HITRUST vs HIPAA: A Strategic Guide for Businesses

The question usually arrives in one of two ways. A hospital system or health plan sends a vendor questionnaire that asks for a HITRUST certification, and a practice or vendor that has always described itself as HIPAA compliant discovers that the two are not the same thing. Or a practice owner reads that HITRUST is the gold standard and wonders whether being merely HIPAA compliant is leaving something on the table. This guide explains what HIPAA and HITRUST actually are, where they overlap, where they differ, and, most usefully, who needs which. Reviewed September 2026; the HITRUST tier details below reflect the current CSF v11 program, and the HIPAA penalty figures are the January 2026 inflation adjustment.

The short version: HIPAA is a federal law that applies to every covered entity and business associate whether they like it or not, and nobody can be certified against it. HITRUST is a voluntary, private certification program that is far more prescriptive, costs real money, and matters mostly when a customer or partner demands it. For most small practices and businesses in the Los Angeles area, HIPAA compliance done properly is the requirement and HITRUST is a business decision, not a legal one.

HIPAA: The Legal Floor

The Health Insurance Portability and Accountability Act, enacted in 1996 and expanded since, sets national rules for protecting health information. It applies to covered entities, meaning providers, health plans, and clearinghouses, and to their business associates, the vendors that create, receive, maintain, or transmit protected health information on their behalf. A common misconception among providers is that HIPAA is a technical standard. It is not. HIPAA is a federal law that provides a framework for accountability but leaves much of the "how" up to the organization.

The three rules that make up HIPAA compliance

• The Privacy Rule governs how PHI is used and disclosed. It grants patients specific rights over their health information, including the right to examine and obtain a copy of their health records.
• The Security Rule sets national standards for protecting electronic PHI. It focuses on administrative, physical, and technical safeguards.
• The Breach Notification Rule requires covered entities to notify affected individuals and the Secretary of HHS after a breach of unsecured PHI, within deadlines that start on the day of discovery.

If you want the full list of what those rules ask of a practice, our HIPAA compliance checklist lays it out rule by rule.

Required versus addressable, and why it causes gaps

The Security Rule labels its implementation specifications as either required or addressable. Required means you must implement it. Addressable does not mean optional: you must assess whether the specification is reasonable for your environment, implement it if so, and otherwise document an equivalent measure or a defensible reason for doing neither. The flexibility is deliberate, but it is also where compliance gaps form, because a practice can believe it is secure while never having written down the analysis that the rule actually requires. The proposed Security Rule update, still unfinalized with final action now listed for July 2027, would remove the addressable category and make encryption and multi-factor authentication firm requirements.

Enforcement and penalties

The Office for Civil Rights within HHS enforces HIPAA. Civil penalties are organized in four tiers by culpability, adjusted for inflation each year. Under the adjustment published on January 28, 2026, penalties run from $145 per violation at the lowest tier to $73,011 per violation at the highest, with a calendar-year cap of $2,190,294 per provision. Beyond fines, OCR frequently imposes multi-year corrective action plans, and the absence of a documented risk analysis, the subject of our healthcare security risk assessment guide, is the finding it cites most often. A practice that wants those obligations managed rather than discovered during an investigation is what our HIPAA compliance services exist for.

HITRUST CSF: The Certifiable Framework

HITRUST is a private organization, not a regulator. Its Common Security Framework, the CSF, harmonizes dozens of standards and regulations, including HIPAA, ISO 27001, NIST, and PCI DSS, into one set of prescriptive control requirements organized across 19 domains. Where HIPAA describes outcomes, the CSF spells out how controls must be implemented and lets an organization prove it through a validated assessment by an authorized external assessor, followed by HITRUST's own quality review. That validated proof is the thing HIPAA cannot give you, and it is the reason large health systems and health plans write HITRUST into vendor contracts.

The three assessment tiers

Since CSF version 11, HITRUST offers three nested assessment tiers. Every requirement in the lower tier is included in the one above it, so work done at one level carries forward. The table below is the practical summary.

The five maturity levels

Unlike HIPAA's yes-or-no view of compliance, the r2 assessment scores each control across five levels of maturity:

• Policy: Is there a formal, written policy?
• Process: Are there defined procedures to execute that policy?
• Implemented: Are the controls fully operational across all systems?
• Measured: Is the organization performing regular testing (like penetration testing)?
• Managed: Are measurements used to improve the security posture over time?

This rigor ensures that security is an evolving process, making HITRUST certification much harder to achieve but far more reliable for stakeholders.

HITRUST vs HIPAA, Side by Side

The primary distinction is that you can be HIPAA compliant, but you cannot be HIPAA certified: HHS certifies no one, and it can still find violations in an organization that holds a HITRUST certificate. The rest of the differences follow from that.

