Everything about HITRUST certification

The healthcare sector holds a vast amount of sensitive data, making it an attractive target for malicious actors. To safeguard this information, healthcare organizations aim to obtain HITRUST (Health Information Trust Alliance) certification, which sets the standard for data protection.

According to their website, “HITRUST has championed programs that safeguard sensitive information and manage information risk for global organizations across industries and throughout the third-party supply chain.”

What is HITRUST certification?

HITRUST certification is a cybersecurity certification developed by the HITRUST Alliance. It encompasses a set of specifications and controls that cover various aspects of data security and handling in the healthcare space. The primary objective of HITRUST certification is to ensure information security for health information networks through an independent assessment.

HITRUST Certification offers three levels of assurance: self-assessment, CSF-validated, and CSF-certified. The highest level, CSF-certified, indicates that an organization has met all certification requirements and aligns with frameworks such as HIPAA (Health Insurance Portability and Accountability Act). Although HITRUST aligns with HIPAA, it does not replace HIPAA compliance.

Read more: What is HITRUST CSF certification? 

Why is HITRUST certification important?

Obtaining HITRUST certification is necessary for organizations, especially in the healthcare industry. Here are some compelling reasons why you should consider pursuing HITRUST certification:

• Widely accepted security framework: HITRUST is recognized as a widely accepted security framework in the United States. Its CSF certification, particularly the r2-validated assessment, is considered the gold standard for information protection. The comprehensiveness and depth of the review it offers make HITRUST a required accreditation for healthcare organizations.
• Integration of authoritative sources: HITRUST incorporates requirements from authoritative sources such as NIST (National Institute of Standards and Technology), ISO 27001, PCI (Payment Card Industry), and more. By integrating about 2000 controls into one framework, HITRUST enables organizations to build an effective information protection program.
• Adaptability to emerging threats and regulatory changes: HITRUST continually updates its policies and programs to stay abreast of threats and regulatory requirements. 
• Rigorous assessment process: The assessment submitted by an external assessor undergoes 150 automated quality checks and five independent quality reviews. This rigorous assessment process demonstrates that achieving HITRUST certification is no easy feat and enhances an organization's public perception.

Read also: What does HITRUST CSF certification mean? 

HITRUST certification requirements

The HITRUST framework consists of controls grouped into categories, each with its implementation requirements. The requirements are divided into three progressive implementation levels: Level 1, Level 2, and Level 3. Level 1 includes the minimum requirements, while Level 2 builds upon Level 1 with additional requirements. Level 3 encompasses everything from Levels 1 and 2, along with more detailed requirements. 

The implementation levels consider an organization's risk factors, regulations, resources, and the type of HITRUST assessment being conducted. Additionally, HITRUST allows organizations to include specific community requirements, industry groups, cooperative sharing agreement standards, and other regulatory factors during the assessment.

Steps to achieve HITRUST certification

The HITRUST certification process typically involves several stages, from initial assessment to final certification. While the duration of the process may vary depending on the size and complexity of the organization, we will outline the general steps involved in achieving HITRUST certification.

Step 1: Readiness assessment

The Readiness Assessment, now known as the HITRUST Basic, Current-State (bC) Assessment, serves as the first phase of the certification process. This self-assessment phase leverages the HITRUST CSF tools and methods. Organizations can work with HITRUST approved external reviewers to facilitate the process and receive guidance.

Step 2: Remediation gap analysis

After completing the readiness assessment, the project coordinator or HITRUST authorized external assessor may recommend strategies for improvement. HITRUST regulations are constantly evolving, so regular assessments are necessary to bridge any gaps in the security program. A thorough gap analysis helps identify operational procedures, policies, access controls, and documentation that need to be updated to align with the current HITRUST CSF requirements.

Step 3: Validation assessment

During the validation assessment, the assessor tests the controls defined in each designated category. This assessment usually includes on-site risk assessments, interviews with certain personnel, review of supporting documents and security measures, sampling, penetration testing, and vulnerability scans. Each requirement is evaluated based on attributes such as policy, process/procedure, and implementation, and the organization is scored accordingly. The assessment results are then reviewed and validated by authorized personnel before being submitted to HITRUST for approval.

Step 4: Quality assurance review

Once a validated assessment is complete and submitted for review, HITRUST conducts various testing techniques to ensure the appropriate implementation of security controls. This quality assurance review typically takes four to eight weeks. The HITRUST quality assurance review adds an extra layer of reliability to organizations that rely on the assurances provided by entities that have undergone a HITRUST assessment. After the review, a final HITRUST CSF validated assessment report is released, either with certification or without, depending on the results.

