How to review a vendor's HITRUST certification before you rely on it
A vendor says it is HITRUST certified, and your contract or customer requires it. Before you rely on that claim, you must confirm three things: the certification scope covers the service you are buying, the assessment type and validity are current, and the assessor that performed the validated assessment was authorized. The organization owns its controls, and the vendor owns its certification. Your job is to read the evidence the vendor holds, not to accept the logo on its website. Only HITRUST-authorized External Assessor organizations may perform the validated assessments submitted for certification, and HITRUST performs central quality assurance before it issues reports. Neither the vendor nor a consultant can issue the certification itself.
Start with validity. An e1 or i1 certification is valid for 12 months and an r2 for 24 months from the report date. Ask for the report date and the letter date, then calculate the expiry yourself. A vendor whose recertification fieldwork is not finished with a signed representation letter by expiry has a certification gap, and HITRUST never extends expiration dates. Also note that an assessor's validated fieldwork window is at most 90 days for e1, i1 and r2, so a report should describe a bounded testing period rather than a continuous one. If the vendor cannot show a current letter, treat the claim as unverified until it can. Confirm the assessor's status in HITRUST's directory of External Assessors, since organizations not listed there are not authorized to perform validated work.
Does the certified scope cover the service you are buying?
A HITRUST certification only covers what the certification letter names. Before you rely on a vendor's result, match the named services and facilities against the actual path your data takes, from the customer-facing component through the back end to where it is stored and processed.
Named facilities in the letter
The certification letter names the facilities included in the assessment. A facility that is not named is outside the certified scope, even if the vendor operates it. Compare every data center, office and hosting location in your data flow against that list. If a location that handles your data is missing, ask the vendor whether it was excluded and on what documented basis, and whether it appears in a later assessment.
Facilities the vendor does not control
In-scope facilities cannot include places that neither the organization nor its service providers control, such as an employee's home or a coworking office. If a vendor's staff process your data from those locations, the assessed scope does not describe that activity. Ask how remote access is restricted, which endpoints are managed, and whether any work happens outside controlled premises.
Back-end infrastructure versus customer apps
HITRUST can certify back-end infrastructure, but it cannot certify applications whose instances sit outside the entity's control, such as mobile apps running on a customer's device. A certified API platform does not make the app on a phone part of the certified scope. Identify which components of the service you use are in the assessed boundary and which are not, and ask how the uncovered parts are assured.
Cloud provider services versus the platform
A cloud provider certifies the services it offers, while each customer certifies the platform it operates on those services. A vendor running its application on a certified cloud service still needs its own assessment for the configuration, access and operations it controls. Check whether the vendor's letter lists the cloud services it runs on, and whether its own platform controls are in scope.
Matching scope to the data path
Draw the path your data takes: intake, storage, processing, backup, support access and deletion. Mark each hop against the named services and facilities in the letter. Any hop with no matching entry needs a documented explanation or a contractual control. This map is illustrative of the method, and it gives your third-party risk review a concrete basis for follow-up questions.
How carve-outs change what a certification proves
A carve-out changes what a HITRUST certification actually proves, so check it before you rely on the result. An r2 assessment accepts no carve-outs of third parties. An e1 or i1 can carve out a third party, but only if that third party's responsibilities are documented, the third party is removed from scoring entirely, and any requirement the third party fully owns is marked N/A with a rationale. The certified score therefore describes the vendor's own environment, and the carved-out function is not tested by the assessment at all. A clean letter does not mean the carved-out work was reviewed.
Ask the vendor for two things: the carve-out list naming each excluded third party, and the documented responsibilities for each one, including which requirements the vendor relies on that party to meet. Compare the N/A rationales against those responsibilities. A rationale that says a requirement is owned by a third party should point to a function you can name, not a general statement that a provider handles it. Confirm the carve-out list against the facilities and services named in the scope, since a function that appears in your purchase but not in the scope is a gap you need to close.
Map every carved-out function to your own third-party risk review. For each one, decide whether you need that party's own assurance, such as a report or certification covering the function you buy, and whether you will review it directly. Record the result as a finding in your vendor file. If a carved-out party handles data or operations central to your contract, treat the HITRUST letter as covering only the vendor's remaining environment and plan your due diligence on the carved-out part separately.
Is the assessment type right and is the certification still valid?
HITRUST offers validated assessments at three levels, and they are not interchangeable. The e1 is the lightest validated assessment, built on a smaller set of requirement statements. The i1 covers a broader baseline and is intended for organizations that need more assurance than the e1 provides. The r2 is the most comprehensive validated assessment and is tailored to the organization's risk factors and the requirements it must meet. Every e1 requirement appears in the i1, and every i1 requirement appears in the r2, so a higher level contains the lower one. Check which level the vendor holds before you compare results.
