HIPAA is the federal law that governs how US healthcare organizations protect patient information, and it applies whether or not you ever pursue outside certification. HITRUST is a private, voluntary framework that organizations can get certified against to demonstrate their controls align with HIPAA and other standards. HITRUST does not replace HIPAA, but a validated HITRUST report gives procurement teams, auditors, and business partners third-party assurance that HIPAA-style safeguards are actually in place.
TL;DR:
- HITRUST certification is voluntary and provides external validation that controls align with HIPAA, but it does not replace legal compliance obligations.
- The upcoming HIPAA Security Rule updates aim for more specific cybersecurity requirements, making risk analysis and documented policies more essential than ever.
- HITRUST's structured control set reduces duplication in compliance efforts and is particularly valuable for organizations facing heavy vendor scrutiny or managing large volumes of PHI.
- Certification levels vary from e1 to r2, with higher assurance levels demanding more evidence; the right level depends on your organization's risk profile and external requirements.
- Maintaining HIPAA compliance requires ongoing risk analyses and operational controls, regardless of HITRUST certification, which only verifies controls at a specific point in time.
Table of Contents
- What HIPAA requires of covered entities and business associates
- What HITRUST is and how its certifiable assessment programme works
- Key differences at a glance: legal force, scope, assurance, cost and effort
- How HITRUST maps to HIPAA: what a HITRUST report proves (and what it doesn't)
- Decision framework: when pursuing HITRUST is worthwhile for HIPAA-regulated organisations
- Practical steps to prepare for a HITRUST assessment while meeting HIPAA obligations
- Nexus perspective: priorities for compliance and IT teams in 2026
- Comparing security and privacy controls under HITRUST and HIPAA
- Common misconceptions about HITRUST and HIPAA compliance
- Editorial take: what actually matters heading into 2026
- How Nexus helps organisations prepare for HIPAA compliance and HITRUST assessments
- Sources
- FAQ
What HIPAA requires of covered entities and business associates
HIPAA is a federal statute, not a certification you can earn or a badge you can display. The Department of Health and Human Services, through its Office for Civil Rights, enforces it through three main components: the Privacy Rule, the Security Rule, and the Breach Notification Rule. These apply to two categories of organizations: covered entities (health plans, health care clearinghouses, and most providers who transmit health information electronically) and business associates (vendors and contractors who handle protected health information, or PHI, on a covered entity's behalf).
The Security Rule sets a "reasonable and appropriate" baseline for protecting electronic PHI, organized around three types of safeguards:
- Administrative safeguards: risk analysis, workforce training, and access management policies.
- Physical safeguards: facility access controls and device or media handling procedures.
- Technical safeguards: encryption, audit controls, and authentication mechanisms.
That "reasonable and appropriate" standard is not static. HHS OCR issued a Notice of Proposed Rulemaking in December 2024 to update the Security Rule with more specific cybersecurity requirements, including an expectation for written, tested, and regularly updated policies. The current rule remains in force while that rulemaking proceeds, but it signals where enforcement is headed.
Enforcement is not theoretical. OCR settled four ransomware investigations in 2026, and the pattern in those cases was consistent: organizations that failed to conduct accurate risk analyses or notify affected individuals on time faced corrective action plans and monetary settlements. Risk analysis, not paperwork, is the recurring failure point.
What HITRUST is and how its certifiable assessment programme works
The HITRUST CSF is a private framework built by harmonizing requirements from HIPAA, NIST, ISO, PCI DSS, and other authoritative sources into a single, structured control set. Unlike HIPAA, which is a legal obligation, HITRUST certification is something an organization chooses to pursue, typically to prove its controls hold up under independent scrutiny.
HITRUST offers three main assessment and certification types, each with a different assurance level and validity period:
- r2 (Risk-based, 2-year): the highest assurance level, tailorable to organizational risk, and the most rigorous in scope and testing.
- i1 (Implemented, 1-year): a fixed control set focused on good security hygiene and consistent implementation, renewed annually.
