Which to pursue first: HIPAA compliance or a HITRUST certification
If you are a covered entity or business associate, the answer is almost always the same: build the HIPAA Security Rule program first. HIPAA compliance is mandatory, and it comes with no certificate. HITRUST is voluntary and certifiable, and it is usually requested by customers rather than by regulators. Your customers may ask for a HITRUST e1, i1 or r2 report, but none of those reports replaces the obligations under 45 CFR Part 164 Subpart C. The HHS FAQ on certifications states that HHS does not endorse or recognize private certifications, and that a third-party certification does not prevent HHS from later finding a security violation. A certificate is evidence you can show a customer, not a defense you can raise with OCR.
A HITRUST certification is worth pursuing when a contract or due diligence process makes it a condition of doing business. Check the actual requirement before you commit: ask the customer which assessment level they accept (e1, i1 or r2), whether an Insights Report mapped to HIPAA would satisfy them, and how recent the report must be. Those answers decide whether the effort is justified. Certification is probably not worth the cost if no customer asks for it, if your HIPAA program has open gaps in risk analysis or risk management, or if your current work with customers can be met with a documented HIPAA assessment and a mapped report. Build the HIPAA controls first, because a HITRUST assessment tests the same underlying practices and an immature program will fail it regardless of the framework label.
Plan the sequence so that HIPAA work counts toward HITRUST rather than being repeated. Start with the risk analysis and the documentation required under 45 CFR 164.316, then map your existing safeguards to the HITRUST CSF before you contract an External Assessor. Confirm with the assessor and the customer the assessment type, the validity period and the interim requirements, since certifications expire and must be maintained. Ask every quote for the fieldwork scope, the number of control specifications in scope, the evidence each one needs, and what remediation is excluded. Those items, not the certification label, determine the true cost of the program.
How HIPAA and HITRUST differ on scope, proof and validity
This table sets the HIPAA Security Rule beside the HITRUST CSF on who requires each, how each is structured, what proof it produces, how long that proof lasts and who enforces it. Read it as two different kinds of obligation: one is law, the other is a certifiable framework that customers may ask for.
| Dimension | HIPAA Security Rule | HITRUST CSF |
|---|---|---|
| Who requires it | Covered entities and business associates handling electronic protected health information under 45 CFR 164.302 | No legal requirement. Organizations adopt it when customers, partners or internal policy ask for it |
| Structure | 18 standards and 36 implementation specifications across administrative, physical and technical safeguards, plus organizational and documentation standards; 14 specifications are required and 22 addressable | 14 control categories, 49 control objectives and 156 control specifications, scored across 19 assessment domains |
| Proof produced | No certificate exists. Covered entities keep their own risk analysis, policies and documentation, which HHS does not endorse or recognize as certification | An e1, i1 or r2 certification issued after an Authorized HITRUST External Assessor completes a validated assessment and HITRUST performs quality assurance |
| Validity | Not applicable. Compliance is continuous and is judged on the facts at the time of an investigation or audit | e1 and i1 certifications last one year. r2 certifications last two years, with an interim assessment due in the 90 days before the first anniversary |
| Enforcement and consequences | OCR investigations, compliance reviews and audits, with civil money penalties; a third-party certification does not stop HHS from finding a violation | Customer contracts, procurement reviews and vendor risk programs. A certification is a contractual and reputational signal, not a regulator finding |
| Recognized practices | Under the 2021 HITECH amendment, OCR considers whether recognized security practices were in place for the prior 12 months | Not a recognized security practice designation. Confirm current treatment with HHS guidance and counsel |
| Pending change | HHS proposed a major Security Rule revision on 6 January 2025 (90 FR 898). As of October 2026, no final rule has been published | Versioned and updated by HITRUST. Current version is v11.9.0, available from 24 September 2026 |
Why HIPAA has no certificate and what OCR looks at instead
There is no HIPAA certificate, and that is the first thing a HITRUST buyer should understand. HHS states in its HHS FAQ 2003 that no Security Rule standard requires an entity to certify compliance, that HHS does not endorse or recognize private organizations' certifications, and that a third-party certification does not stop HHS from later finding a violation. A HITRUST certificate therefore cannot be presented to OCR as proof that the Security Rule is met. What OCR examines is the entity's own risk analysis, its decisions and its documentation, so the practical question is whether your evidence would hold up in an OCR review of your ePHI environment.
