The HHS Office for Civil Rights reported 21 enforcement actions in 2025. That included 19 settlements and 2 civil money penalties. That pace shows how closely regulators watch organizations that handle health data. HIPAA sets the legal floor for that protection. HITRUST sets a higher, optional bar. Many large buyers now expect it from vendors.
HITRUST stands for the Health Information Trust Alliance. The group built a certifiable security framework that goes well past what HIPAA requires on paper. HIPAA is a law every covered entity and business associate must follow. HITRUST certification is a business choice, not a legal one.
A security firm or health tech vendor often chases contracts with hospitals or health plans. HITRUST certification often cuts weeks out of vendor due-diligence reviews for these vendors. A smaller shop without those enterprise buyers often skips certification. A solid HIPAA compliance program usually covers the legal bar without the added spend. The right call depends on who signs the contracts, not on how rigorous a framework sounds.
What Is HITRUST?
HITRUST began in 2007 to standardize security controls. The nonprofit built a framework it calls the HITRUST Common Security Framework, or CSF. HITRUST created and maintains the CSF. The framework helps healthcare organizations and their providers show security and compliance in a consistent way.
The CSF pulls from a wide range of outside standards instead of inventing new rules. The HITRUST framework harmonizes over 70 regulations, standards, and other authoritative sources into one consolidated set of controls. The framework started in healthcare and became industry-agnostic in 2019.
HITRUST does not replace HIPAA. The CSF builds on HIPAA and the Health Information Technology for Economic and Clinical Health Act. This law expanded requirements for using, disclosing, and safeguarding health information. Pursuing certification adds a layer of outside validation on top of that legal baseline.
How HITRUST Differs From HIPAA
HIPAA is a federal law. HITRUST is a certification program. That single distinction explains most of the confusion between the two terms.
Protected Health Information, or PHI, is health data that can identify a person. Examples include medical records and insurance details. HIPAA tells covered entities and business associates how to protect PHI. The Department of Health and Human Services, or HHS, can fine them for failing to do that. The Office for Civil Rights, or OCR, is the HHS division that handles that enforcement.
No government body certifies anyone as HIPAA compliant. HHS guidance states that HHS does not endorse or recognize private certifications for the Security Rule. Such certifications do not remove a covered entity's legal duties. OCR judges a HIPAA program by its documented risk analyses, policies, and training records. It does not judge the program by a certificate.
HITRUST works differently because an outside party formally validates the result. An authorized external assessor reviews the evidence. HITRUST's own quality team checks the work before HITRUST issues certification. That extra layer of review is what gives a HITRUST report weight with large buyers.
What HITRUST Certification Requires
HITRUST offers three certification tiers, and each fits a different risk profile and budget:
- e1 (Essentials, one year): Covers 44 requirement statements scored on implementation. The pass mark is 83 per domain, and it suits lower-risk vendors pursuing a first certification.
- i1 (Implemented, one year): Covers about 182 implemented controls. This tier is the one vendor contracts most often require for health plans and hospital systems.
- r2 (Risk-based, two years): Tailors the control set to the organization's risk factors. It averages about 360 requirement statements and scores maturity across five levels instead of implementation alone.
Timelines vary by tier and by how ready an organization is before the assessment starts. One assessor's planning range runs three to six months for an e1. The same source puts an i1 at five to ten months. An r2 engagement often runs eight to fifteen months from kickoff to certification letter.
Budgets scale with each tier as well. One estimate puts first-time e1 costs around $35,000 to $50,000, all-in. The same source puts i1 costs between $70,000 and $120,000. An r2 engagement costs noticeably more, given its larger control set and longer validity period.
Certification does not last forever, either. An e1 or i1 certification is valid for one year. An r2 certification is valid for two years if the organization submits an interim assessment before the one-year mark. That renewal cycle becomes a recurring line item in the security budget, not a one-time cost.
Does HITRUST Shorten the Sales Cycle?
For vendors selling into large health systems, the tier matters more than the label. The assessment tier an organization chooses should follow its customers' contracts, not ambition. A health plan may specify r2 in its vendor risk requirements. That plan will not accept a lower tier as a substitute.
HITRUST built the program around a simple idea it calls “assess once, report many.” In practice, a single HITRUST report can answer many buyers' security questionnaires at once. That saves vendors from repeating the same disclosures for each new deal. That reuse is where the sales-cycle argument for HITRUST holds up best.
HITRUST also points to its own breach data to make the case for certification. The organization reports that 99.62% of HITRUST-certified environments had no breaches in 2025. That figure comes from HITRUST itself. It works better as a marketing data point than as a benchmark checked by an outside party. Large buyers still cite it during vendor reviews.
When HIPAA Compliance Alone Still Works
Not every organization needs the added cost of certification. No federal law requires HITRUST. Many still consider it one of the most comprehensive frameworks available. A vendor without enterprise health plan or hospital contracts may never face a buyer who asks for it.
A smaller healthcare SaaS company selling mainly to independent practices often meets its legal bar with four basics:
- a documented risk analysis
- written policies
- signed business associate agreements
- staff training
Those four pieces cover the core of what OCR checks during an investigation. Adding HITRUST on top of that program makes sense eventually. It pays off once a sales pipeline starts to include larger, more risk-averse buyers.
How to Decide Between HIPAA Baseline and HITRUST Certification
A few questions tend to settle the decision quickly:
- Do current or near-term prospects specify a HITRUST tier in their vendor contracts?
- Does the sales team lose deals or face long security reviews without outside validation?
- Can the budget cover a multi-year certification cycle, not just the first-year cost?
- Is the data footprint large enough that a two-year r2 report would outweigh its cost?
An organization answering yes to most of these questions likely gets a return from certification. An organization answering no to most of them can keep building a strong HIPAA program. It can revisit HITRUST once the sales motion changes.
Getting the Decision Right
HIPAA compliance is the required starting point for any organization that touches protected health information. HITRUST certification sits on top of that baseline as an optional, often costly, step. It pays off mainly when enterprise buyers ask for it by name. A business should weigh the real sales pipeline against the certification's cost and timeline, not its reputation. That approach leads to a better outcome than chasing the label alone.
Planet 9 is a Bay Area cybersecurity consulting firm specializing in HITRUST readiness for SMBs in healthcare and health technology. Our vCISOs and compliance managers help organizations choose the right approach, configure governance, risk, and compliance tools if needed, and get audit-ready without wasted time.
