Key Takeaways

•       HIPAA is a US federal law. It sets legal requirements for protecting patient health information, it isn’t a certification you can buy or a badge you can display.
•       HITRUST CSF is a certifiable framework. It harmonises HIPAA, NIST, ISO 27001 and other standards into one structured set of controls that an independent assessor validates.
•       Being HIPAA compliant does not automatically mean you’re HITRUST certified, and HITRUST certification doesn’t remove your legal HIPAA obligations either.
•       HITRUST has three assessment tiers: e1, i1 and r2, so the cost and effort scale from tens of thousands of dollars to several hundred thousand, depending on risk and organisational size.
•       Healthcare has been the most expensive industry for data breaches for 14 consecutive years, according to IBM’s 2025 Cost of a Data Breach Report, averaging $7.42 million per incident.
•       The right choice depends on business goals: a small private practice may only need HIPAA compliance, while a healthcare SaaS vendor selling into hospital networks will often need HITRUST to win the deal.

A growing healthcare software company has just made it through the final stage of vendor due diligence with a major hospital network. The demo landed well. Pricing is competitive. The relationship with procurement feels strong.

Then the security questionnaire arrives: “Are you HIPAA compliant? Do you also hold HITRUST certification?”

The company answers the first question confidently; yes, they’re HIPAA compliant, and they can point to a risk analysis, a designated privacy officer, and sign business associate agreements to prove it. The second question is where things stall. Their legal counsel has told them HIPAA compliance is legally required; their sales team has just discovered that a growing number of hospital networks, insurers and enterprise healthcare buyers now treat HITRUST certification as table stakes before they’ll sign a contract.

This confusion is common, and it isn’t a knowledge gap so much as a framing problem. HIPAA and HITRUST get talked about as if they’re competing certifications, when really they answer two different questions. HIPAA asks: are you legally allowed to handle this patient data? HITRUST asks: can you independently prove your security controls are mature enough to be trusted with it? Understanding that distinction and knowing which one (or both) your organisation actually needs is the difference between a compliance programme that protects the business and one that quietly becomes a bottleneck to growth.

Why Healthcare Compliance Is More Complex Than Ever

Healthcare has held the unwanted title of the most expensive industry for data breaches for 15 consecutive years. IBM’s 2025 Cost of a Data Breach Report puts the average healthcare breach at $7.42 million, which is down from $9.77 million the year before, but still far above every other sector, and breaches in the industry still take an average of 279 days to identify and contain, well above the cross-industry average.

The regulatory backdrop has grown heavier too. HHS’s Office for Civil Rights has logged well over 7,600 large healthcare data breaches since it began publishing its public breach summary in 2009, and cumulative affected individuals now number in the hundreds of millions, driven in part by mega-breaches like the 2024 Change Healthcare ransomware attack, which alone exposed the protected health information of roughly 192.7 million people.

Meanwhile, the compliance landscape has quietly stopped being a single checklist. A modern healthcare organisation may need to satisfy HIPAA as a legal minimum, HITRUST or SOC 2 to win enterprise contracts, state-level privacy laws for specific regions, and increasingly, AI-specific risk requirements as machine learning tools touch clinical and billing workflows. Organisations that treat these as one undifferentiated “compliance” bucket often end up either under-investing in what’s legally required, or over-investing in certification their business doesn’t actually need yet. 

What exactly is HIPAA ?

The Health Insurance Portability and Accountability Act (HIPAA) is a US federal law, not a certification. It’s enforced by the HHS Office for Civil Rights, and it applies automatically to any organisation that meets its definitions so there’s no opt-in and no badge to earn. If your organisation is a healthcare provider, health plan, healthcare clearinghouse, or a business associate that creates, receives, stores or transmits protected health information (PHI) on their behalf, HIPAA already applies to you.

Who Has to Comply and What Happens If You Don’t

Both covered entities (providers, payers, clearinghouses) and their business associates like vendors, SaaS platforms, billing companies, cloud hosts, and anyone else handling PHI on a covered entity’s behalf carry direct legal liability under HIPAA. Penalties scale with the degree of negligence involved, and the current civil monetary penalty cap sits at just over $2.19 million per violation category, per year, adjusted for inflation annually. Multi-year, systemic non-compliance is where the largest settlements tend to occur. 

What HITRUST Actually Does

The Health Information Trust Alliance  was founded in 2007 specifically to solve the problem HIPAA’s flexibility creates: if the law tells you what to protect but not exactly how, how does a hospital or insurer evaluate a vendor’s security posture without redoing that analysis themselves every time? HITRUST’s answer was the CSF (Common Security Framework), a certifiable framework that harmonises requirements from dozens of authoritative sources including HIPAA, NIST, ISO 27001, PCI DSS and GDPR into a single, structured set of controls organised across 14 control categories.

Unlike HIPAA, HITRUST certification is voluntary, and unlike HIPAA, it’s independently validated. An accredited third-party assessor tests your controls directly, submits findings through HITRUST’s MyCSF platform, and HITRUST itself performs a quality assurance review before issuing certification. That extra layer of independent verification is exactly why HITRUST has become the framework health plans and large health systems increasingly name specifically when evaluating vendors and business associates.

HIPAA vs HITRUST: Key Differences

Once the two frameworks are separated from each other, most of the confusion clears up. HIPAA is a legal floor everyone in scope must meet. HITRUST is a ceiling, an optional, independently verified demonstration that you’ve gone well beyond the floor.