Much of that judgment sits in the addressable specifications. Under 45 CFR 164.306(d), for each addressable implementation specification the entity must assess whether it is reasonable and appropriate. If it is not, the entity must document why and implement an equivalent alternative measure where that is reasonable and appropriate. Each addressable decision is a documented choice that an assessor or OCR investigator can test. OCR enforces through complaint investigations, compliance reviews and audits, and its 2024 to 2025 HIPAA audits review 50 covered entities' and business associates' compliance with provisions most relevant to hacking and ransomware. Under the 2021 HITECH amendment on recognized security practices, OCR must consider whether the entity had such practices in place for the prior 12 months when it applies certain enforcement and audit activities, so a documented, operating program matters at least as much as its label.
Exposure is set by the penalty tiers, not by a certificate. For penalties assessed on or after January 28, 2026, the inflation-adjusted civil money penalty under 45 CFR 102.3 ranges from $145 per violation (no knowledge) to $2,190,294 per violation (uncorrected willful neglect), with a calendar-year cap of $2,190,294. Confirm the current table in the eCFR before you cite it in a board paper. Also note that NIST SP 800-66 Rev. 2, published in February 2024, maps key activities and sample questions to each standard, but HHS lists it as informational rather than legally binding. Use it to structure your evidence, and treat HITRUST scoring as a separate, optional assurance layer.
Choosing e1, i1 or r2 for a HITRUST assessment
HITRUST offers three certification levels that share one requirement baseline. Each level adds scope and assurance, so the choice depends on your data sensitivity, system risk and how much assurance your customers expect. Confirm the current baseline in MyCSF before scoping any of them.
e1 for lower-risk organizations
The e1 suits startups and lower-risk organizations that need a certifiable starting point. HITRUST cites an average of about 30 days for e1 certification, though the figure depends on readiness. The certification lasts one year. For a HIPAA vs HITRUST decision, check whether your business associate customers accept an e1 as evidence, since HHS does not recognize any private certification as proof of Security Rule compliance.
i1 for maturing programs
The i1 fits maturing programs that need moderate assurance and have a control environment ready for a more detailed assessment. HITRUST cites 6 to 12 months for most i1 certifications, depending on readiness. Because every e1 requirement sits in the i1, a team that has already certified at e1 carries its evidence forward rather than starting over. Confirm with your assessor which controls are inherited from cloud or hosting providers.
r2 for sensitive data and high-risk systems
The r2 targets organizations handling highly sensitive data or operating high-risk systems, where customers or regulators expect the deepest validated assessment. Every i1 requirement sits in the r2 baseline. An r2 certification lasts two years, and an interim assessment is due in the 90 days before the first anniversary. Plan that interim assessment into budget and staffing from the start.
The e1, i1 and r2 portfolio
The three levels form a traversable portfolio: every e1 requirement is in the i1 baseline, and every i1 requirement is in the r2 baseline. In v11.9.0, the e1 has 44 requirement statements and the i1 has 182. Starting at e1 and moving up therefore reuses existing evidence, which is useful when the first certification is a stepping stone rather than the end goal.
Confirm the baseline in MyCSF
Requirement counts, e1 and i1 baselines and mapping content change between CSF versions. Before scoping, confirm which CSF version and baseline apply to your assessment in MyCSF, and ask your External Assessor to confirm the same. Only Authorized HITRUST External Assessor organizations perform validated assessments submitted for certification, so verify the assessor's status too.
Certification is not HIPAA compliance
A HITRUST certification shows a validated assessment against a specific baseline, but it does not replace the Security Rule's own obligations. HHS states that private certifications do not relieve covered entities of their legal obligations and do not prevent HHS from later finding a violation. Use the level you choose as evidence for customers and as a structured control set, while keeping your own Security Rule risk analysis and documentation current.
