor can test it, but the organization keeps ownership of its controls and the certification decision remains with HITRUST and the assessor.
How DeployOpen prepares evidence for a HITRUST assessment
DeployOpen works on the systems and evidence behind a HITRUST report, not on the report itself. We prepare the self-hosted open-source platforms and documentation that an authorized external assessor will examine, while the organization owns its controls and the assessor issues any results. Engagements are fixed-scope, with the scope agreed in writing before work starts.
How we scope
- We agree in writing which systems, facilities and services fall within the assessment scope before work starts.
- We confirm that every in-scope facility is one the organization or its service providers control.
- We map the agreed scope to the assessment type and the domains it will be scored against, and record what each domain depends on.
How we build
- We configure self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks to meet the agreed requirements.
- We document how each platform's controls operate, so an assessor can trace a requirement to a configuration and an owner.
- We test the controls we built and record the results, so gaps are found and documented before fieldwork begins.
How we hand over
- We deliver the configuration records, evidence collections and control documentation in a format your assessor can review directly.
- We hand over a gap and corrective action register that states what is open, who owns it and what evidence will close it.
- We give your team the runbooks needed to keep evidence current after handover, since the organization remains responsible for its controls.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, agreed separately from the fixed-scope work.
- We can support your team through the assessor's requests for clarification, while the assessor decides what it accepts.
- Ask us to confirm in writing which deliverables are included, what is excluded and how changes to scope are priced before you sign.
