When a hospital, payer, or PBM asks for assurance,
HITRUST is what they ask for.

Tier selection is driven by three factors: what your customer is asking for, your organizational risk profile, and your revenue-stage maturity.

The e1 (Essentials, 1-year) is the entry-level certification, focused on cyber hygiene at 44 standardized requirement statements. It is appropriate for growth-stage startups whose healthcare prospect needs validated third-party assurance but where SOC 2 alone is not enough — the "minimum viable HITRUST" for closing initial healthcare deals without burning six months of runway. Typical cost: ~$35K.

The i1 (Implemented, 1-year) is the middle tier with approximately 182 requirement statements offering moderate assurance. It is the most common HITRUST engagement tier and the right answer when a hospital system, health plan, or enterprise healthcare buyer requires demonstrated control implementation effectiveness. Includes a Rapid Recertification option in year two for organizations whose control environments have not materially changed. Typical cost: ~$70K first year.

The r2 (Risk-Based, 2-year) is the comprehensive certification with 360+ requirement statements selected based on scoping factors. Appropriate for organizations whose customers explicitly require r2, organizations with high inherent risk (large PHI volumes, complex data flows), and organizations where program maturity is fully there and the cost is justified. Typical cost: $100K+ first year.

The three tiers are designed as a maturity pathway — i1 requirements are Core in r2, e1 work can be built upon, and organizations frequently start at e1 or i1 and graduate to r2 over 12–24 months.

The two attestations serve different purposes and different gatekeepers in the healthcare ecosystem.

SOC 2 is a US enterprise B2B contract gate — required when your customer's procurement, security review, or contract demands a Type I or Type II report. SOC 2 reports describe your control environment and are evaluated against the Trust Services Criteria. They are widely accepted in commercial B2B but are not natively designed for healthcare-specific scoping.

HITRUST is the healthcare ecosystem's preferred third-party assurance. When a hospital system, health plan, payer, pharmacy benefit manager, or large healthtech customer demands attestation from a vendor in 2026, HITRUST is increasingly what they ask for — not because SOC 2 is inadequate as a control framework but because HITRUST natively integrates HIPAA, the HITRUST Shared Responsibility Matrix is the framework's native answer to Business Associate vendor scoping, and the HITRUST-issued certification carries a level of assurance that healthcare customers' vendor risk management teams have built their processes around.

Practical reality: most healthcare-ecosystem vendors in 2026 end up running both. SOC 2 Type II for general B2B contract scrutiny; HITRUST e1 or i1 for healthcare-specific customer demand. Approximately 50–60% of SOC 2 Common Criteria controls overlap with HITRUST e1 / i1 requirements, so the second framework is meaningfully cheaper than a cold start.

The strategic question is sequencing: if your most pressing deal is healthcare, HITRUST first; if it's enterprise B2B with healthcare as a secondary segment, SOC 2 first.

HITRUST CSF v11.7 is the current version of the framework, the latest in the v11 family that began with v11.0 in early 2023 and has been refined through point releases (v11.3.0 added NIST SP 800-172 and MITRE ATLAS as authoritative sources).

The transition from v9 to v11 introduced fundamental changes:

First, the three-tier portfolio (e1 / i1 / r2) replaced the older single-track validated assessment model. The bC assessment from v9 was retired and replaced by e1. The i1 was restructured to be the bridge tier with a Rapid Recertification option. The r2 baseline was moved to use i1 requirements as Core — meaning lower-tier assessment work is now reusable in higher-tier assessments.

Second, requirement counts were reduced through better mapping and threat-adaptive analysis: i1 dropped from 219 statements in v9 to approximately 182 in v11. Mapping and maintenance effort was reduced by up to 70%. The level of effort to achieve and maintain i1 over two years was reduced by approximately 45%.

Third, the Cyber Threat Adaptive program was added — continuous integration of real-world threat intelligence directly into the framework. Q1 2026 coverage of observed adversarial AI techniques was measured at 98.19% for e1/i1 assessments and 100% for r2.