Who assesses each and what each produces
This table sets the HIPAA Security Rule, which has no certifying body, against HITRUST, which issues validated certifications through authorized assessors. Read it to see who checks the work, what document results, and how long that document stays valid.
| Question | HIPAA Security Rule | HITRUST CSF (e1, i1, r2) |
|---|---|---|
| Who assesses compliance | No certifying body. The covered entity or business associate documents its own compliance, and HHS does not endorse or recognize private certifications. | Only Authorized HITRUST External Assessor organizations perform the validated assessment submitted for certification. |
| Quality control on the result | No external review step is defined. OCR reviews compliance only when it investigates, audits or receives a complaint. | HITRUST performs central quality assurance before it issues the report. |
| What the output is | No certificate exists. Evidence is the entity's own risk analysis, policies, risk management records and documentation under 164.316. | A HITRUST certification. Validity is one year for e1 and i1, and two years for r2. |
| Fieldwork window | Not applicable. There is no assessment event to schedule. | The assessor's validated fieldwork window is at most 90 days for e1, i1 and r2. |
| Renewal and interim checks | Continuous obligation. Documentation must be kept current and made available to OCR on request. | e1 and i1 are renewed annually. r2 requires an interim assessment due in the 90 days before the first anniversary. |
| Effect of a certification on regulator findings | A third-party certification does not stop HHS from later finding a Security Rule violation. | Certification does not prevent HHS from later finding a violation. Confirm with your assessor and counsel how it will be presented to OCR. |
| What to confirm with an assessor | Ask which e1, i1 or r2 baseline maps to your ePHI systems and whether a HITRUST Insights Report would map results to HIPAA. | Confirm the assessment type, the current CSF version in MyCSF, the scope and inheritance from cloud or hosting providers, and the certification's expiry date. |
Doing HIPAA first, then HITRUST, with shared evidence
This sequence builds a HIPAA program that serves as the legal record first, then maps those same controls and evidence into HITRUST so that one body of work supports both the regulatory position and any certification a customer requests.
Complete the HIPAA risk analysis and documentation
The covered entity or business associate completes its risk analysis and the documentation required by the Security Rule for electronic protected health information, covering the administrative, physical and technical safeguards in Appendix A to Subpart C of Part 164 and the organizational and documentation standards in sections 164.314 and 164.316. Each addressable specification needs a recorded decision on whether it is reasonable and appropriate, and any equivalent alternative must be documented. The step closes when the risk analysis, risk management decisions and policies are approved and dated. Keep these records as the legal record, since HHS states that no Security Rule standard requires certification and that private certifications do not relieve legal obligations.
Map existing controls to HITRUST
Map the HIPAA-driven controls onto the HITRUST CSF using a HITRUST Insights Report or an e1 or i1 baseline as the starting point. An Insights Report can map e1, i1 or r2 results to HIPAA, so the team can see where its existing evidence already answers HITRUST requirements. The output is a gap list that names each control, its current evidence and the owner responsible. Confirm the current CSF version and mapping details directly with HITRUST, since the CSF version in use changes which requirements apply.
Close gaps and assemble shared evidence
Close the gaps identified in the mapping, then organize evidence so that a single artifact can answer both a HIPAA documentation requirement and a HITRUST requirement where the mapping allows. Examples include access review records, risk analysis updates, incident response test results and backup restoration logs. Each artifact should carry a date, an owner and a reference to the HIPAA section and HITRUST requirement it supports. The step closes when the gap list is empty or each open item has a documented plan, and when evidence is stored in a single repository that both HIPAA and assessor reviews can draw from.
Select the certification level matching customer demand
Choose between e1, i1 and r2 based on the assurance customers actually request and the sensitivity of the data and systems in scope. HITRUST positions the e1 for startups and lower-risk organizations, the i1 for maturing programs needing moderate assurance, and the r2 for organizations handling highly sensitive data or high-risk systems. The e1 and i1 form a traversable portfolio, so an organization can start at e1 and move to i1 or r2 later. The output is a written decision that names the level, the scope and the contractual driver, reviewed with the customers who require the certification.
Engage an Authorized HITRUST External Assessor
Engage an Authorized HITRUST External Assessor organization to perform the validated assessment, since only authorized assessors may perform the assessments submitted for certification. Agree the scope, the evidence approach and the fieldwork window in writing, noting that the validated assessment fieldwork window is at most 90 days for e1, i1 and r2. Ask each assessor how it will reuse the shared evidence repository and how it will treat evidence prepared for HIPAA. The step closes with a signed engagement letter, a named assessor team and an agreed evidence request list. HITRUST performs central quality assurance before issuing the report, so the certification decision is not made by the assessor alone.
