HITRUST Certification: e1, i1, and r2 Assessments, Cost, and Timeline

HITRUST certification is the credential HITRUST issues after an Authorized External Assessor validates an organization's controls against the HITRUST CSF and HITRUST's quality assurance team reviews the work. HITRUST offers three certifiable core assessments: the e1, with 44 requirement statements in CSF v11.9 and a one-year term; the i1, with 182 requirement statements and a one-year term; and the r2, a risk-based assessment tailored to the organization that runs two years with an interim assessment at the one-year mark. HIPAA does not require HITRUST, and HHS does not recognize private certifications of Security Rule compliance. Health systems and payers ask vendors for it anyway, because one validated report gives them scored evidence that maps to HIPAA and other frameworks.

BD Emerson's HITRUST work is readiness: we help clients choose the assessment type, run the gap assessment, remediate, and prepare evidence in MyCSF. An Authorized External Assessor performs the validated assessment, HITRUST issues the certification, and BD Emerson is not an External Assessor.

HITRUST, the CSF, and certification defined

HITRUST is the organization that maintains the HITRUST CSF, runs the MyCSF platform, authorizes External Assessor firms, and issues certifications. The CSF is a controls framework that harmonizes requirements from many authoritative sources into requirement statements, and HITRUST releases new versions during the year. As of October 2026, the current release is v11.9.0, which became available on September 24, 2026. It added a mapping to the OWASP Top 10 for Agentic Applications 2026, refreshed the NIST SP 800-53 Rev. 5.2.0 mapping, modified the HIPAA Privacy Rule and Security Rule mappings, and lists the e1 baseline at 44 requirement statements and the i1 at 182 (HITRUST advisory HAA 2026-005). The May 2026 release, v11.8.0, refreshed the mappings to the AICPA SOC 2 Trust Services Criteria and PCI DSS v4.0.1 (HAA 2026-002).

Certification is the result of a validated assessment that clears HITRUST's scoring thresholds. When the scores fall short, the organization receives a validated report without a certification letter, according to the HITRUST Assessment Handbook v1.2. A readiness assessment, which the organization performs itself or with an advisor, produces no certification, and HITRUST recommends one before the validated assessment.

e1 vs i1 vs r2: the three HITRUST assessments

The three assessments differ in how many requirements they test, what they score, and how long the certification lasts. The table summarizes them as of CSF v11.9.

Sources: HITRUST advisories HAA 2026-005 and HAA 2024-008, HITRUST sample e1, i1, and r2 reports, the r2 data sheet, and the HITRUST Assessment Handbook v1.2; read October 2026.

Two details in that table drive more decisions than the requirement counts. HITRUST fixes the e1 and i1 baselines and revises them through CSF releases, so an e1 or i1 must be created on a current version, and HITRUST's September 24, 2026 advisory closes v11.8 to new e1 and i1 assessments at the end of 2026 (HAA 2026-006). The r2, by contrast, is assembled from the scoping and compliance factors an organization selects in MyCSF, so two r2 certifications can contain requirement sets of different sizes, which is why HITRUST's r2 data sheet gives an average instead of a fixed count. Every i1 requirement statement is included in the r2 baseline, which makes an i1 a practical step toward an r2.

The HITRUST AI Security Assessment

HITRUST offers an AI security certification that can be added to an e1, i1, or r2 or pursued as a standalone certification. It introduced the HITRUST AI Security Assessment in an advisory dated December 6, 2024, in which the ai1 certification pairs with an e1 or i1 and the ai2 pairs with an r2 (HAA 2024-008). HITRUST's AI Security Assessment FAQ says the add-on contains no more than 44 AI security requirements, depending on tailoring, drawn from an analysis of 13 AI threats, and requires CSF v11.4.0 or later with the Security for AI Systems compliance factor. The AI certification lasts as long as the core certification it pairs with, and HITRUST will not issue it if the core assessment fails to certify. It is open to organizations that provide AI systems, including AI application and AI platform providers, and CSF v11.9 added an Agentic AI selectable factor to the assessment.

How HITRUST certification works

A HITRUST certification runs through five stages, and the organization, the External Assessor, and HITRUST each own part of it.

1. Scope and select. The organization subscribes to MyCSF, defines the systems, facilities, and data in scope, and chooses the assessment type. For an r2, the scoping and compliance factors generate the requirement statements.
2. Readiness and remediation. The organization, often with an advisor, scores its current controls the way the assessor will, fixes the gaps, and for an r2 writes the policies and procedures the maturity scoring requires.
3. Validated assessment. An Authorized External Assessor tests each requirement statement, samples evidence, and scores the results. The handbook caps validated fieldwork at 90 days for e1, i1, and r2.
4. Quality assurance. The assessor submits the assessment to HITRUST, a HITRUST QA analyst reviews it during a reserved QA block, and the organization has 30 days to review the draft reports before MyCSF approves them automatically.
5. Certification and upkeep. HITRUST issues the report and, when every domain clears the threshold, the certification letter. An r2 holder submits an interim assessment in the 90 days before the one-year anniversary, and a bridge assessment can extend r2 status by 90 days while a renewal is in progress.