- e1 scope: a smaller requirement set, suited to a narrower or lower-risk service.
- i1 scope: a broader baseline, with a larger set of requirement statements than the e1.
- r2 scope: the most comprehensive validated assessment, tailored to the organization's risk profile.
- Mismatch check: a vendor holding an e1 may not meet a contract that requires an r2, even if its letter looks current.
- Ask for the level in writing: confirm the assessment type named in the certification letter, not only in the sales material.
Confirm the level against your contract requirement and the directory entry before accepting the letter.
A HITRUST certification has a fixed validity period that runs from the report date, not from the date the assessor finished fieldwork or the date the vendor announced the result. e1 and i1 certifications are valid for 12 months. r2 certifications are valid for 24 months. The clock is set by the report date printed on the certification, so read that date and calculate the expiry yourself rather than trusting a rounded or marketing description.
- e1 and i1 validity: 12 months from the report date.
- r2 validity: 24 months from the report date.
- Calculate expiry: add the validity period to the report date on the letter and compare it with today's date.
- Check the current letter: a vendor may hold an older certification that has already expired while a newer assessment is in progress.
- Confirm in the directory: verify status with the vendor and in the HITRUST directory, since a letter alone does not show whether the certification is still active.
If the calculated expiry falls before your next review, ask the vendor for the date of its planned recertification fieldwork.
An r2 certification runs for two years, but it is not a single event at the end of that period. HITRUST requires an interim assessment for an r2 certification, and it must be completed within the 90 days before the first anniversary of the report date. The interim assessment confirms that the controls behind the r2 still operate between full assessments. If the vendor has not completed the interim, the certification's ongoing status is in question even before the two-year mark arrives.
- Timing window: the interim assessment is due in the 90 days before the first anniversary of the report date.
- Purpose: it checks that the certified controls still operate, not only that they were true at the last full assessment.
- Evidence to request: the date of the most recent interim assessment and the status of the next one.
- Missed window: a vendor that misses the interim window has a gap risk that a two-year date alone does not show.
- Verify: confirm the interim with the vendor and in the directory before relying on the r2.
Ask for the interim assessment completion date and confirm whether it falls inside the required window.
A certification gap opens when recertification is not finished by the expiry date. For recertification to close the gap, the fieldwork must be complete and the entity must have signed its representation letter by the expiration date. If either step is missing when the certification expires, the entity is in a gap, and its prior certification no longer covers the service. HITRUST does not extend expiration dates, so a vendor cannot negotiate its way past the deadline. This is the point where a relying party must stop treating the old letter as current.
- Two conditions: recertification fieldwork and the signed representation letter must both be finished by expiry.
- No extensions: HITRUST never extends expiration dates.
- Gap effect: during a gap, the prior certification should not be presented as current.
- Ask directly: request the vendor's recertification timeline and whether fieldwork and the representation letter are on track.
- Contract response: decide in advance whether a gap triggers a review, a notice obligation or a remediation plan.
Confirm current status with the vendor and in the HITRUST directory on the day you rely on the certification, and record the date you checked.
What a validated-only report does not prove
A validated-only report shows that an assessment was completed but that scores missed the certification thresholds. The cards below cover what the report does and does not establish, and how the vendor's wording and your contract records should reflect that.
Completed assessment, not certification
A validated-only report confirms that an Authorized HITRUST External Assessor performed the validated assessment and that HITRUST reviewed it. It does not confirm that the entity met the certification thresholds, so it carries no certification status. Treat it as evidence of work performed and of the current control gaps, not as proof of a passing outcome.
Thresholds stated as not met
The report states that the certification thresholds were not met. Read the domain scores and the stated outcome before accepting any summary from the vendor. If a sales deck, security questionnaire or trust page omits this statement, ask the vendor to show the outcome section of the report itself.
Certified claims the vendor must not make
A vendor holding only a validated-only report may not describe itself as certified. Ask for the wording it uses in proposals, marketing materials and questionnaire answers. A claim of certification without a certification letter is a misstatement you should flag in due diligence and record in your file.
Contract language for the outcome
Write the contract to match the actual outcome. Require the vendor to state the assessment type, the report date and whether a certification letter was issued. Add a clause that obliges the vendor to notify you if the outcome changes, and do not accept "HITRUST validated" as a substitute for a certification commitment.
Procurement and risk file entries
Record the report type, the report date and the outcome in your third-party risk file, not a generic note that the vendor has HITRUST. Note any compensating controls or additional evidence you requested, such as a corrective action plan and its progress. This record shows auditors and approvers what you relied on when you accepted the vendor.