Run the assessment and receive the certification
The assessor tests the in-scope controls against the agreed evidence, submits the validated assessment, and HITRUST performs quality assurance before issuing the certification. The organization answers assessor questions, provides access to evidence and records any corrective actions. The step closes when the certification is issued and the validity period is recorded. Remember that e1 and i1 certifications are valid for one year and r2 certifications for two years, so the renewal calendar starts at issuance. Confirm the exact certification letter and scope statement with HITRUST, since customers will ask for it.
Plan the r2 interim assessment and annual renewal
For an r2 certification, schedule the interim assessment to fall within the 90 days before the first anniversary, as the HITRUST Assessment Handbook requires. For e1 and i1, plan the annual renewal before the one-year validity ends. Refresh the HIPAA risk analysis at the same cadence, and update the shared evidence repository whenever the CSF version, the system scope or the HIPAA documentation changes. The step closes when a dated calendar exists for each renewal, each owner is named, and a change process links HIPAA reviews to HITRUST evidence. Ongoing support and continuous testing can be scoped as retainers, and the reader should confirm those terms in a written quote.
What drives the cost and effort of each path
The HIPAA Security Rule path is mostly internal labor and decisions, with some outside help if you want it. Your staff time goes into the risk analysis, the policies and documentation the standards in 45 CFR 164.308, 164.310, 164.312, 164.314 and 164.316 call for, and the technical configuration of systems that hold electronic protected health information. Where an addressable implementation specification is not reasonable and appropriate, the documented reasoning and any equivalent alternative measure also take time. Outside help, such as DeployOpen implementing or hardening controls, is scoped in writing before work starts. Nothing in the Rule requires a paid certificate, so the recurring cost is mainly the ongoing operation of the program. Cost rises with the number of systems that store, process or transmit ePHI, the hosting model, and the number of gaps the first risk analysis surfaces.
The HITRUST path adds costs that the HIPAA path does not carry. You pay an Authorized HITRUST External Assessor for the validated assessment, and you pay internally for readiness work, evidence collection and remediation before fieldwork. Certification then recurs: e1 and i1 certifications last one year and r2 certifications last two years, with an r2 interim assessment due in the 90 days before the first anniversary. Each renewal or interim cycle repeats evidence work, so an organization that changes its environment often will pay that cost more than once. Ask the assessor to show how the fieldwork window, which is at most 90 days for e1, i1 and r2, maps to your system count, and confirm with HITRUST which assessment type and CSF version your contract covers, since v11.9.0 changed the e1 and i1 baselines.
When you request a written quote from DeployOpen or any other implementer, ask for a line-by-line scope that separates HIPAA program work from any HITRUST readiness work. Confirm the systems in scope, the hosting environments, the number of policies to be written or revised, the assumptions about existing evidence, and what is excluded, such as the assessor's fees or your own staff time. Ask how a gap found in the risk analysis or readiness review would change scope and timing, and whether the quote includes the interim or renewal cycle or only the first assessment. The point of this comparison is to price the path you need, so a quote that cannot show these components is not yet comparable to another one.
Common questions about HIPAA and HITRUST
Is HITRUST required for HIPAA compliance?
No. HIPAA has no certification, and HITRUST is a private, voluntary framework. HHS states that no Security Rule standard requires an entity to certify compliance, and that it does not endorse or recognize private organizations' certifications. The Security Rule (45 CFR Part 164 Subpart C) is what covered entities and business associates must meet for electronic protected health information. HITRUST becomes relevant mainly when a customer contract, procurement questionnaire or board asks for third-party assurance. Confirm with your customers and contracts whether they require HITRUST specifically, or whether a HIPAA-focused assessment or a SOC 2 report will satisfy them.
Does a HITRUST certification prove HIPAA compliance?
No. A HITRUST certification is a third-party result against the HITRUST CSF, not a legal finding of HIPAA compliance. HHS states that a third-party certification does not relieve covered entities of their legal obligations, and that it does not prevent HHS from later finding a security violation. Assessment results can be mapped back to HIPAA through HITRUST Insights Reports, which cover e1, i1 or r2 results. Ask your assessor to show the mapping for each Security Rule standard and to explain which Security Rule requirements the certified scope does not cover, such as organizational or documentation standards you run outside the assessed systems.
