HITRUST CSF: Healthcare's Most Demanding — and Most Trusted — Security Framework

The HITRUST Common Security Framework (CSF) has become the most widely recognised security certification in the US healthcare industry. Unlike HIPAA, which provides principles and requirements but leaves implementation largely to the organisation, HITRUST provides a prescriptive, certifiable framework that harmonises requirements from HIPAA, NIST, ISO 27001, PCI DSS, and other standards into a single unified framework. For healthcare organisations seeking to demonstrate security assurance to large health systems, payers, and government health agencies, HITRUST certification is often the only acceptable demonstration.

HITRUST CSF vs HIPAA: Why Certification Matters

HIPAA does not provide a certification programme. There is no 'HIPAA certified' designation that carries any independent assurance weight. When a healthcare organisation or health system asks a vendor 'can you prove your HIPAA compliance?', the vendor can provide self-assessments, third-party assessments, or SOC 2 reports — none of which are specifically designed for the healthcare context.

HITRUST fills this gap. HITRUST certification is issued following an assessment conducted by an approved HITRUST External Assessor against the full CSF requirements. It provides:

• A standardised framework that directly addresses HIPAA requirements alongside multiple other standards
• An independently assessed and certified outcome that carries credibility with healthcare buyers
• A harmonised framework that satisfies multiple regulatory requirements simultaneously — reducing the total compliance burden for multi-framework organisations
• A shared responsibility framework for cloud service providers (Shared Responsibility and Inheritance Programme)

Three Assurance Levels: e1, i1, and r2

HITRUST offers three assessment and certification levels:

e1 Assessment (Essential, 1-year certification): The entry-level HITRUST assessment covering the most fundamental cybersecurity hygiene requirements — approximately 44 controls focused on basic access management, patching, MFA, and phishing protection. Designed for lower-risk vendors and as a starting point for HITRUST engagement. Validated by HITRUST (not a third-party assessor).

i1 Assessment (Implemented, 1-year certification): A mid-tier assessment covering approximately 182 controls addressing both essential cybersecurity hygiene and many HIPAA requirements. Based on leading security practices. Validated by HITRUST (not a third-party assessor). Appropriate for vendors with moderate healthcare data responsibility.

r2 Assessment (Risk-based, 2-year certification): The most comprehensive HITRUST assessment, covering 200+ controls tailored to the organisation's specific risk profile (size, complexity, regulatory factors). Requires an approved External Assessor and carries the greatest credibility with healthcare buyers. The r2 is what major health systems and payers require from their most critical vendors.

Preparing for HITRUST r2 Assessment

Gap assessment: HITRUST's MyCSF tool is used to conduct the self-assessment against all applicable r2 controls. An initial self-assessment identifies the current state — which controls are fully implemented, partially implemented, or not implemented.

Remediation: Closing gaps identified in the self-assessment. HITRUST controls are prescriptive — they have specific maturity scoring criteria that must be met. Partial implementation typically scores as non-compliant.

Policy and procedure documentation: HITRUST requires documented policies and procedures for every control domain. These must be formally approved, current, and reflect actual operational practice.

Evidence preparation: The external assessor will request evidence for every control in scope. Building an organised evidence repository — mapped to each control — significantly reduces assessment friction.

Interim assessment: Many organisations conduct an interim self-assessment or readiness review with their External Assessor before the formal validated assessment to identify and address any remaining gaps.

Validated assessment: The External Assessor conducts the validated assessment — reviewing documentation, interviewing personnel, and testing control implementation. Results are submitted to HITRUST for quality assurance review before certification is issued.

Timeline: Plan for 12–18 months from kickoff to r2 certification for most first-time organisations.

Why Organisations Choose Savadub

Deep GRC Expertise

Our team holds practitioner-level expertise across every major compliance framework — not just theoretical knowledge, but hands-on implementation experience across multiple industries and organisation sizes.

Engineers, Not Just Consultants

We implement controls, not just recommend them. Our GRC engineers configure the systems, write the integrations, and build the monitoring pipelines that make compliance operational.

Global and African Regulatory Coverage

We understand both the global frameworks and the African regulatory environment — NDPR, NDPA, CBN directives, NITDA guidelines, and regional data protection laws — making us uniquely positioned for organisations operating across Africa and internationally.

Internal and External Audit Capability

We provide both embedded internal audit functions and independent third-party audit support, including CPA-accredited audit coordination for SOC examinations.

End-to-End Engagement

From initial gap assessment through certification, continuous monitoring, and ongoing compliance management — we are your long-term GRC partner, not a one-time consultant.

Industries We Serve

Financial Services · Healthcare · Technology & SaaS · Manufacturing · Logistics & Trade · Government & Public Sector · Energy & Critical Infrastructure · Education & EdTech · Media & Broadcasting · Retail & E-Commerce · Professional Services · Food & Beverage

Deliverables You Receive

Working with Savadub, every engagement delivers a concrete set of outputs:

• Gap Assessment Report — prioritised findings with effort estimates and risk ratings
• Compliance Roadmap — milestone-based plan from current state to certification or attestation
• Risk Register — organisational risk register with treatment plans
• Policy Pack — all required policies authored, reviewed, and approved
• Technical Control Implementation Evidence — configurations, screenshots, and audit trails
• Internal Audit Report — independent assessment of control effectiveness
• Audit Evidence Repository — organised, auditor-ready evidence collection
• Executive Summary Presentation — board and leadership-ready compliance status
• Remediation Tracker — structured tracking of open findings and closure evidence
• Continuous Monitoring Setup — ongoing CCM pipeline for post-certification compliance

Get Started with Savadub

Savadub's GRC practice combines deep compliance expertise with technical engineering capability. We don't just advise — we build, implement, and operate your compliance program from the ground up.

Book a free GRC consultation with our team. We will review your current posture, identify your most critical gaps, and give you a clear, costed roadmap to compliance.

Contact us:

• Email: grc@savadub.com
• Phone: +234 816 734 2201
• WhatsApp: +234 903 234 8435
• Website: www.savadub.com