Step 5: HITRUST certification

After completing the review and meeting all the security control requirements of the HITRUST framework, the organization is eligible for HITRUST certification. The HITRUST external assessor oversees the scoring of all assessments, and HITRUST approves and certifies them.

The timeframe to achieve HITRUST certification can vary depending on an organization's size and complexity. Generally, the certification process can take up to 18 months, including the readiness assessment, remediation and gap analysis, validation assessment, and review and HITRUST accreditation process.

How much does HITRUST certification cost?

The cost of HITRUST certification can vary based on several factors, including organizational size, security maturity, and level of compliance. Direct costs for certification typically include access to the MyCSF corporate portal, gap analysis, readiness assessment, validation testing, and consultation costs if required. Indirect costs may include internal resource costs, technological deployments, ongoing compliance costs, and remediation efforts.

At the lower end, direct costs for HITRUST CSF certification can start from $30,000, but the overall costs can exceed $160,000. The complexity of IT systems and the extent of sensitive data utilization can also influence the risk level and total cost. Conducting a readiness assessment allows the assessor to estimate the organization's unique risks and budget appropriately for the entire HITRUST certification process.

This makes you wonder if it's worth the cost, according to HITRUST, “It depends. If your organization has little or no access to sensitive data, you may not need HITRUST. A simple attestation, like a SOC 2, might be enough. However, if you maintain or access high stakes, sensitive data like medical, payment, customer, or employee data; if your security practices are subject to regulation; if protecting your organization and its officers from liability is important; or if your customers want proof that you are safeguarding the data they entrust to you, HITRUST certification is more than worth it.”

Challenges in achieving HITRUST certification

While HITRUST certification offers benefits, it is not without its challenges. Organizations may face the following hurdles during the certification process:

• Preparation and documentation: Achieving HITRUST certification requires a massive amount of preparatory work and detailed documentation. Organizations must invest time and effort in ensuring all compliance requirements are met.
• Identifying weaknesses and remediation: The assessment process may identify weaknesses in an organization's security program. Addressing these weaknesses and implementing necessary changes can be time-consuming and resource-intensive.
• Cost considerations: Getting new systems and policies in place to resolve security and compliance issues can be expensive. Organizations must budget for the costs associated with HITRUST certification, including direct and indirect costs.
• Coordination across systems and business units: Large organizations may face challenges in coordinating and rolling out security measures across various systems and business units. Ensuring consistent implementation and compliance throughout the organization can be complex.
• Ongoing compliance and framework changes: Staying certified requires periodic assessments and keeping up with framework changes. Organizations must allocate resources to maintain compliance and adapt to changing regulations.

Paubox and HITRUST

At Paubox we take securing your data seriously and it's embedded into our company culture. Which is why we are very proud to have Paubox Email Suite Standard, Plus, and Premium, Paubox Email API, and Paubox Marketing achieve HITRUST CSF Certified status. HITRUST CSF Certified status demonstrates that our solutions have met regulatory requirements and industry-defined requirements and are appropriately managing risk.

This achievement places Paubox in an elite group of organizations worldwide that have earned this certification. By including federal and state regulations, standards, and frameworks, and incorporating a risk-based approach, the HITRUST CSF helps organizations address these challenges through a detailed and flexible framework of prescriptive and scalable security controls. At this time we believe Paubox to be the only HIPAA compliant email provider to have their solution achieve HITRUST CSF Certified status. 

Learn more: HIPAA Compliant Email: The Definitive Guide

FAQs

Does HITRUST certification apply to non-healthcare industries?

Although HITRUST was initially created to ensure data security in the healthcare industry, the framework has expanded to encompass security standards in all domains. Organizations in non-healthcare industries that deal with sensitive information can also benefit from HITRUST certification.

Do I need consent to collect and process data if I have HITRUST certification?

HITRUST certification focuses on establishing a security and privacy framework. While HITRUST certification can be instrumental in compliance efforts, organizations must still adhere to applicable data protection laws and regulations, such as obtaining appropriate consent for data collection and processing.

Is HITRUST certification valid for a specific duration?

HITRUST certification (r2) is typically valid for 24 months. However, organizations are required to undergo an interim assessment after 12 months to ensure the ongoing effectiveness of implemented controls.

Can HITRUST certification replace HIPAA compliance?

No, HITRUST certification does not replace HIPAA compliance. While HITRUST aligns with HIPAA requirements, organizations must still comply with HIPAA regulations separately. HITRUST certification can serve as a foundation for implementing HIPAA controls, but it cannot replace HIPAA compliance.