Fourth, the HITRUST AI Security Certification was added as a separate tier for organizations operating AI-enabled systems. v9.1–9.4 libraries were removed from MyCSF on March 31, 2026 — organizations on those versions can no longer create new assessments and must transition to v11.

The HITRUST AI Security Certification is a separate validated assessment tier introduced specifically to address the security of AI-enabled systems. It evaluates the controls an organization has in place to defend against AI-specific attack techniques — prompt injection, training data poisoning, model extraction, adversarial inputs, AI agent manipulation, and the increasingly prevalent attacker use of synthetic text, visual deepfakes, and audio deepfakes for phishing and social engineering.

The certification is informed by HITRUST's Cyber Threat Adaptive program, which produced a Q1 2026 analysis specifically focused on AI-enabled attacks. The AI Security Certification maintained over 97% coverage of adversarial AI techniques observed during that period.

The certification is appropriate for: organizations deploying AI in production, AI platform companies whose enterprise customers demand demonstrated AI security maturity, clinical decision support systems and other healthcare AI applications, and any organization where the next vendor risk questionnaire asks specifically about AI security controls (a question that has become increasingly common in 2025–2026 healthcare procurement).

Unlike e1/i1/r2 which assess general information security, the AI Security Certification is specifically scoped to AI-related controls and can be pursued alongside any of the general tiers.

The HIPAA Security Rule Overhaul finalizing in May 2026 fundamentally changes HIPAA's enforcement posture from broadly principles-based to prescriptive control requirements — closer in structure to NIST 800-53 or PCI DSS than to the original 2003-era Security Rule.

Specific control requirements (multi-factor authentication, encryption at rest, vulnerability scanning cadence, documented technology asset inventories, network segmentation expectations, incident response plan testing requirements) become explicit rather than implied.

For Covered Entities and Business Associates, this means that demonstrating HIPAA compliance through general representations no longer satisfies regulatory expectations.

The Overhaul significantly increases HITRUST's value proposition because HITRUST CSF v11.7 already maps HIPAA Security Rule requirements at the prescriptive control level through its native HIPAA authoritative source integration. Organizations with a current HITRUST i1 or r2 certification will demonstrate compliance with most or all of the Overhaul's new prescriptive requirements through their existing HITRUST control set — the mapping work has already been done.

Organizations relying on a checklist HIPAA approach face significant remediation work to reach the new bar. The 2026 driver for HITRUST adoption is meaningfully shaped by this regulatory shift: healthcare customers' vendor risk management teams are increasingly requiring HITRUST attestation in part because it provides defensible evidence of compliance with the Overhaul's prescriptive expectations.

The HITRUST validated assessment is performed by an Authorized HITRUST CSF External Assessor — an independent firm credentialed by HITRUST Alliance (major Authorized External Assessor firms include A-LIGN, Coalfire, Tevora, Accorian, and Schellman, among others).

The assessor is selected from the HITRUST-published list and engaged separately from any readiness or advisory firm — there is a deliberate separation between organizations that help you prepare and the organization that performs the validated assessment.

The assessment proceeds in three phases:

First, the assessor reviews the MyCSF platform package the organization has authored. Each requirement statement is scored across five PRISMA-derived dimensions: Policy, Process, Implemented, Measured, Managed.

Second, the assessor performs on-site fieldwork (or remote-equivalent): walkthroughs of implemented controls, evidence sampling and validation, interviews with control owners, and verification testing of automated controls.

Third, the assessor submits the completed validated assessment package to HITRUST Alliance for final Quality Assurance review. The HITRUST QA review is the final external accountability moment — HITRUST itself reviews the assessor's work, may issue findings or require additional evidence, and ultimately issues the certification.

This QA step is distinctive to HITRUST and is part of why HITRUST certifications carry the assurance level they do in the healthcare ecosystem — the assessment is reviewed twice.