Reassessment and follow-up evidence
A validated-only outcome does not set a certification date, so there is no certification period to track. Ask the vendor when it plans a new validated assessment and what remediation it has completed since the last one. Diary a follow-up review to confirm whether the next outcome meets the thresholds.
How to check for suspension or revocation
This sequence confirms that a vendor's HITRUST certification is still in force, surfaces any event that pushed scores below thresholds, and establishes whether the vendor can still allow inheritance or claim certification. Each step produces a written record you can file with your third-party risk review.
Confirm the current certification status with the vendor
Ask the vendor in writing for its current HITRUST certification letter, the report date, the expiry date and the assessment type (e1, i1 or r2). Ask whether the certification is active today or whether any notice of suspension or revocation has been received from HITRUST. The vendor's answer, with the letter attached, is the baseline for every later step. Note the date the vendor gave the answer so you can show what you relied on.
Check the status directly with HITRUST
Do not rely only on the vendor's copy of the letter. Ask the vendor to confirm the assessment's status through HITRUST's own channels, and compare the report date, scope and expiry date against what the vendor sent you. Any mismatch in dates, scope or assessment type should be raised with the vendor before you rely on the certification. The file is complete when the status and the letter details match across both sources.
Ask whether any event lowered scores below thresholds
Ask the vendor directly whether any event has shown that scores fell below the certification thresholds, such as an incident, a failed interim check or an assessor finding. HITRUST may suspend or revoke certification when an event indicates this. Request a written answer that names each event, its date and the outcome. If the vendor reports no such event, record that statement and its date in your file.
Confirm what a suspended vendor may not do
If the vendor is suspended, HITRUST's rules bar it from allowing inheritance of its results and from saying it is certified. Ask the vendor to confirm in writing that it has stopped both, and check its customer-facing materials, contracts and trust pages for any statement that still claims certification. Any continued claim, or any inheritance still in use, should be escalated because it conflicts with the suspension. The step closes when the vendor confirms the restrictions in writing.
Record the revocation and the remediation path
If the certification has been revoked, record the revocation date and ask the vendor for its remediation plan. HITRUST allows a new validated assessment to begin 90 days after remediation, so ask when the vendor expects to start that assessment and what it has done to address the cause. Do not infer a timeline beyond this rule. The output is a dated record of the revocation, the remediation actions and the vendor's stated plan for a new validated assessment.
Decide whether to continue relying on the vendor
Compare the status checks, the event answer and any remediation record against your contract and your risk appetite. If the vendor is suspended or revoked, decide whether to pause inheritance of its results, request interim evidence or escalate the relationship under your third-party risk process. Document the decision, the reviewer and the date. The sequence is complete when the file shows a current status, a confirmed event answer and a recorded decision.
A review sequence for procurement and security teams
This sequence turns a vendor's HITRUST certification into a documented decision: whether the certified scope covers the service you buy, what it leaves out, and what you still need to ask for in the contract.
Request the letter and the validated report
Ask the vendor for the certification letter and the validated assessment report, not a logo, a summary slide or a verbal assurance. Confirm the report date, the assessment type and the organization named on both documents. Record the request, the date received and the files retained in the vendor file. The step is complete when you hold both documents and have confirmed they name the same entity and assessment.
Match scope and facilities to the service bought
Compare the systems, services, business units and facilities named in the scope against the service your organization is buying. Check the facilities listed in the certification letter and confirm none is a location the vendor and its service providers do not control. Note any gap, such as a product line or hosting region that is not in scope. The output is a scope match note stating which parts of the service the certification covers and which parts it does not.
Read carve-outs and N/A rationales
Identify every third party carved out of the assessment and every requirement marked not applicable. For each carve-out, confirm the vendor documented the third party's responsibilities and that the third party is removed from scoring. For each N/A, read the rationale and check it makes sense for the service you buy. Remember that r2 assessments do not accept carve-outs of third parties. The output is a carve-out list with the responsibilities you must cover through your own due diligence or contract terms.
Confirm assessment type and validity
Identify whether the assessment was an e1, i1 or r2 and confirm the certification is current on the date you review it. Under HITRUST's published rules, e1 and i1 certifications are valid for 12 months and r2 certifications for 24 months from the report date. Check whether a recertification or r2 interim assessment is underway, and ask the vendor for the expiry date in writing. The output is a validity note recording the assessment type, report date and expiry date.