- e1 (Essential, 1-year): a lighter-weight assessment covering foundational cybersecurity practices.
According to the HITRUST Assessment Handbook, these validated assessments are designed so organizations can use one certification in place of responding to multiple separate compliance questionnaires, which is part of the appeal for healthcare vendors juggling dozens of client audits a year.
What makes HITRUST a certification rather than a self-attestation is the assessor structure. An organization does not grade its own homework: an authorized external assessor tests the controls, and HITRUST's own central quality assurance team reviews that work before certification is issued. The HITRUST i1 assessment page describes this model explicitly, noting that i1 results can be mapped to standards like HIPAA to simplify downstream compliance reporting. A HITRUST certification report, in the end, represents a point-in-time, externally validated statement that a defined set of controls was implemented and tested, nothing more and nothing less.
Key differences at a glance: legal force, scope, assurance, cost and effort
The clearest way to separate these two is by what happens if you ignore them. Ignore HIPAA and you risk federal investigation. Skip HITRUST and nothing legally happens, though you may lose business.
- Legal status: HIPAA is enforceable federal law; HITRUST is a voluntary, private certification with no legal force on its own.
- Scope: HIPAA centres narrowly on protecting PHI; HITRUST's harmonized control set is broader, pulling in requirements from multiple frameworks beyond health care.
- Assurance type: HIPAA compliance is a self-managed posture subject to OCR investigation; HITRUST certification is independently validated by an external assessor and HITRUST's quality assurance process.
- Assessment cycle: HIPAA has no fixed reassessment calendar, only an ongoing duty to reassess risk; HITRUST certifications run on defined cycles, one year for i1 and e1, two years for r2.
HHS OCR's 2024 NPRM proposes more specific cybersecurity requirements and expects written, tested, and regularly updated policies, a signal that the "reasonable and appropriate" bar for HIPAA compliance is likely to get more prescriptive, not less.
Cost and effort scale with assurance level. An e1 assessment demands the least evidence and time; an r2 demands the most, because it disallows certain scope carve-outs and requires broader evidence collection across the organization. For a mid-sized health system or a business associate serving many covered entities, that added rigour is often the point: it is what turns a HITRUST report into something a hospital's vendor risk team will actually accept without further questions.
How HITRUST maps to HIPAA: what a HITRUST report proves (and what it doesn't)
HITRUST's control families are built to align directly with HIPAA Security Rule requirements, alongside NIST and other standards, which is why organizations that complete a HITRUST assessment often find they have simultaneously produced usable evidence for a HIPAA risk analysis. Mapping one framework to another does not mean duplicating the work twice.
That mapping has real practical value:
- Reduced duplication: a single validated assessment can substitute for answering the same control questions in multiple vendor security questionnaires.
- Vendor assurance: covered entities increasingly ask business associates for a HITRUST report instead of a lengthy custom audit.
- Centralized reporting: organizations juggling HIPAA, SOC 2, and ISO 27001 requirements can align much of that work under one HITRUST assessment cycle.
What a HITRUST report does not do is change your legal duties. Breach notification timelines, OCR's authority to investigate, and the requirement to conduct an ongoing HIPAA risk analysis all remain in force regardless of certification status. As OCR's 2026 ransomware settlements showed, certification is not a defence if an organization's risk analysis or breach response process fails in practice. A HITRUST certificate documents that controls were tested at a point in time. It is evidence, not immunity.
Decision framework: when pursuing HITRUST is worthwhile for HIPAA-regulated organisations
Not every covered entity or business associate needs HITRUST. The decision usually comes down to how much third-party scrutiny your organization faces and how much PHI moves through your systems.
- Heavy vendor scrutiny favours HITRUST. If hospital systems or large payers routinely ask you to complete detailed security questionnaires, a HITRUST report can replace much of that back-and-forth.
- Large or complex PHI volumes favour HITRUST. Organizations handling PHI at scale, across multiple systems or business lines, benefit from the structured control mapping HITRUST provides.
