HITRUST vs HIPAA: What the Difference Means for Your Practice

A vendor’s website says it’s “HIPAA certified.” The phrase sounds official, and plenty of practices file it away as proof that the vendor is safe.

HIPAA doesn’t certify anyone. No government office runs a test that a company can pass, and no official seal exists for a vendor to earn. When your texting platform, telehealth app, or billing service uses that phrase, it’s describing its own opinion of its security.

HITRUST is what many large health plans and hospital systems turn to instead. It’s a private framework that turns HIPAA and other standards into a fixed list of security controls. An approved outside assessor tests a vendor against that list, and a vendor that passes gets a certificate with a real expiration date.

HIPAA and HITRUST do different jobs, and your practice gets the most out of them when you use them together. HIPAA is the law you follow. HITRUST is one of the clearest ways to check whether the companies holding your patient data follow it too.

That check matters more each year. Hacking and other IT incidents caused more than 80% of large healthcare breaches in 2025. Business associates handle data for many clients at once, which makes them a frequent way in for attackers.

When a breach starts at a vendor, your patients still get the notice letter. Your front desk still fields the worried calls, and your practice still answers for what happened to the data.

Most practices will never seek HITRUST certification themselves. They will sign BAAs with a long list of vendors, often without asking for more than the signature.

Knowing what HITRUST proves, and what HIPAA alone can’t prove, changes what you ask for before the next contract lands on your desk.

What is HITRUST?

HITRUST is a privately held company that helps groups manage data, compliance, and security risk. Its main product is a security framework that health organizations and their vendors can be tested and certified against.

Where HITRUST Came From

HITRUST was founded in 2007 to deal with a growing mess of overlapping healthcare security and privacy rules. The name first stood for the Health Information Trust Alliance, and its early goal was to help healthcare groups meet HIPAA.

Its members came from across the industry: providers, health plans, and health tech firms. They all faced the same problem. Each new rule meant another audit, another checklist, and another set of forms for the same data.

HIPAA and HITRUST share a goal, which is keeping patient data safe from breaches. HIPAA is a federal law with fines behind it. HITRUST is an industry program that tests and certifies how well a company protects that data.

What the CSF Covers

HITRUST released its Common Security Framework, or CSF, in 2009. The CSF takes rules from many standards and folds them into one set of controls. It maps to HIPAA, NIST, ISO 27001, and others, along with PCI, the card payment standard.

For a vendor, that means one test can cover several rule sets. A single r2 assessment can stand in for separate HIPAA, NIST 800-53, and ISO 27001 audits.

The Three Certification Levels

HITRUST offers three levels, e1, i1, and r2, matched to a group’s size, risk, and security needs.

An outside assessor approved by HITRUST does the testing, and HITRUST then reviews the results and issues the certificate.

What It Means for Your Practice

HITRUST gives covered entities one framework they can measure and certify against HIPAA’s security rules. For medical practices, it supports HIPAA compliance, especially regarding telemedicine.

Video visits, patient texts, and online forms all run through outside software, so your vendor’s security becomes part of your own.

Most small practices won’t pursue HITRUST themselves. Its real value for you is in choosing vendors. A HITRUST certificate tells you an outside assessor has checked that company’s controls, which carries more weight than a signed form saying it’s secure.

People often treat HIPAA and HITRUST as the same thing. HIPAA is the law your practice must follow. HITRUST is a voluntary standard that shows how well a company meets it.

What is the Difference Between HITRUST and HIPAA

HITRUST and HIPAA are closely linked, and many practices mix them up. They differ in who sets the rules, how specific those rules are, and what proof you get at the end.

Who Sets the Rules

HIPAA is a law passed by the US government. HITRUST is a private organization. Its members include healthcare providers, insurance companies, health tech firms, and other groups in the field.

That difference decides who can push you to comply. HIPAA has set penalties for security breaches. HITRUST has no legal power, so its weight comes from contracts.

Large healthcare buyers increasingly ask vendors for HITRUST certification, or proof of an active assessment, before they’ll sign a business associate agreement.