How long does HITRUST certification take?

Measured from kickoff to certification letter, BD Emerson's planning ranges are three to six months for an e1, five to ten months for an i1, and eight to fifteen months for an r2, and remediation is the phase that moves them most. The table breaks the ranges into phases.

How HITRUST scoring decides certification

HITRUST scores each requirement statement and certifies only when every assessment domain clears a threshold. In an e1 or i1, the assessor scores implementation alone on a five-step scale that awards 0, 25, 50, 75, or 100 percent of the points from non-compliant to fully compliant, according to the HITRUST Control Maturity Scoring Rubric. Each domain needs a straight average of at least 83, and a requirement scoring below 100 needs a corrective action plan when its control reference averages below 80, per HITRUST's sample i1 report. Run the arithmetic on a ten-requirement domain: seven fully compliant requirements and three mostly compliant ones average 92.5 and pass, while five fully compliant and five partially compliant average 75 and fail.

The r2 scores five maturity levels with different weights. HITRUST's sample r2 report shows policy worth 15 points, procedure 20, and implemented 40, with measured and managed together worth the remaining 25, and each domain needs a straight average of at least 62. Organizations can certify without scoring measured and managed, which caps each requirement at 75. That weighting is why documentation decides r2 outcomes. A requirement with a complete written policy, no written procedure, and full implementation scores 15 plus 0 plus 40, or 55, and a domain where most requirements look like that averages below the 62 it needs. The same requirement with a documented procedure scores 75. A control that runs well can still fail an r2 domain when the policy and procedure behind it are missing, and most r2 readiness work is the writing that closes that gap.

HITRUST vs SOC 2 vs HIPAA

HIPAA is the law, SOC 2 is a CPA's attestation report, and HITRUST is a certification against a prescriptive framework. They answer different questions, and many healthcare vendors hold two of the three.

HHS states that no Security Rule standard requires a covered entity to certify its compliance, and that "HHS does not endorse or otherwise recognize private organizations' 'certifications' regarding the Security Rule" (HHS FAQ). HHS's risk analysis guidance lists HITRUST's framework among outside resources, describes it as proprietary, and says HHS does not endorse any particular risk analysis or risk management model. A HITRUST certification therefore does not replace the risk analysis that 45 CFR 164.308(a)(1)(ii)(A) requires. Our guide to the HIPAA security risk assessment covers that requirement, and our HIPAA compliance team builds the program around it.

Healthcare buyers ask for HITRUST because it solves their vendor review problem. A health system with hundreds of vendors touching protected health information needs evidence it can compare across vendors, and HITRUST gives it requirement statements mapped to HIPAA, scored on a fixed rubric, tested by an authorized assessor, and reviewed centrally by HITRUST before the certification issues. HITRUST also publishes outcome data: its 2026 Trust Report, released April 7, 2026, states that 99.62 percent of HITRUST-certified environments did not report a security breach in 2025 (HITRUST press release). That figure is HITRUST's own measurement of its own program.

SOC 2 and HITRUST cover much of the same security ground, and the CSF carries a mapping to the SOC 2 Trust Services Criteria. The choice usually follows the customer base: SaaS and technology buyers ask for SOC 2, and health systems and payers ask for HITRUST. Some CPA firms issue a SOC 2+ report that adds HITRUST CSF requirements as additional criteria, and the AICPA's SOC 2 guide includes an illustrative SOC 2+ report. A SOC 2+ remains a SOC 2 and does not produce a HITRUST certification. For the international version of the same decision, see ISO 27001 vs SOC 2, and for SOC 2 readiness, see our SOC 2 practice.

Inheritance from cloud providers

Inheritance lets an organization reuse validated results from a service provider's own HITRUST assessment instead of testing those requirements again. HITRUST's inheritance guide separates fully inheritable requirements, which the cloud provider manages and has already validated, from partially inheritable ones, where the organization still demonstrates its own part of a shared control. The workflow runs in MyCSF: the organization requests inheritance, and the provider approves sharing its results. HITRUST says organizations may inherit as much as 65 to 85 percent of assessment requirements from participating cloud providers such as Amazon, Microsoft, and Google, depending on the CSF version, assessment type, and tailoring.

Two scoping rules matter here. An e1 or i1 can carve out a service provider's controls, while an r2 must include them, so inheritance is how an r2 organization covers a cloud provider's data center controls without testing them itself. Inheritance also stops at the provider's boundary: identity and access in your cloud account, your encryption configuration, logging, and your application controls remain yours to implement and evidence. HITRUST's Shared Responsibility Matrix, a free template with provider-specific versions, is the document to read before you assume a requirement is inheritable.

How much does HITRUST certification cost?

HITRUST certification cost has four parts: HITRUST's own fees for the MyCSF subscription and the assessment, the External Assessor's fee for the validated assessment, readiness and remediation work, and internal staff time. HITRUST quotes its own fees directly, so the table covers the assessor and readiness work. These are BD Emerson planning ranges as of October 2026 for one in-scope environment on a cloud platform with inheritance available.

