# HITRUST: HITRUST CSF assessments and certification

> A certifiable security framework widely required by US healthcare organisations.

URL: https://securei3.com/standards/hitrust/
Category: Attestation & assurance: Attestation / assessment
Provider: Secure iQube (independent consultancy; ISO certificates are issued by accredited certification bodies; SOC and ISAE reports by licensed CPA and audit firms, which Secure iQube can arrange through partner firms)


HITRUST combines requirements from many standards and regulations into the HITRUST CSF, with e1, i1 and r2 assessments of increasing rigour performed by authorised assessors. We prepare health-tech and service providers for the assessment.

## Who it is for

- Health-tech and BPO providers serving US healthcare

## Benefits

- Assurance US health systems recognise

## How Secure iQube helps

1. **Scoping**: Agree the systems, services and criteria in scope, and whether a Type 1 or Type 2 report fits your customers and timeline.
2. **Readiness assessment**: Map existing controls to the criteria, identify gaps and design missing controls with owners and evidence.
3. **Remediation**: Put policies, tooling and processes in place, and rehearse evidence collection so it is routine, not a scramble.
4. **Assessment coordination**: We help you engage an authorised HITRUST external assessor, prepare the evidence and support you through the assessment and any follow-up actions.
5. **Observation period and report**: For Type 2, we monitor controls through the observation window and help you respond to exceptions before the report is issued.

## Frequently asked questions

### Which HITRUST assessment should we choose?

Your customers often specify it. e1 suits lower-risk vendors; r2 is the most comprehensive.

Related: https://securei3.com/standards/hipaa/, https://securei3.com/standards/soc-2/, https://securei3.com/standards/iso-27001/

Contact: https://securei3.com/contact/: info@securei3.com