Comparison
HIPAA vs HITRUST
For health tech and healthcare vendors working out what customers really need. HIPAA is a US law you must follow; HITRUST is a certification many healthcare buyers use to check vendors. This page explains how they differ and how they fit together.
Reviewed by CyberWave GRC Team
Side-by-side comparison
| HIPAA | HITRUST | |
|---|---|---|
| What it is | A US federal law (with its Privacy, Security and Breach Notification Rules) that protects health information | A certifiable control framework, the HITRUST CSF, with assessments run by HITRUST |
| Who it applies to | Covered entities and their business associates that handle protected health information | Any organization that chooses it, often because healthcare customers ask for it |
| Is there a certificate? | No. HIPAA has no official certification; you show compliance through risk analysis, policies and evidence | Yes. HITRUST certifies after an Authorized External Assessor validates your controls and HITRUST completes quality review |
| Options | One set of rules; how you meet the Security Rule depends on your risk analysis | e1 (44 foundational controls per CSF v11.9), i1 (182 requirements) or r2 (risk-based and tailored) |
| Validity | Ongoing obligation, with regular risk analysis | e1 and i1 for one year; r2 for two years with an interim assessment |
| Relationship | HITRUST r2 can be used to demonstrate HIPAA safeguards | e1 is not designed to show HIPAA compliance; r2 is the usual choice when HIPAA must be shown |
Questions buyers ask
No. HIPAA is a law you must follow if you handle protected health information. HITRUST is a voluntary certification that many healthcare customers accept as evidence of strong security, and an r2 assessment can be used to demonstrate HIPAA safeguards.
There is no official HIPAA certification. Organizations show compliance through a risk analysis, policies, safeguards and evidence. Some firms sell a HIPAA certificate, but it is not issued by the government.
Not always. HIPAA does not require any certification, but many hospitals, health plans and health tech buyers ask vendors for HITRUST. Ask your customers which evidence they accept.
The r2 assessment is risk-based and tailored, and is the usual choice when you need to show HIPAA safeguards. The e1 is not designed to show HIPAA compliance.
No. We do the readiness work. The validated assessment is done by Huduku AI, an independent HITRUST Authorized External Assessor, and HITRUST performs quality review and issues the certification.