- Smaller providers with limited PHI exposure may not need it. A solo practice or small clinic with a narrow technology footprint can often meet HIPAA obligations directly without the added cost of certification.
- Match the certification type to your risk profile. r2 suits organizations facing high scrutiny or complex risk; i1 suits those wanting solid, repeatable assurance without r2's full scope; e1 suits organizations still building foundational hygiene.
Pro Tip: Before contacting an external assessor, run an internal gap assessment against your target certification's control requirements. Fixing obvious gaps first keeps the formal assessment timeline and cost predictable.
Timing matters as much as the decision itself. Organizations that jump into a formal assessment before remediating known weaknesses often see costs and timelines stretch as assessors document deficiencies that could have been fixed beforehand.
Practical steps to prepare for a HITRUST assessment while meeting HIPAA obligations
Getting ready for HITRUST while keeping HIPAA obligations current follows a fairly consistent sequence.
- Define scope and map PHI flows. Identify every system that creates, stores, or transmits PHI, and document where business associate boundaries sit.
- Run a controls gap analysis. Map existing HIPAA Security Rule safeguards against your target HITRUST CSF requirements to see where evidence already exists and where it does not.
- Remediate high-risk gaps first. Prioritize issues like missing encryption or incomplete audit logging, and build the documented evidence and test plans assessors will expect. Encryption practices and audit trail evidence are common gap areas worth reviewing early, as covered in guidance on patient data encryption practices for HIPAA audit readiness.
- Engage an authorized external assessor. HITRUST's validated assessment workflow runs through multiple phases, including assessor testing and HITRUST's own quality assurance review, before certification is issued.
- Sustain the programme after certification. Use the report for vendor and procurement purposes, but keep your HIPAA risk analysis cycle running independently and prepare early for re-assessment.
Pro Tip: Budget separate time for evidence management, linking artefacts to control statements and resolving assessor questions, since teams routinely underestimate how much of the project that consumes.
Nexus perspective: priorities for compliance and IT teams in 2026
With HHS actively modernizing the Security Rule, we think organizations should treat that NPRM as a preview, not background noise, and start tightening risk analysis and documentation practices now rather than waiting for a final rule. HITRUST is a strong procurement and vendor assurance tool, but it does not transfer legal responsibility: covered entities and business associates still own their HIPAA compliance regardless of what certification sits on the wall. Our priority for 2026 is consolidating ownership of these decisions under one accountable team, documenting the reasoning behind every control choice, and building continuous monitoring rather than treating either HIPAA or HITRUST as a once-a-year event.
— Nick - Sr. Executive
Comparing security and privacy controls under HITRUST and HIPAA
HIPAA's Security Rule defines safeguards in broad, principle-based language: administrative, physical, and technical categories with a "reasonable and appropriate" standard that leaves implementation details to the organization. That flexibility is useful but can also produce inconsistent interpretations across similar organizations.
HITRUST's CSF takes those same underlying concerns and translates them into a specific, testable control set, often with defined maturity levels and evidence requirements attached to each one. Where HIPAA might require "appropriate access controls," a HITRUST control statement will typically specify what that looks like in practice, along with what evidence an assessor expects to see.
The implication for compliance teams is straightforward: HIPAA tells you what outcome the law demands, and HITRUST gives you one detailed, externally testable way to get there. Organizations that adopt HITRUST controls are generally building a more granular, better-documented version of what HIPAA already requires, which is why the two are complementary rather than competing. The privacy side is where the gap widens: HIPAA's Privacy Rule addresses patient rights and permitted uses of PHI in ways HITRUST's control set touches only partially, so HITRUST certification should never be treated as covering privacy obligations in full.
Common misconceptions about HITRUST and HIPAA compliance
The most persistent misconception is that HITRUST certification equals HIPAA compliance. It does not: certification demonstrates that a defined set of controls was implemented and tested at a point in time, but HIPAA compliance is an ongoing legal obligation that includes duties, like breach notification, that HITRUST does not directly certify.
