If your product uses models, copilots or AI agents to work with health data, your customers' security questions are changing. Hospitals and payers still want to know how you protect PHI. Now they also want to know how you secure the AI: its inputs, its outputs and what it's allowed to do.
HITRUST's AI Security Assessment is one way to answer. This guide explains who it's for, how it fits with the e1, i1 and r2, how it relates to ISO 42001, and what HITRUST CSF v11.8.0 changed for AI.
Who the AI Security Assessment is for
HITRUST offers the AI Security Assessment for companies providing AI platforms or services. In healthcare, that covers a wide range of products:
- Clinical documentation and ambient scribe tools.
- Patient-facing chat assistants and triage tools.
- Coding, billing and prior authorization automation.
- AI models or platforms that other health tech companies build on.
If you provide AI to customers, it's relevant to you. If you only use AI internally, for example to help your own staff, a standard e1, i1 or r2 may be all your customer needs. Ask them.
Standalone or paired with e1, i1 or r2
You have two options:
| Option | What it means | When it fits |
|---|---|---|
| Standalone AI Security Certification | The AI Security Assessment on its own | Your customer wants assurance about your AI specifically |
| Paired with e1, i1 or r2 | The AI Security Assessment alongside a core HITRUST assessment | Your customer wants both your overall security and your AI covered |
For most health AI vendors selling to hospitals or payers, the customer will also expect a core HITRUST assessment, because you're handling PHI as well as running AI. Our HITRUST assessment chooser recommends the right core assessment and flags the AI option when you tell it you provide AI to customers.
Why healthcare buyers are asking AI vendors for assurance
AI adds risks that a traditional security review doesn't always reach. A model can be manipulated through its inputs. It can reveal data it shouldn't. An AI agent can take an action nobody approved. For a hospital, those risks sit on top of the usual question of how a vendor protects PHI.
Healthcare buyers already rely on HITRUST to assess vendors' security. An AI-specific assessment from the same organization gives them a way to ask about AI risk in a consistent form, rather than writing a new questionnaire for every AI vendor. If you want a deeper look at the technical risks, read our guides to AI agent security and LLM penetration testing.
How it relates to ISO 42001
ISO 42001 and the HITRUST AI Security Assessment both address AI risk, but they're different kinds of thing.
| ISO 42001 | HITRUST AI Security Assessment | |
|---|---|---|
| What it is | A management system standard for AI | A security assessment |
| Focus | How your organization governs AI: roles, risk and impact assessments, policies, monitoring and improvement | The security of the AI platform or service you provide |
| Result | Certification by an accredited certification body | A HITRUST AI Security Certification, standalone or paired with e1, i1 or r2 |
| Who often asks | Enterprise and global customers evaluating AI governance | Healthcare buyers that already use HITRUST to assess vendors |
They work well together. ISO 42001 gives you the governance structure; HITRUST's assessment gives healthcare buyers security assurance in a format they already use. If ISO 42001 is on your list too, see our comparison of the best ISO 42001 consultants.
What HITRUST CSF v11.8.0 changed for AI
HITRUST CSF v11.8.0 was released on 7 May 2026. Among other changes, it added a mapping to the OWASP Top 10 for LLM Applications 2025. That matters for health AI vendors because the OWASP list is a common reference for large language model risks, such as prompt injection and sensitive data disclosure. A mapping means work you do against the OWASP list can be connected to your HITRUST controls.
Read our summary of what changed in HITRUST CSF v11.8.0 for the full list.
How to prepare
- List your AI features. Write down every model, copilot and agent in your product, what data each one touches and what actions it can take.
- Ask your customer what they need. Find out whether they want the AI Security Assessment, a core e1, i1 or r2, or both.
- Decide on standalone or paired. If you also need a core assessment, pairing keeps the work in one project.
- Test the AI itself. Use the OWASP Top 10 for LLM Applications 2025 as a checklist for testing and fixing AI-specific risks.
- Keep evidence. As with any HITRUST assessment, you'll need to show your controls work, not just describe them.
Questions to be ready for
Whatever assurance you choose, health AI vendors should expect detailed questions in security reviews. Prepare clear, written answers to these:
- What data does each model see, and does that include PHI?
- Is customer data used to train or improve models, and how is that controlled?
- Who can change prompts, models or model settings, and how are those changes approved?
- How do you test for prompt injection and other AI-specific attacks?
- Can an AI agent take an action, such as sending a message or changing a record, without a person approving it?
- How are AI inputs, outputs and actions logged, and who reviews the logs?
Good answers, backed by evidence, are the foundation of any AI assessment. They also make your next security questionnaire much faster to complete.
How CyberWave GRC helps
At CyberWave GRC, we run HITRUST readiness for health tech and health AI companies: scoping, gap assessment, remediation guidance, policies and evidence, MyCSF setup and inheritance mapping. The validated assessment is performed by Huduku AI, an independent HITRUST Authorized External Assessor we work with, and HITRUST issues the certification. We never certify our own work.
We also provide ISO 42001 consulting, so if your customers ask for both AI governance and HITRUST, we can map one control set to both. See our HITRUST consulting page to learn more.