HITRUST CSF

What is HITRUST?

HITRUST is a private organisation that maintains the HITRUST CSF, a control framework that brings requirements from many sources into one set: HIPAA, NIST frameworks, ISO/IEC standards, PCI DSS and others. It also runs an assurance programme. An organisation is tested by an authorised external assessor, HITRUST reviews the results and, where the controls meet its bar, issues a certification report the organisation can share with customers.

The CSF is updated often. Version 11.9.0 was released on 24 September 2026, adding mappings and coverage for agentic AI and post-quantum cryptography among other changes. New e1 and i1 assessments can use either v11.8.0 or v11.9.0 until 31 December 2026.

The assessments

HITRUST offers assessments of increasing depth, so an organisation can start small and grow:

• e1: an entry-level assessment of 43 core controls, valid for one year. It suits start-ups and lower-risk organisations.
• i1: 182 control requirements aimed at current threats, valid for one year, for organisations with an established security programme.
• r2: the most thorough option, tailored to the organisation’s risk factors and the regulations it needs to show, valid for two years.

HITRUST also offers assessments for AI systems, which can stand alone or be added to e1, i1 or r2.

Who uses it?

It is most common in US healthcare: hospitals, health plans and their vendors often ask suppliers for a HITRUST certification as evidence that protected health information is safe. It is not a legal requirement, and a certification doesn’t mean an organisation complies with HIPAA, though the controls cover much of what HIPAA’s Security Rule asks for.

How does it relate to other frameworks?

Because the CSF maps to many frameworks, one r2 assessment can be used to answer questions about several at once. Organisations certified to ISO/IEC 27001 or with a SOC 2 report will find much of the work familiar, but HITRUST tests against its own prescriptive requirements and scoring.