A second misconception is that smaller organizations do not need to think about either. HIPAA applies regardless of size to any covered entity or business associate handling PHI, and OCR's enforcement actions have not been limited to large health systems.
A third misconception treats all HITRUST certifications as interchangeable. An e1 assessment covers foundational hygiene, an i1 covers a fixed, moderate assurance control set, and an r2 covers a tailored, high-assurance scope. A vendor holding an e1 certification has not demonstrated the same depth of testing as one holding an r2, and treating them as equivalent in a vendor risk review is a common and avoidable error.
Finally, some teams assume certification removes the need for an internal HIPAA risk analysis. OCR's own enforcement pattern shows the opposite: failure to conduct an accurate risk analysis remains one of the most common findings behind settlements, independent of what certifications an organization holds.
Editorial take: what actually matters heading into 2026
The conventional advice tends to frame HITRUST versus HIPAA as a choice, and that framing misleads more organizations than it helps. HIPAA is not optional, so the real question is only ever whether HITRUST's added structure and third-party validation are worth the cost for your risk profile and your customers' expectations. Where I think most teams get it wrong is chasing certification as a compliance shortcut instead of using it as a forcing function for better documentation and evidence discipline, the habits that also happen to be what OCR investigations keep flagging as missing. With the Security Rule NPRM signalling more prescriptive expectations ahead, the organizations in the best position by 2027 will be the ones that used 2026 to tighten risk analysis, documentation, and continuous monitoring, whether or not they ever pursue certification. Prioritize the substance HITRUST is built on before you prioritize the certificate itself.
— Nick - Sr. Executive
How Nexus helps organisations prepare for HIPAA compliance and HITRUST assessments
Coordinating HIPAA obligations and a HITRUST assessment usually means juggling several vendors: one for risk analysis, another for monitoring, another for backups. Nexus consolidates that work under one provider with a single point of accountability, so your team is not managing separate contracts and separate timelines to get audit-ready.
Our compliance and cybersecurity services are built around the groundwork both HIPAA and HITRUST require:
- Compliance assessments that map your current controls against HIPAA Security Rule requirements and HITRUST CSF control sets.
- 24/7 real-time threat detection and monitoring to support the continuous oversight both frameworks expect.
- HIPAA-compliant backup and disaster recovery, detailed in our guide on proving your restores for audit purposes.
- Assessor coordination and remediation support to close gaps before a formal HITRUST assessment begins.
A typical engagement starts with a scoping call, moves through a gap assessment against your target framework, and ends with a remediation plan and documented evidence package your team can hand to an external assessor. Visit our services page to talk through where your organization stands today.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
Sources
- HIPAA Security Rule NPRM — HHS
- OCR settles four ransomware investigations — HHS press release
- HITRUST Assessment Handbook
FAQ
Are HIPAA and HITRUST the same thing?
No. HIPAA is a US federal law enforced by HHS OCR, while HITRUST is a private, voluntary certification framework. HITRUST can demonstrate HIPAA-aligned controls, but it does not replace HIPAA's legal requirements.
What is the new HIPAA rule expected in 2026?
HHS OCR proposed updates to the HIPAA Security Rule through a Notice of Proposed Rulemaking issued in December 2024, aiming for more specific cybersecurity requirements and regularly tested policies. The current Security Rule remains in effect while that rulemaking process continues.
Is HITRUST certification mandatory for healthcare organisations?
HITRUST certification is voluntary and not required by federal law. Many organizations pursue it because business partners and covered entities increasingly request it as proof of tested security controls during vendor reviews.
Is HITRUST better than SOC 2 for healthcare compliance?
Neither framework is universally better since they serve different purposes: SOC 2 focuses on service organization controls broadly, while HITRUST's CSF is built specifically to harmonize healthcare-relevant standards, including HIPAA. Organizations serving healthcare clients often find HITRUST's direct mapping to HIPAA requirements more useful for that specific audience.