Furthermore, there is  so much of modern patient data now living in Microsoft Azure, AWS Healthcare or Google Cloud Healthcare environments, cloud security services play a central role in keeping electronic health records properly configured under the shared-responsibility model, well before an assessor or an OCR investigator ever asks to see the evidence.

The same applies at the network layer. Hospital networks increasingly connect medical devices, administrative systems and remote clinicians on the same infrastructure, which makes managed network security services essential for segmentation, secure communications and reducing the blast radius of any single compromised device.

Can You Be HIPAA Compliant Without HITRUST?

Yes and for a large share of the healthcare market, this is the right and sufficient answer. A solo practitioner, a small clinic, or a regional provider with no enterprise vendor relationships can meet every one of HIPAA’s legal obligations through a proper risk analysis, documented policies, staff training and appropriate safeguards, without ever pursuing HITRUST. HITRUST wasn’t designed to replace HIPAA compliance; it was designed to prove it convincingly to a third party who doesn’t want to take your word for it.

The distinction matters commercially, not just legally, because it’s a legal requirement versus a certification decision, and those are evaluated differently.

Does HITRUST Automatically Cover HIPAA?

Not entirely, and this is where organisations sometimes over-trust a certificate. Because the HITRUST CSF maps its controls to HIPAA’s Security Rule requirements, a HITRUST-certified organisation will typically satisfy most of HIPAA’s technical and administrative safeguard expectations as a byproduct of certification. HITRUST even offers scoping factors that reference HIPAA explicitly, which is part of why health plans treat certification as strong evidence of HIPAA alignment.

But HITRUST certification is not a legal substitute for HIPAA compliance. Obligations like maintaining valid business associate agreements, honouring patient access and amendment rights under the Privacy Rule, and meeting HIPAA’s specific breach notification timelines sit outside what a HITRUST assessor tests. A certified organisation that lets its business associate agreements lapse, or mishandles a patient’s records request, can still face an HHS enforcement action despite holding a current HITRUST certificate. Certification and legal compliance need to be maintained as two connected, but distinct, programmes.

Both HIPAA risk analyses and HITRUST assessments live or die on documented evidence; many healthcare organisations begin their journey with structured IT compliance services to identify gaps before they become failed audits or missed contract requirements, rather than discovering them during a live assessment. 

Which Framework Fits Your Organisation?

The right answer depends less on organisation type and more on who’s asking for proof, and how much risk sits on the table. Three common scenarios illustrate how this plays out in practice.

Example 1: The Private Clinic

A small multi-provider clinic handles patient records for a local community. It has no enterprise vendor contracts, no health-plan relationships requiring independent assurance, and a manageable, well-scoped IT environment. HIPAA compliance, a documented risk analysis, staff training, encrypted patient portals, and signed BAAs with its EHR vendor, meets every legal obligation. HITRUST would add cost and administrative overhead without a commercial driver to justify it.

Example 2: The Healthcare SaaS Provider

A healthcare SaaS company selling scheduling and care-coordination software to hospital networks keeps losing enterprise deals at the security-review stage, even though it’s demonstrably HIPAA compliant. Procurement teams at larger health systems want independently verified proof, not a self-reported questionnaire. Pursuing HITRUST i1 or r2 certification directly unlocks the enterprise segment it’s trying to sell into, turning a stalled sales pipeline into closed contracts.

Example 3: The Medical Billing Company

A medical billing company acts as a business associate to dozens of provider clients, each of whom periodically sends its own security questionnaire as part of vendor due diligence. Instead of completing a new bespoke assessment for every client relationship, the company pursues HITRUST certification once and uses it to satisfy the majority of incoming vendor-risk requests, cutting the time sales and compliance teams spend on repetitive due diligence.

Cost, Time and Resource Comparison

Budget conversations are usually where HITRUST decisions stall, so it’s worth being direct about the range. Figures vary by assessor, organisational complexity and starting security maturity, but the following ranges reflect current 2026 market data compiled across multiple HITRUST-authorised assessment firms.

Building a Healthcare Security Strategy Beyond Compliance

Compliance frameworks, whether HIPAA or HITRUST, describe a minimum bar and a maturity benchmark, they were never designed to be a complete cybersecurity strategy on their own. The organisations that fare best treat compliance as the by-product of good security practice, not the goal itself.

In practice, that means extending the same discipline used to prepare for a HIPAA risk analysis or a HITRUST assessment into everyday operations: continuously monitoring the cloud environments that host electronic health records, hardening the hospital and clinic networks that connect medical devices and administrative systems, and treating every new vendor or AI tool as a fresh scoping exercise rather than an afterthought.

For organisations building or refreshing their public-facing patient portals and websites, it’s worth pairing compliance work with the fundamentals covered in Website Security Essentials, since patient-facing web properties are frequently in scope for both HIPAA risk analyses and HITRUST assessments.

Organisations that have already worked through UK-focused certification schemes may recognise the pattern from Cyber Essentials Plus, an independently verified audit that, much like HITRUST, exists because self-reported compliance alone no longer satisfies procurement teams, insurers and regulators.

Final Thoughts: Complementary, Not Competing

HIPAA and HITRUST serve different but complementary roles in healthcare cybersecurity. While HIPAA establishes the legal foundation for protecting patient information, HITRUST offers a comprehensive framework for demonstrating mature security practices. Organisations that align compliance with proactive cybersecurity are better positioned to protect sensitive health data, build stakeholder trust, and meet evolving regulatory expectations.

Elite IT Team helps healthcare organisations strengthen their security posture, prepare for compliance assessments, and build resilient IT environments that support long-term growth.