HITRUST e1 and SOC 2 for a US health-tech company

The challenge

The company sells software to US healthcare organisations that handle PHI. Customers were asking for both SOC 2 and HITRUST, and the team didn't want to run two separate compliance programmes for five platforms.

What we did

• Built one common control set covering SOC 2 and the HITRUST e1 requirements, so each control was implemented and evidenced once.
• Ran a gap assessment against the HITRUST e1 requirements for CSF v11.8 in a structured workbook.
• Wrote a complete library of 30 policies and 11 procedures in the client's own document template, using role titles rather than names so it stays valid as people change.
• Mapped the client's actual stack into the controls: Google Workspace for identity and device management, CrowdStrike Falcon for endpoint protection, a client VPN for remote access, GitHub for source control and ADP for HR.
• Added HIPAA business associate language to the SOC 2 system description and drafted a breach notification policy aligned with 45 CFR §164.410.
• Caught and resolved a conflict between two breach notification timelines in different policies before the assessor found it.
• Prepared the team for the HITRUST validated assessment, performed by an Authorized External Assessor.

Timeline

1. Scoping, gap assessment and the common control set
2. Policy library and remediation
3. SOC 2 examination and HITRUST e1 validated assessment, both completed within four months

Results

• HITRUST e1 certification achieved.
• SOC 2 Type II report achieved.
• Both delivered within the four-month timeline.
• One policy library and one control set serving SOC 2, HITRUST and HIPAA.

What made it work

Building once and mapping many times. With SOC 2 and HITRUST sharing most of their security controls, a single common control set removed most of the duplicated work, and the policy library written for HITRUST also answers HIPAA questions from customers.