Check for validated-only results and suspension history
Confirm the document is a certification and not a validated-only report. A validated-only report states the thresholds were not met and includes no certification letter, so it cannot support a claim of certification. Ask whether HITRUST has suspended or revoked the certification, or whether any event caused scores to fall below thresholds. A suspended entity may not allow inheritance or say it is certified. The output is a status note confirming the outcome and any history you need to follow up.
Verify the assessor is authorized
Confirm the external assessor that performed the validated assessment appears in HITRUST's Find an External Assessor directory. HITRUST states that organizations not listed there are not authorized to perform HITRUST readiness or assessment work. Use the directory's filters to confirm the assessor type and listing, and keep a dated screenshot or record of the search. The output is an assessor verification record, which you attach to the vendor file.
Record what you accepted and what the contract must add
Summarize the outcome of each step in one review record: the scope match, the carve-out list, the N/A rationales you accepted, the validity dates and the status history. For every gap or uncovered service, write the specific control, evidence or contract term you need, such as a notice obligation for suspension or a right to receive a refreshed letter at recertification. Have the security and procurement leads sign off. The review is complete when every gap has an owner and a contract clause or follow-up action attached.
What to write into the contract and monitor afterwards
A vendor's HITRUST certification is a point-in-time result that changes with suspensions, expirations, scope updates and reissued letters. The terms below make sure you hear about those changes and can act on them, while your own controls and risk decisions stay with your organization.
Notice of suspension or revocation
Ask the vendor to notify you promptly if HITRUST suspends or revokes its certification after an event shows scores below the certification thresholds. While a certification is suspended, the vendor may not allow inheritance or describe itself as certified, so any reliance you placed on it changes immediately. Write the notice obligation and the vendor's duty to stop representing certified status into the contract, and confirm the notice period with the vendor rather than assuming one.
Notice of a certification gap
A gap opens when recertification fieldwork is not finished, with a signed representation letter, by the expiry date, and HITRUST does not extend expiration dates. Require the vendor to tell you before a certification lapses so you are not learning about it from an expired letter. Record the expiry date from the letter in your vendor file and set your own reminder well before it.
Updates to carve-outs and facilities
Carve-outs and in-scope facilities can change between assessments, and each change alters what the certification covers. Ask the vendor to notify you of any new third party carved out, any carve-out removed, and any facility added or dropped from the certification letter. For an r2, confirm that no third party is carved out, since HITRUST accepts none in that assessment type.
Re-issued letters and report updates
Vendors sometimes reissue a letter or report after a correction, a scope change or a new version. Ask the vendor to send you each reissued document and compare its scope, facilities and dates with the version you hold. Keep a dated copy of every version you reviewed so you can show which one your decision relied on.
Next interim or recertification date
Record the next milestone that the vendor's certification cycle requires. For an r2, that is the interim assessment, which is due in the 90 days before the first anniversary. For an e1 or i1, it is recertification before expiry. Ask the vendor to confirm these dates in writing when the contract is renewed, and schedule your own review shortly after each one passes.
Your controls and the vendor's cycle
Your organization owns its controls, and a vendor's certification covers only the services and scope in its letter. Monitoring should follow the vendor's assessment cycle, with your review timed to each certification milestone and each notice you receive. Confirm with the vendor who will notify you, through what channel, and how you will check the certification status yourself before relying on the vendor's word.
Questions buyers ask when reviewing a HITRUST certification
Is a HITRUST e1 enough for a vendor that handles sensitive data?
An e1 can be enough only when the data sensitivity, contract terms and your own risk assessment say so, because the e1 is the lightest validated assessment and it is a narrower test than an i1 or r2. Start by asking which assessment the vendor holds and what scope it covers. The e1 is valid for 12 months, so check the report date. If the service handles high volumes of sensitive records or sits deep in your critical processes, ask whether the vendor can provide an i1 or r2 instead. Compare the assessment type against the data you will share, not against the label alone, and record the reasoning in your third-party file.
How long does a HITRUST review take, and what does it need from us?
The review time depends on how quickly the vendor provides the right documents and how much of the certification falls within your service. Your side needs a named reviewer, a list of the services you buy, and the data flows that connect them to the vendor. Expect to check the certification letter, the scope section, the facilities list, any carve-outs, the validity dates and the assessor's authorization. Because the timeline depends on the vendor's response speed and your internal approvals, ask the vendor for a documented schedule before you start. No duration is guaranteed by HITRUST, so confirm the expected turnaround in writing with the vendor.
Can we read the vendor's HITRUST report without an NDA?
Usually not directly, because the full report contains detailed control results that the vendor controls. Most vendors share results through their own process, which may include an NDA, a request form or a secure portal. Ask the vendor which version it will share and how access is granted. Some vendors use a controlled distribution channel that lets relying parties see results without receiving a full copy. Your contract should state what you may keep, who in your organization may read the report, and how long you may retain it. Confirm the sharing method with the vendor before you assume any particular access route.