Prescriptive rigor versus descriptive flexibility

Where HIPAA says a covered entity must implement procedures to verify identity and control access, the HITRUST CSF specifies the control requirements an assessor will test, scores them, and updates them as threats change. That specificity removes guesswork for the technical team, which is why organizations that already run mature cybersecurity solutions often find an e1 or i1 assessment more of a documentation exercise than an engineering project. It also means the framework asks for things HIPAA never mentions by name, and paying for controls a small practice does not need is the main reason certification should be tied to a real contractual demand rather than pursued on principle.

Who Actually Needs HITRUST

HITRUST becomes relevant when a customer or partner requires it. Health plans, hospital systems, pharmacy benefit managers, and large health-technology companies increasingly specify i1 or r2 certification in vendor agreements, and a provider council backed by major health systems has stated that moderate-risk vendors must hold at least an i1. If your practice or company sells into those buyers, HITRUST is the price of admission and the only question is which tier the contract names. If the contract says "HITRUST certification" without a tier, it almost always means i1.

Medical practices

A medical or dental practice in the San Fernando Valley that sees patients and bills insurers is a covered entity, and its obligation is HIPAA. Nothing in federal law requires it to be HITRUST certified, and very few practices are. Where HITRUST enters the picture is indirectly: the practice's EHR vendor, billing service, or cloud host may hold a certification, and the practice can rely on that when it evaluates business associates. A practice that grows into a multi-site group, joins a health information exchange, or contracts with a health plan as a delegated entity may eventually be asked for it, at which point the tiers above become the conversation.

Business associates and health-technology vendors

This is where HITRUST lives. A billing company, a software vendor, a data analytics firm, or an IT provider that handles PHI for covered entities is a business associate under HIPAA and is the kind of organization health systems ask to certify. For these companies the sequence that keeps cost sane is well established: get the HIPAA program working first, including the risk analysis, then a SOC 2 Type 2 if customers ask for it, then HITRUST e1 or i1 when a contract requires it, because much of the evidence carries across.

Law firms and other professional firms

A law firm that receives medical records for personal injury, malpractice, or workers' compensation matters is usually a business associate of the provider that supplied them, which means HIPAA applies to how the firm handles that data and a breach carries the same notification duties. HITRUST, on the other hand, is rarely the right tool for a small firm: clients ask law firms for security questionnaires, outside counsel guidelines, and sometimes a SOC 2 report, not a HITRUST certificate; our comparison of SOC 2 vs HIPAA covers that choice. Implementing a handful of HITRUST-style controls as good practice is sensible; pursuing certification without a client requiring it is an expensive way to answer a question nobody asked.

What to Do in Practice

Whatever the answer to HITRUST, the work starts in the same place, and much of it is common to both.

1. Run a real risk analysis. It is the first document OCR asks for and the first step in any HITRUST scoping conversation. Our guide to the healthcare security risk assessment explains what a defensible one contains.
2. Close the gaps HIPAA already requires. Encryption on every device and backup, multi-factor authentication on every path to PHI, access reviews, logging, tested restores, and signed business associate agreements.
3. Decide whether a certificate is being asked for. Read the contracts and questionnaires you actually receive. If none of them name HITRUST, stop here and keep the HIPAA program current.
4. If it is required, scope narrowly. Define which systems and facilities sit inside the assessment boundary, choose the lowest tier the contract accepts, and inherit controls from certified cloud providers where the assessor allows it, remembering that your own scope and evidence remain your responsibility.
5. Plan the calendar. An e1 takes months, an i1 longer, and an r2 commonly a year or more of preparation for an organization starting from a working HIPAA program, followed by annual or interim reassessment to keep the certificate alive.

The technical hardening behind steps two and four, the encryption, identity, logging, and testing that both HIPAA and HITRUST expect, is what a practice gets from managed IT services in Los Angeles that treats compliance evidence as part of the daily work rather than a yearly scramble.

The Honest Trade-Off

HITRUST certification is a real signal, and organizations that hold it tend to have security programs that work. It is also expensive, slow, and unnecessary for most small practices. The mistake in one direction is treating HIPAA as a checkbox and assuming compliance because nothing has gone wrong yet. The mistake in the other direction is chasing a certification because it sounds authoritative, then paying for controls and assessments that no customer will ever ask to see. The right question is not "which is better" but "what does the law require of us, and what are our customers actually asking for," and the answers to those two questions, which a compliance and risk management review is built to produce, decide the rest.

If you are trying to work out whether your organization needs a HITRUST certification or simply a HIPAA program that would survive an investigation, talk to GlobeVM about a HITRUST vs HIPAA gap assessment that reads your actual contracts and maps the work in both directions.