HITRUST assessment by A-LIGN

HITRUST offers three validated assessment types. The e1 covers roughly 43 essential requirements and suits lower-risk organizations demonstrating baseline security hygiene. The i1 covers 182 threat-adaptive requirements and suits organizations needing moderate assurance, testing only “implemented” maturity rather than the full maturity model. The r2 is scoped to the organization's risk profile, industry, data volume, and regulatory footprint — most r2 assessments land somewhere between roughly 200 and 400+ requirements (commonly cited averages run around 300–385), though tailoring can push the ceiling into the thousands. The r2 is the benchmark for enterprise healthcare organizations, health plans, and health tech vendors. The e1 and i1 produce one-year certifications; the r2 produces a two-year certification with a mid-cycle Interim Assessment. A-LIGN also offers Readiness Assessments for organizations preparing for a first validated assessment, Interim Assessment Testing for r2 certificate holders, and HITRUST AI Security and Risk Management Assessments.

An e1 assessment typically takes 3 to 6 months from kickoff to certification. An i1 assessment generally takes 6 to 9 months. An r2 assessment, the most comprehensive, commonly takes 9 to 18 months, with a significant share of that time spent remediating controls before formal assessment begins. The primary variables are the assessment type, the maturity of the existing control environment, and the efficiency of the evidence-management process. A-LIGN offers readiness assessments to surface gaps early, and the A-SCEND platform exchanges data with MyCSF via API, which compresses the assessment phase by reducing evidence-submission delays and quality-review iterations.

HITRUST maps to dozens of frameworks beyond SOC 2, including ISO 27001, NIST 800-53, HIPAA, PCI DSS, and GDPR, consolidating them into a single certifiable control set. The key distinction is the form of assurance: SOC 2 is an attestation — an auditor's opinion against the flexible AICPA Trust Services Criteria — while HITRUST is a certification produced by scored, maturity-rated testing against prescribed requirements. Organizations already holding SOC 2 or ISO 27001 can reuse substantial existing evidence for HITRUST, and the assessments can be run concurrently. A-LIGN's A-SCEND platform lets clients manage evidence, communications, and audits for HITRUST, SOC 2, and ISO 27001 from one central location, reducing audit fatigue instead of repeating evidence collection for each framework.

HITRUST certification isn't mandated by any single federal regulation, but it's effectively required in several commercial contexts. Large health systems, health plans, and managed care organizations frequently list HITRUST r2 as a vendor-qualification requirement in their third-party risk programs. Organizations participating in health information exchange ecosystems often require it as a baseline trust anchor, and some federal health agency contracts specify it as an evaluation criterion. Cyber insurance underwriters in health tech and healthcare SaaS increasingly treat HITRUST certification as a risk-reduction signal affecting premium pricing. Many non-healthcare organizations also pursue HITRUST for its broad framework coverage and market recognition. If an organization handles protected health information and sells to enterprise healthcare customers, certification is likely already required by its largest accounts, or will be within the next contract cycle.

Cost varies significantly based on the assessment type chosen (e1, i1, or r2), the complexity and size of the organization, and the number of in-scope systems and locations. Assessor fees are only part of the picture — the total investment also depends on the MyCSF subscription charged directly by HITRUST, any internal remediation work needed before the assessment, and the maturity of the organization's existing control environment. Organizations that already hold SOC 2 or ISO 27001 typically see lower overall costs, since much of the evidence infrastructure is already in place. Because pricing is so scope-dependent, the most reliable way to get an accurate figure is a scoping conversation with A-LIGN based on your specific environment.

The HITRUST Common Security Framework (CSF) is a certifiable information security and privacy framework maintained by the HITRUST Alliance. It consolidates requirements from HIPAA, NIST 800-53, ISO 27001, PCI DSS, GDPR, and other authoritative sources into a single control set organized across 19 domains (grouped under 14 control categories), covering areas including access control, endpoint protection, incident management, risk management, data protection, and physical and environmental security. Every HITRUST validated assessment tests against CSF requirements calibrated to the organization's risk profile, industry, data volume, and geographic scope.

HITRUST uses a maturity-based scoring model rather than a simple pass/fail threshold. For r2 assessments, each control requirement is scored across five maturity levels — Policy, Procedure, Implemented, Measured, and Managed — on a 0 to 100 scale (e1 and i1 test only the Implemented level). To achieve certification, an organization must meet the minimum required average score in every in-scope domain — no single domain may fall below the threshold. Scoring is applied by the External Assessor Organization and then independently validated by HITRUST's own quality-review team before certification is issued.

The HITRUST AI Security Assessment evaluates security controls for organizations that develop, deploy, or operate AI systems in data-sensitive environments, addressing model integrity, data provenance, AI-specific threat vectors, and governance of AI system inputs and outputs. HITRUST also offers an AI Risk Management Assessment covering governance and risk-identification controls for AI systems. Both are add-ons layered onto an underlying e1, i1, or r2 assessment rather than standalone certifications, and are most relevant to health tech companies, SaaS platforms, and any organization whose AI products handle protected health information. A-LIGN delivers both through its HITRUST AI Security and Risk Management Assessments.