"We need HIPAA and HITRUST": five questions a UK supplier should ask

A healthcare customer's questionnaire may mention HIPAA, HITRUST and ISO 27001 together. That does not make them equivalent requirements or mean that a single document will satisfy the buyer.

Before quoting a completion date, establish what the customer actually needs and how it relates to the service you provide.

1. What relationship and information are involved?

Identify the customer's role, your role and the information your service will handle. HHS explains that HIPAA applies to covered entities and business associates in the relevant circumstances; the relationship and activities matter. HHS guidance.

Ask whether the proposed service will receive, maintain or otherwise handle relevant protected information, and which suppliers or support teams are involved. Do not make a legal conclusion based only on the fact that the product is described as health technology.

2. What evidence will the buyer accept?

A contract review, security questionnaire and independent assessment are different requests. Ask the procurement or security contact to confirm the deliverable, scope and acceptance criteria.

For HITRUST, clarify the expected assessment option rather than selecting one from an abbreviated questionnaire label. HITRUST offers different assurance products; confirm current options with the scheme and the appropriate assessor. HITRUST.

3. Which systems are included?

Identify the product environment, administration, support, data exports and important third parties. If a buyer asks for evidence covering a service, an assessment of a different corporate environment may not answer the request.

Record scope differences early so they do not surface after an assessment has been commissioned.

4. What existing work can be reused?

Your security programme may already contain useful evidence: access reviews, risk assessments, supplier records and incident procedures. Map it against the actual requirement and explain any limits.

Avoid saying that ISO 27001 automatically satisfies HIPAA or HITRUST. Reuse reduces duplicated effort only when the evidence and scope are relevant.

5. Who owns the remaining work?

Separate legal interpretation, technical remediation, readiness consultancy and authorised assessment activities. Build the timetable around those dependencies and the buyer's deadline.

A credible response may be a scoped improvement plan with evidence of progress, if the customer accepts that. It should not be a certification claim that the business cannot substantiate.

ProtectifyAI provides HIPAA readiness support and HITRUST assessment preparation. Start with the customer request and a clear account of the service so the right work is commissioned.