The HITRUST Common Security Framework is the gold standard for information security in healthcare. HITRUST certification is increasingly required by healthcare organisations as a condition of doing business with vendors and partners.
What is HITRUST?
The HITRUST Common Security Framework (CSF) is a certifiable framework that provides organisations with a comprehensive, flexible, and efficient approach to regulatory compliance and risk management. It incorporates requirements from HIPAA, NIST, ISO, PCI DSS, and other frameworks into a single, unified standard.
HITRUST offers three assessment types: e1 (Essential, 44 controls), i1 (Implemented, 182 controls), and r2 (Risk-based, 375+ controls). The r2 assessment is the most comprehensive and is widely recognised as the healthcare industry standard for demonstrating security assurance.
HITRUST certification is increasingly required by US healthcare organisations as a condition of vendor onboarding, replacing the need for multiple individual security questionnaires and assessments.
Compliance requirements
HITRUST CSF organises controls across 19 control categories, covering information protection, access management, risk management, and more.
Establish a comprehensive information protection programme covering policies, procedures, and controls for protecting sensitive health information.
Implement controls to protect all endpoints accessing sensitive data, including anti-malware, patch management, and device encryption.
Implement controls for portable devices including encryption, remote wipe capability, and mobile device management.
Establish policies and technical controls for managing mobile devices that access or store sensitive information.
Implement controls to protect email communications, including encryption, anti-phishing, and data loss prevention.
Implement strong access controls including multi-factor authentication, privileged access management, and regular access reviews.
Implement comprehensive audit logging and monitoring capabilities to detect and respond to security incidents.
Conduct regular risk assessments and implement a risk management programme aligned to HITRUST CSF requirements.
Audit process
Netru manages the complete HITRUST certification journey, from selecting the right assessment type through to validated assessment management.
We determine the appropriate HITRUST assessment type: e1 (Essential), i1 (Implemented), or r2 (Risk-based), based on your requirements.
We define the scope of your HITRUST assessment, identifying all systems, processes, and data flows in scope.
We assess your current controls against the applicable HITRUST CSF requirements, producing a prioritised remediation roadmap.
Your compliance manager guides implementation of required controls, with evidence collection throughout the remediation period.
We manage the engagement with a HITRUST Authorised External Assessor to conduct the validated assessment.
Upon successful assessment, HITRUST issues your certification, valid for two years with an interim assessment at one year.
How Netru delivers it
Our team has deep experience in HITRUST CSF across all assessment types. We select the right assessment for your needs, implement controls, manage the External Assessor relationship, and support you through certification and annual renewals.
Talk to our teamBefore you talk to anyone