When a customer requests HITRUST, a useful first conversation establishes the assessment they expect, the service boundary and the date by which they need the result. We support the readiness work that connects that request to your existing security programme.
HITRUST offers different assurance products and assessment routes. We help you confirm the expected option, systems and services in scope, control domains, validity period and customer deadline rather than starting from an abbreviated questionnaire label. Review current programme material with the HITRUST Alliance and the authorised assessor selected for the engagement.
The service is for UK and European health-tech suppliers, cloud platforms, clinical research organisations, insurers, managed service providers and software vendors serving US healthcare buyers. The usual buyer is a compliance director, security lead, CTO or commercial owner whose customer has requested a HITRUST e1, i1 or r2 outcome, asked for an assessment date, or made HITRUST a condition of renewal or onboarding.
It also suits an organisation that has ISO 27001, SOC 2 or a HIPAA programme but cannot efficiently show how existing evidence maps to the customer’s chosen HITRUST scope. The value is not to create a parallel universe of documents; it is to identify what can be reused, what is missing and where the actual assessment boundary differs from the corporate security boundary.
Healthcare procurement teams may send a security questionnaire that names HITRUST without identifying the assessment product, ask for a current validated report, or give a renewal date only a few months away. A supplier may also choose HITRUST to make one control framework legible to multiple US customers, but discover that evidence is inconsistent across products or that a subprocessor was never included in the original scope.
We clarify the customer’s actual ask before recommending a route. A readiness engagement is not the same as an authorised assessment, and an ISO certificate or HIPAA statement does not automatically produce a HITRUST result. Getting that distinction right prevents an expensive assessment of the wrong system or an assurance claim that procurement will reject.
They ask for a defined assessment boundary, asset and data-flow inventory, risk assessment, policy and control evidence, access reviews, vulnerability and configuration records, incident and continuity evidence, supplier oversight, workforce training and management review. They may ask how controls operate across the review period, who owns exceptions and whether cloud or support providers are inside the scope.
The assessment option matters. A narrower validated or foundational route has a different effort profile from a more comprehensive validated assessment, and current programme rules determine what evidence is acceptable. We do not present a historical questionnaire or generic mapping as a substitute for the current requirements and assessor instructions.
We begin with the customer request, current HITRUST material, product architecture, PHI or sensitive-data flows and existing assurance reports. Workshops with security, engineering, privacy, operations and supplier owners establish the in-scope services, locations, identities, integrations and evidence sources. We record assumptions and exclusions so that the boundary can be defended in an assessor conversation.
We map existing ISO 27001, SOC 2, HIPAA, GDPR and internal-control evidence to the selected HITRUST requirements, then test whether it is current, complete and appropriate for the scope. Readiness work can include control-owner sessions, policy and procedure updates, access and vulnerability evidence review, incident and recovery exercises, supplier evidence coordination and a remediation tracker. Before the formal assessment, we run an evidence and interview-readiness review so owners can explain how controls operate rather than search for documents live in the meeting.
Clients receive an assessment-option and scope memo; system and data-flow boundary; control and responsibility matrix; gap assessment; evidence request and index; cross-framework mapping; prioritised remediation plan; supplier and subprocessor evidence log; management-readiness briefing; and a pre-assessment action tracker. We can also create a customer assurance pack that accurately explains the planned assessment without calling readiness a certificate.
For example, an evidence index can link access control to the identity-provider export, approval tickets, quarterly review and leaver sample. It can link vulnerability management to the asset population, scanner output, remediation SLA and exception approval. For resilience, it can link the recovery objective to a dated restore test and the resulting corrective action. Every item has a scope, owner, period and source.
A scoped gap assessment normally takes three to six weeks. The first week confirms the customer expectation and assessment route; weeks two and three cover boundary mapping and owner interviews; the final weeks review evidence, score gaps and agree the remediation plan. Closing material gaps and producing a stable evidence history often takes three to six months. A multi-product group, immature supplier governance or short customer renewal window may require a staged plan and early assessor coordination.
The authorised HITRUST assessment follows its own process, fees and timetable. We help you prepare for it and coordinate questions, but do not promise a result or represent readiness consultancy as the assessment itself.
A SaaS supplier may have an excellent SOC 2 report but no evidence that privileged access is reviewed for a newly acquired tenant. A clinical platform may have a HIPAA risk analysis that excludes its support-ticket export, while the customer considers that export part of the service. A cloud provider may retain vulnerability findings but have no documented exception owner or closure validation. These are precisely the gaps a scoped review should expose before an assessor does.
HITRUST offers different assurance products. Confirm the expected option, scope and validity period with the customer and current programme material rather than assuming one from an abbreviated questionnaire label.
No. Existing evidence may be reusable, but it must be assessed against the actual assessment option, control domains and scope the customer expects.
A scoped gap assessment commonly takes three to six weeks. Closing gaps and preparing for the authorised assessment often takes three to six months, depending on scope and evidence maturity.
This service is readiness consultancy. The authorised HITRUST assessment follows its own route with an appropriate assessor.
Bring the customer request and we'll help you scope the readiness work.
Book a working session →