Who Needs HITRUST Certification
HITRUST is not legally mandated, but it has become a practical requirement for many organizations in and around healthcare. Understanding who is driving the demand and who needs to respond is key to deciding whether to pursue HITRUST — and at what level.
Organizations That Typically Need HITRUST
Health Technology Companies (Health IT / Digital Health)
Electronic health record (EHR) vendors, telehealth platforms, patient engagement platforms, remote patient monitoring companies, and other health tech vendors are among the most frequent pursuers of HITRUST certification. Major health systems routinely require HITRUST as a condition of vendor contracts.
Business Associates Under HIPAA
Companies that create, receive, maintain, or transmit PHI on behalf of a covered entity are HIPAA business associates. HIPAA requires covered entities to have signed Business Associate Agreements (BAAs) in place. Many large health systems and payers now require their business associates to hold HITRUST certification as evidence that HIPAA security requirements are actually implemented — not just acknowledged in a BAA.
Healthcare SaaS Companies
SaaS companies providing services to healthcare organizations — including HR software, financial management, document management, communication tools, and analytics — often need HITRUST to close enterprise healthcare deals. Procurement teams at large health systems frequently require HITRUST before approving new vendors.
Medical Device Manufacturers (Connected Devices)
Manufacturers of connected medical devices — particularly devices that transmit patient data — may need HITRUST to meet the security requirements of health system IT departments before devices are approved for clinical use.
Health Insurance and Managed Care Organizations
Health insurance companies, managed care organizations, pharmacy benefit managers (PBMs), and other payers often seek HITRUST to demonstrate to regulators, employers, and their own vendor ecosystem that they meet rigorous security standards.
Pharmaceutical and Life Sciences Companies
Pharmaceutical companies, contract research organizations (CROs), and life sciences firms that handle patient data from clinical trials or pharmacovigilance programs may need HITRUST as a market requirement when partnering with health systems.
Healthcare Revenue Cycle Management (RCM) Companies
Medical billing, coding, and revenue cycle management companies access sensitive PHI and financial data. Health system clients increasingly require HITRUST from RCM vendors.
Organizations That Typically Don’t Need HITRUST
- Small independent physician practices: HIPAA compliance is the primary requirement; HITRUST is generally not required of small practices
- Healthcare organizations that do not accept outside vendor data or partner with large health systems: HIPAA is sufficient
- Non-healthcare companies with no PHI: HITRUST is healthcare-specific
What Level Do You Need?
The right HITRUST level depends on what your customers require and your organization’s risk profile:
e1: Appropriate when customers require “HITRUST certified” but don’t specify level, or when you’re earlier in your compliance journey and want to establish a foundation before pursuing r2.
i1: Appropriate for organizations that want a more robust certification than e1 but face lower-risk scenarios. Increasingly accepted by health systems as a valid alternative to r2 for lower-risk vendor relationships.
r2: The gold standard and what most large health systems and payers require when they mandate HITRUST. Required for vendor relationships involving higher-risk PHI access, system integrations, or sensitive data flows.
If your customer says “we require HITRUST,” always clarify which level they accept — many organizations still default to r2, but acceptance of e1 and i1 is growing.
How Espresso Labs Helps
Espresso Labs helps healthcare vendors and business associates build the security programs required for HITRUST certification — from initial readiness assessment through remediation and ongoing maintenance. We implement the technical controls across all 19 HITRUST domains as a managed service, significantly reducing the time and cost to achieve and maintain certification. Contact us to discuss your HITRUST certification path.