What does a carve-out mean for our own third-party review?
A carve-out removes a third party from the vendor's assessment scoring, so its controls are not tested as part of the vendor's certification. For your review, this means you must assess that third party yourself or obtain its own evidence. Check whether the carve-out appears in the scope and whether the vendor documented the responsibilities it passed to the third party. In an r2, third parties cannot be carved out, so a carve-out is a signal to examine the assessment type closely. Map each carved-out party to a service you receive, then decide whether your own due diligence covers that gap.
Can an implementation partner check a vendor's HITRUST certification for us?
An implementation partner can help you read the documents and organize your questions, but it cannot confirm the certification or issue a report. Only an authorized HITRUST External Assessor and HITRUST's quality assurance process produce validated results and certification letters. DeployOpen prepares systems, controls and evidence for compliance assessments, and it does not issue audit reports, attestations or certifications. For verification, check the vendor's status with HITRUST and confirm the assessor's presence in the HITRUST directory. Treat any partner's review as analysis support, not as proof of certification.
What should we do if the vendor's HITRUST status is unclear?
Pause reliance on the certification until you have written confirmation of its status, and ask the vendor for the certification letter and report date. Check whether the certification is still valid, whether any recertification fieldwork is open, and whether a validated-only report was issued instead of a letter. Ask whether HITRUST has suspended or revoked the certification after a reported event. A suspended entity may not allow inheritance or claim certification, so the vendor should not present that status as current. If the answer stays unclear, request a corrective action plan, document the gap and apply your own compensating due diligence until the status is resolved.
Where DeployOpen fits when you are the vendor or the buyer
If you are a vendor preparing for a HITRUST validated assessment, DeployOpen can help with the work that comes before the assessor arrives. DeployOpen plans, implements and hardens self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks, and it can prepare the configurations, logs, backups, documentation and other evidence that your controls produce. That evidence work is where the engagement sits. DeployOpen does not own your controls, does not decide whether a requirement is met, and does not issue reports or letters. Only an Authorized HITRUST External Assessor performs the validated assessment, and HITRUST performs quality assurance before it issues a report. Confirm the assessor's status in HITRUST's directory before you sign anything, and agree the evidence scope with both DeployOpen and the assessor in writing.
If you are a buyer reviewing a vendor's HITRUST letter, you do not need DeployOpen to validate it. The checks that matter are the ones described above: whether the in-scope facilities and services include the service you purchase, whether any third party was carved out, whether the letter is a certification or a validated-only report, and whether the certification is still within its validity period. Those checks rely on the vendor's documents and HITRUST's own records, not on any implementation partner. If a vendor says that DeployOpen assisted with its environment, treat that as a fact about preparation, not as evidence of certification.
No outcome is guaranteed. Preparation work does not ensure that a vendor will meet the certification thresholds, and an assessment can still result in a validated-only report or a gap. Ask any partner, DeployOpen included, to describe what it will deliver and what it will not control, and keep the two roles separate in your contracts and your third-party risk file.
How DeployOpen prepares systems and evidence for a HITRUST assessment
DeployOpen works on the systems and evidence behind a vendor's HITRUST certification, so that a buyer's review can check scope, carve-outs, validity and assessor authorization against documents the vendor can produce. We prepare and document the environment inside the client's own infrastructure, while the organization owns its controls and only an authorized External Assessor issues the report.
How we scope
- We confirm which services, facilities and hosting environments the vendor's certification scope names, and which ones it leaves out.
- We map each third party to documented responsibilities so carve-out and inheritance statements can be traced to written evidence.
- Engagements are fixed-scope, with scope and deliverables agreed in writing before any work starts.
How we build
- We prepare self-hosted open-source platforms in the client's own cloud accounts, data centers or air-gapped networks, with configuration kept under version control.
- We organize access, logging and change records so a reviewer can trace each control to a dated, retrievable artifact.
- We flag gaps where a control has no system-level evidence, so the vendor can close them or disclose them before a buyer asks.
How we hand over
- We document the scope boundary, control ownership and evidence index in a form a buyer's security team can read.
- We record certification dates, the validity window and the recertification plan so the vendor can show when its status must be renewed.
- Testing results and remediation records are delivered to the client, who decides what to share and with whom.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the fixed-scope work closes.
- We can help update the scope and evidence index when the vendor changes services, facilities or subservice providers.
- Confirm with your assessor or HITRUST directly which reports and letters you should request from a vendor before relying on them.
