The HITRUST Common Security Framework (CSF) is a certifiable framework that integrates various security and privacy standards, including HIPAA, NIST, and ISO. It provides a prescriptive set of controls specifically designed to help organizations manage risk and protect sensitive data in a consistent, standardized manner.
HITRUST is often considered the "Gold Standard" for healthcare security. Many large health systems and payers now mandate HITRUST certification as a non-negotiable requirement for their business associates. Achieving this certification demonstrates a mature security posture and can significantly differentiate your organization in a competitive market.
While not a federal law like HIPAA, HITRUST is a powerful contractual requirement. If you serve enterprise-level healthcare organizations, they likely require the high level of assurance that only a HITRUST CSF certification provides. It acts as a comprehensive "Proof of Trust" that covers multiple regulatory mandates at once.
The process involves a multi-stage engagement: identifying the appropriate CSF implementation level based on your organization's risk profile, performing a thorough self-assessment, and undergoing a formal validated assessment. CRI performs the final testing required to confirm your controls meet the CSF criteria, paving the way for your certification.
For maximum efficiency, we can map HITRUST requirements directly onto your SOC 2® engagement. This “single testing” approach allows you to satisfy general enterprise security expectations and specialized healthcare mandates in one streamlined process.
Because the HITRUST CSF® is a harmonized framework, a single engagement can simultaneously validate your alignment across multiple global standards. By leveraging this overlap, you can satisfy the requirements of HIPAA, NIST, and ISO through one unified testing process.
We offer several paths to help you achieve and maintain your certification status:
The CRI team supports all three levels of HITRUST assessments, from the "e1" (essentials) for lower-risk profiles to the "r2" (risk-based, 2-year) assessment, which is the most comprehensive and widely recognized certification for complex environments.
Our approach focuses on the reality of your security, not just the existence of a policy manual:
We provide clear, professional feedback on any areas that require refinement to meet the certification criteria.
As an approved firm, we deliver the formal validation required by HITRUST to issue your final certification.
Choosing Auditwerx for your compliance examination gives you a distinct advantage. Our simple reporting process makes it easy for any size organization to build trust with their clients.
We are proud to be an independent firm with no conflicts of interest in completing your report.
We focus only on controls and evidence that will score points in the final assessment.
Partner with a single firm throughout your entire compliance lifecycle. Our findings are objective and have no conflicts of interest.
Our U.S. based team of assessment professionals are never outsourced.
200+ years of collective experience translates to the most efficient path to certification, saving you time and money.
We offer flexible integration with leading GRC tools, so you don't have to duplicate evidence.
No. HIPAA is a federal regulation, whereas HITRUST is a private security framework. However, the HITRUST CSF was designed specifically to incorporate HIPAA requirements. Achieving HITRUST certification is a powerful way to demonstrate that you also satisfy your HIPAA mandates.
The “r2” certification is valid for two years, with an interim assessment required at the one-year mark to ensure controls are still operating effectively. The “i1” and “e1” assessments typically require annual validation.
If you handle PHI on behalf of a healthcare provider or payer, you are a Business Associate. This means you must have signed Business Associate Agreements (BAAs) in place and meet the same technical and administrative standards as the healthcare providers themselves. We verify that your BAA management and vendor oversight processes are fully compliant.
…Both operations and assessment teams executed the engagement flawlessly, on-time and on-budget. The Auditwerx team provided us with the necessary guidance, tools and knowledge...We would highly recommend Auditwerx services to organizations of all sizes and requirement complexities.
...Their team has brought a level of knowledge and professionalism that has been unmatched. Our company is required to undergo a number of assessments annually with various firms and Auditwerx has truly been a pleasure to work with...
...The assessment itself was thorough, but non-disruptive. The team was highly professional and very knowledgeable. We recommend Auditwerx...without reservation.
At Carr Riggs and Ingram LLC (CRI) our experienced professionals have the industry expertise and certifications to guide you through the HITRUST process. CRI has been approved by HITRUST for performing assessment and services associated with the CSF Assurance Program and the HITRUST CSF, a comprehensive security and privacy framework that incorporates the existing security requirements of healthcare organizations.
As an approved HITRUST CSF Assessor, the team at CRI can complete the testing required to meet HITRUST CSF criteria, paving the way for our clients to earn HITRUST CSF certification.
