Free tool
HITRUST assessment chooser
A hospital, payer or partner has asked for HITRUST, but which one? Answer eight questions and we'll recommend e1, i1 or r2, explain why, and show you the fastest sensible path.
How the chooser works
The chooser asks eight short questions about the things that decide which HITRUST assessment fits: whether a customer has named a specific assessment, how much protected health information (PHI) you store or process, who your main customers are, where your security program is today, whether you need to show HIPAA or NIST CSF compliance, whether your product provides or uses AI, when you need the certification, and where your systems are hosted.
Each answer moves the recommendation toward e1, i1 or r2. The e1 covers 44 foundational security controls (per CSF v11.9) and suits startups and companies with a limited risk profile. The i1 has 182 control requirements for organizations with an established security program. The r2 is the most comprehensive, risk-based assessment, valid for two years, and fits organizations that must show HIPAA or NIST CSF compliance or serve large health systems and payers. If your customer has already named an assessment, that comes first, because the one they accept is the one you need.
You'll see the recommended assessment, the reasons behind it, a suggested path and next steps. Your answers stay in your browser unless you ask us for a roadmap. For a side-by-side comparison of all three, read our guide to HITRUST e1 vs i1 vs r2.