How Specific the Rules Are

HIPAA tells you what to protect and leaves most of the “how” up to you. You won’t find a fixed, standard checklist in it.

HITRUST builds on HIPAA by turning those goals into a standard set of controls. Each control can be tested, scored, and certified. HITRUST also adjusts what it asks for based on each group’s risk, using system and organizational factors.

What Each One Covers

HIPAA sets rules that covered entities must follow to protect Protected Health Information (PHI). HITRUST reaches further. It folds in other frameworks, such as PCI for payment card security and NIST, the National Institute of Standards and Technology. A vendor that stores PHI and takes card payments can address both in one HITRUST assessment.

What Proof You Get

HIPAA doesn’t provide certificates for compliance. You can hire a firm to run a HIPAA audit, but the result is a report and nothing more official.

HITRUST runs a formal assessment of security, privacy, and regulatory risk. Once a company meets set conditions, HITRUST issues a certificate. This process is more rigid than a HIPAA audit.

Cost and Effort

Earning HITRUST CSF certification takes more resources, time, and work than a HIPAA audit. That extra effort is why the industry sees it as a stronger badge for security and compliance.

HITRUST works alongside HIPAA. It gives you measurable targets for meeting HIPAA’s call for “appropriate administrative, technical, and physical safeguards.”

How Does HITRUST Compare to HIPAA?

HIPAA is the law. The HITRUST CSF is a tested set of controls that maps to HIPAA, NIST, and PCI. Practices get the most from the two when they use them together, mainly when deciding which vendors to trust with patient data.

How the Two Fit Together

HIPAA sets binding rules for how covered entities protect patient data. HITRUST turns those rules, plus parts of other standards, into specific controls that an outside assessor can test.

That makes HITRUST a risk management tool for any practice that handles sensitive data. Pitting HITRUST against HIPAA misreads both. One tells you what’s required, and the other gives you a way to check whether someone meets it.

Where a BAA Falls Short

Any outside company that touches your patient data must sign a Business Associate Agreement (BAA). In it, the vendor states that it uses proper security controls to protect that data.

A BAA is still a promise on paper. Say your new texting vendor emails you a signed BAA on a Monday.

You file it, and nobody on your side ever looks at their servers, staff access rules, or backups. A proper external audit is the most reliable way to confirm HIPAA compliance, and most practices can’t run one on every vendor.

What a HITRUST Certificate Adds

HITRUST CSF certification gives you a more reliable and consistent way to confirm a business associate is compliant. A few major healthcare payers already require their business associates to comply with the HITRUST CSF.

Why Vendor Security Matters More Now

Healthcare breaches have climbed in recent years, and that has pushed compliance higher on every practice’s list.

In 2025, hacking and other IT incidents caused more than 80% of large healthcare breaches reported to federal regulators. Healthcare also had the highest average breach cost of any industry, at $7.42 million, for the 14th year in a row.

Vendors are often the weak spot. Business associates handle data for many healthcare clients at once but may have weaker security, which makes them a common way in for attackers. Choosing a HITRUST-certified IT provider takes much of the guesswork out of handling sensitive health data.

Conclusion: Choosing Vendors That Can Prove Their Security

Your practice probably won’t ever need a HITRUST certificate of its own. You do need a clear way to judge every vendor that handles your patients’ data.

Start with the tools that touch the most PHI. Your texting platform, telemedicine app, online intake forms, and billing service send or store patient details every working day. For each one, ask three things: who tested their security controls, when it happened, and against which standard.

Collect the signed BAA first, then ask for the outside proof behind it. Most vendors will send a BAA within a day. Far fewer can hand you a recent assessor’s report or a certificate with a valid date on it, and those are the vendors worth a second look.

Curogram is a HIPAA-compliant patient communication platform for texting, telemedicine, and two-way messaging. We’ll show you how our platform protects PHI from the first appointment reminder to the last video visit. Bring your vendor questions and we’ll answer them on the call.

Schedule a demo to see how Curogram keeps your patient conversations secure.

Frequently Asked Questions