HIPAA vs HITRUST testing

What does each of the two actually do to you?

One is a status you cannot resign from. The other is a dated asset you buy, maintain and can lose. section 164.104 applies Part 164 to a health plan, a health care clearinghouse and a health care provider who transmits health information electronically in connection with a covered transaction, and paragraph (b) applies the standards to a business associate where provided. No filing creates that status and no supplier can take it off you, and what the Security Rule asks of software, safeguard by safeguard is what the status obliges once you have it.

HITRUST reaches you through two signatures. A customer asks for it in a contract, and you sign a subscription agreement with HITRUST Services LLC, a Delaware limited liability company. Neither signature is compelled by any statute. What HITRUST is, who sells it and which of the e1, i1 and r2 you have been asked for is the detail behind that sentence.

The consequence a CEO can act on: failure on the HIPAA side is answered to a regulator and has no end date, while failure on the HITRUST side is answered to a customer on a calendar date that is already in your contract. The two failures arrive from different directions and neither cancels the other.

Who asks for which, and at what moment?

The regulator never asks for HITRUST and the enterprise buyer rarely asks for HIPAA by name. The HITRUST request usually arrives from procurement or from a health plan partner, with a date attached and a deal behind it. The HIPAA question arrives at three moments instead: when a customer's counsel drafts the business associate agreement, when a diligence team opens the technical review before a funding round or an acquisition, and when something goes wrong and OCR asks what you had in place beforehand.

Read the questionnaire literally, because the two requests buy different things. A request for HITRUST is a request for a named third party to have inspected your controls, and only firms on HITRUST's External Assessor list may perform the assessment submitted for certification. A request framed around HIPAA is a request for your own evidence. OCR's FAQ on certifying compliance says of the evaluation at section 164.308(a)(8) that it "can be performed internally by the covered entity or by an external organization that provides evaluations or 'certification' services", and HHS attaches no weight to which of the two you chose.

The supplier question sits underneath both. 45 CFR 160.103 lists quality assurance, data analysis and consulting among the functions that make an outside firm a business associate, so a testing vendor appointed for either exercise is inside that definition the moment it touches records. Our own terms are set out at how we work with protected health information. We sign a Business Associate Agreement before any engagement that touches PHI. We do not need production PHI to test. Environments run on synthetic and de-identified data, and where a test genuinely needs a real-world shape, the route to it is agreed in writing before an environment exists, and de-identification is verified rather than assumed. What to ask a healthcare QA vendor before you appoint one puts those questions in the order a procurement team asks them.

Which of the two expires?

HITRUST does, on a date HITRUST will not move. Certification runs 12 months from the report date for an e1 and an i1 and 24 months for an r2, and the handbook fixes the report date as the date of the Management Representation Letter, so the clock starts at a signature and not at the day the certificate lands. An r2 carries a checkpoint in the middle: the interim assessment is due inside the 90-day window before the one-year anniversary of the certification issuance date, and non-submission by that deadline "will result in suspension and/or revocation of the Assessed Entity's certification." Criterion 15.7.4 reads in full: "HITRUST does not, under any circumstances, extend the expiration date of a HITRUST certification."

Slip the re-assessment and you get a certification gap, during which HITRUST states the entity "is not considered to be HITRUST certified". That is a sentence a customer's vendor management system reads as a renewal blocker, and the only relief is the bridge assessment, which exists for the r2 alone and buys up to 90 days.

HIPAA has no expiry and no renewal. 164.308(a)(8) requires the evaluation to be periodic and sets no interval, no method and no requirement that anybody outside the organisation performs it, so the date is yours to choose and yours to miss. Nobody writes to tell you it is overdue. A company can therefore hold a current HITRUST certificate, publish it, and still have nothing on file against the standard a regulator would cite.

What can you buy, and what stays with you whatever you pay?

You can buy the assessment. HITRUST publishes no price for any assessment or certification, and handbook criterion 3.1.9 places the whole envelope on the assessed entity: funding readiness, validation and certification work, internal and external resources, and completing any corrective actions. There are at least two invoices, one for the platform subscription and one for the external assessor, and assessor quotes differ partly because each assessor firm's own annual programme fee to HITRUST is set on that firm's revenue. Budget for the HIPAA side separately, because what a HIPAA testing engagement costs is driven by the addressable safeguard decisions you have to document, and no assessor sets a price for those.

Four things no payment moves, and each one is stated by the party you would otherwise be relying on.

The risk analysis stays in your hands. HITRUST writes that its "CSF assessments are not risk assessments", and it points management at section 164.308(a)(1)(ii)(A) for the analysis itself, which is where the rule already put it.

Coverage stops short of the statute. HITRUST states that its assessments "do not evaluate coverage of or compliance with HIPAA in its entirety", and it names the material it left out of the framework deliberately, including the applicability and definitions sections at 164.302, 164.304, 164.400, 164.402, 164.500 and 164.501.

Responsibility does not transfer with the report. The transmittal letter of HITRUST's own published example report tells the reader that management remains "solely responsible for ensuring the Organization's compliance with any legal and/or regulatory requirements, including HIPAA."

The regulator keeps its freedom to disagree. OCR states that private certifications "do not absolve covered entities of their legal obligations under the Security Rule" and that a certification performed by an external organization "does not preclude HHS from subsequently finding a security violation."

What changes in your testing when the request says HITRUST?

The audience for the evidence changes, and that changes what the evidence has to look like. For HIPAA work the reader is your own evaluation file and, eventually, an investigator: a test result is useful when it names the safeguard, the build and the date, and the HIPAA technical safeguards checklist is the shape that file takes. For HITRUST the reader is an approved external assessor working inside a fieldwork window capped at 90 days, and evidence is attached to individual requirement statements that are scored.

Three consequences for the plan.

Sequencing gets tighter. The assessor inspects documented evidence of control implementation, so a control fixed during fieldwork still needs evidence that it was operating, and the window does not stretch to accommodate a late fix.

Who does the work becomes a rule. Handbook criterion 3.3.5 bars assessor personnel who were involved in implementing or operating your assessed controls in the previous 12 months from working on the validated assessment, and requires a separate team including a separate engagement partner. Criterion 3.3.6 still permits the same firm to do your readiness work, penetration testing and vulnerability scanning.

Test data acquires a contractual boundary that HIPAA does not draw for you. The MyCSF subscription agreement states that customer data "shall not upload PHI", so any screenshot, extract or log going into the platform as evidence has to be de-identified or redacted before it goes in. On the HIPAA side the rule names no test environment at all, and the decision about what data a test environment holds is yours to make and to document. What a HIPAA testing engagement covers and what it hands back sets out the artefacts that serve both readers.

Sources for this page: the HIPAA statements are read in the eCFR text of 45 CFR Part 164 as current to 31 August 2026 and in two HHS OCR guidance pages read on 2 September 2026. The HITRUST statements are read in the HITRUST Assessment Handbook version 1.2, the published example HIPAA Compliance Insights Report, the "HITRUST and HIPAA" white paper of April 2023, the MyCSF Subscription Agreement and the External Assessor Program Options document, all read on 2 September 2026.

What do you settle before you answer the questionnaire?

Five questions, in this order. The first two belong to the customer and the last three to you.

The systems you mark at step 3 sit outside the certificate your customer will read and inside the obligation a regulator would examine. Each of them either enters the scope of your 164.308(a)(8) evaluation or carries a written reason for its exclusion. Those two lists are what your evaluation is a statement about, and the certificate says nothing about either of them.