Five drivers move the number within each range. Scope size comes first, because each additional application, data center, or business unit adds requirement statements and samples. For an r2, the compliance factors you select, such as HIPAA, PCI DSS, or the AI add-on, add requirement statements directly. Inheritance cuts testing when the platform runs on a participating cloud provider. Documentation maturity matters most for an r2, because missing policies and procedures become remediation hours. The last driver is the number of gaps the readiness assessment finds, since remediation is usually the largest variable cost.

How to choose e1, i1, or r2

Choose the assessment your contracts name, and when they name none, choose the lowest assessment your largest customers accept. BD Emerson's decision rule has three tests. First, read the contract or security addendum: if it says r2, only an r2 satisfies it, and if it says "HITRUST certified" without a type, ask the customer's vendor risk team which type it accepts before you scope anything. Second, size the risk you carry for customers: a vendor handling limited data, or a startup winning its first health system contract, can start with an e1 when the contract allows it, while a vendor holding protected health information at scale for health systems and payers usually needs an i1. Third, check what the next contract requires: if an r2 is likely within two years and no customer requires one today, an i1 now is a sound first step, because every i1 requirement statement is part of the r2 baseline and the evidence carries forward.

Choosing an r2 when an i1 satisfies every customer costs months and budget for no commercial gain, and choosing an e1 when a customer's contract names an i1 costs a second assessment. Settle the type with your customers before anyone opens MyCSF.

What BD Emerson does in a HITRUST program

BD Emerson's role is readiness. We handle assessment type selection, scoping in MyCSF, a gap assessment scored to HITRUST's rubric, remediation, and evidence preparation in MyCSF, and we support the validation phase by answering the assessor's evidence requests and managing corrective action plans. A HITRUST Authorized External Assessor performs the validated assessment, and HITRUST performs quality assurance and issues the certification. BD Emerson is not an External Assessor.

Frequently asked questions

Is HITRUST certification required by HIPAA? No, HIPAA does not require HITRUST or any other certification, and HHS states that it does not endorse or recognize private organizations' certifications regarding the Security Rule. Covered entities and business associates must still perform their own risk analysis and meet the Security Rule. Health systems and payers often require HITRUST from vendors by contract, because it gives them independently validated, scored evidence that maps to HIPAA.

What is the difference between HITRUST e1, i1, and r2? The e1 covers 44 foundational requirement statements and lasts one year. The i1 covers 182 leading-practice requirement statements and also lasts one year. The r2 is tailored to the organization's risk factors, averages about 360 requirement statements by HITRUST's figures, scores up to five maturity levels instead of implementation alone, and lasts two years with an interim assessment at year one. These counts reflect HITRUST CSF v11.9.

How long is a HITRUST certification valid? An e1 or i1 certification is valid for one year. An r2 certification is valid for two years, provided the organization submits an interim assessment in the 90 days before the one-year anniversary. A bridge assessment can extend r2 status by 90 days while a renewal assessment is still in progress. An AI security certification lasts as long as the core certification it is paired with.

How much does HITRUST certification cost? BD Emerson planning ranges as of October 2026 put the External Assessor's validated assessment at $15,000 to $40,000 for an e1, $35,000 to $80,000 for an i1, and $70,000 to $200,000 for an r2, with readiness and remediation support on top. HITRUST's own MyCSF and assessment fees are separate, and HITRUST quotes them. Scope size, r2 factors, inheritance, and documentation maturity move the total.

What is the difference between HITRUST and SOC 2? SOC 2 is an attestation report in which a licensed CPA firm gives an opinion on controls against the AICPA Trust Services Criteria. HITRUST is a certification that HITRUST issues after an Authorized External Assessor scores controls against prescriptive CSF requirement statements and HITRUST reviews the work. Technology buyers usually ask for SOC 2, while health systems and payers usually ask for HITRUST, and many healthcare vendors hold both.

Can you inherit HITRUST controls from AWS, Azure, or Google Cloud? Yes, through HITRUST's inheritance program in MyCSF. A participating cloud provider approves your request, and its validated results apply to the requirements it fully or partially performs. HITRUST says organizations may inherit as much as 65 to 85 percent of assessment requirements from participating providers, depending on CSF version, assessment type, and tailoring. Controls inside your own cloud account, such as identity and access configuration, remain yours to evidence.

How long does it take to get HITRUST certified? BD Emerson planning ranges, measured from kickoff to certification letter, are three to six months for an e1, five to ten months for an i1, and eight to fifteen months for an r2. Remediation drives most of the variation. HITRUST's assessment handbook caps validated assessment fieldwork at 90 days, and HITRUST's quality assurance review follows submission before the certification issues.

If a customer contract has put HITRUST on your calendar, our HITRUST readiness team can confirm the assessment type with you, score your current controls against the rubric the assessor will use, and plan remediation before you engage an External Assessor.