How long does an e1 or i1 certification take?
Timing depends mostly on how ready your controls and evidence already are. HITRUST cites an average of about 30 days for e1 certification and 6 to 12 months for most i1 certifications, depending on readiness, according to its e1 and i1 pages. The validated assessment fieldwork window is at most 90 days for e1, i1 and r2, per the Assessment Handbook v1.1. Readiness work before fieldwork, such as gap analysis, evidence collection and remediation, is usually the longest part. Ask your external assessor for a written timeline that separates readiness, fieldwork and HITRUST quality assurance review.
Can our team run a HITRUST assessment ourselves?
Your team can prepare for an assessment, but it cannot perform the validated assessment submitted for certification. Only Authorized HITRUST External Assessor organizations may perform those assessments, and HITRUST performs central quality assurance before issuing reports. Internal staff can run a readiness review against the requirements, build the evidence library, and close gaps. Confirm with HITRUST which assessor types are authorized for your chosen level, and check that the assessor is listed on HITRUST's Find an External Assessor page before signing a scope.
What does a HITRUST engagement need from our team?
Expect demands on several roles, not only the security team. The work usually needs an executive sponsor to approve scope, a program owner to coordinate evidence, system owners to explain controls on their platforms, and engineers who can produce configuration exports, logs and access records. Assessment results are reported across 19 assessment domains, so each domain needs a named owner for its evidence. Ask the assessor which controls are inherited from cloud or hosting providers and what that provider must supply, because inherited controls still require evidence in your assessment.
Does a HITRUST certificate protect us from OCR penalties?
No. A certificate does not shield an organization from OCR enforcement. OCR enforces the Security Rule through complaint investigations, compliance reviews and audits, and HHS states that third-party certifications do not prevent a later violation finding. Penalties are set per violation, and the inflation-adjusted HIPAA civil money penalty for penalties assessed on or after January 28, 2026, ranges from $145 to $2,190,294 per violation, under 45 CFR 102.3. Relevant to penalty exposure is whether you can show recognized security practices in place for the prior 12 months, which OCR must consider under the 2021 HITECH amendment. Ask counsel how a HITRUST result would be presented in an OCR matter.
How DeployOpen prepares HIPAA and HITRUST readiness
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure, and prepares systems, controls and evidence for compliance assessments. We do not issue audit reports, attestations or certifications, and HITRUST validated assessments can only be performed by an Authorized HITRUST External Assessor.
How we scope
- Written scope lists which ePHI systems, business associate relationships and Security Rule standards are included
- Scope states which HITRUST assessment type, if any, the client is preparing for and which assessor performs it
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts
- Quotes follow from the written scope, so ask for each scope item to be priced separately
How we build
- Controls are mapped to the HIPAA Security Rule standards and implementation specifications, with addressable decisions documented
- Required and addressable specifications are implemented in the client's own cloud accounts, data centers or air-gapped networks
- Security testing of applications, APIs and infrastructure runs against the in-scope systems before evidence is collected
- Hardening covers access, logging, encryption and backup configuration as agreed in the scope
How we hand over
- Documentation covers policies, procedures, system configurations and the evidence each control produces
- Evidence packages are organized so an independent auditor or HITRUST assessor can trace each control to its artifact
- Runbooks let the client's own staff operate, back up and upgrade the platform after the engagement ends
- Gaps found during readiness work are listed with owners so the client decides what to remediate before any assessment
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover
- Retainers can cover periodic control reviews that keep HIPAA evidence current as systems change
- Ask whether the retainer includes re-testing after platform upgrades and how changes to scope are documented
- Confirm with your assessor which evidence formats they accept before agreeing on the handover package
Sources and further reading
- HHS FAQ 2003: Are we required to certify our organization's compliance with the standards? ↗
- The HITRUST Assessment Handbook, version 1.1 ↗
- HHS Security Rule Guidance Material ↗
- Appendix A to Subpart C of Part 164, Security Standards: Matrix ↗
- HITRUST Insights Reports ↗
- NIST SP 800-66 Rev. 2, Implementing the HIPAA Security Rule ↗
