Services
Services
SOC & Attestations
SOC & Attestations
Payment Card Assessments
Payment Card Assessments
ISO Certifications
ISO Certifications
Privacy Assessments
Privacy Assessments
Federal Assessments
Federal Assessments
Healthcare Assessments
Healthcare Assessments
Penetration Testing
Penetration Testing
Targeted Security Assessments
Targeted Security Assessments
Crypto and Digital Trust
Crypto and Digital Trust
Schellman Training
Schellman Training
Industry Solutions
Industry Solutions
Cloud Computing & Data Centers
Cloud Computing & Data Centers
Financial Services & Fintech
Financial Services & Fintech
Healthcare
Healthcare
Payment Card Processing
Payment Card Processing
US Government
US Government
Learning Center
Learning Center
Articles
Articles
Whitepapers
Whitepapers
Case Studies
Case Studies
Events & Live Webinars
Events & Live Webinars
On-Demand Webinars
On-Demand Webinars
About Us
About Us
Leadership Team
Leadership Team
Careers
Careers
Corporate Social Responsibility
Corporate Social Responsibility

HIPAA vs. HITRUST

HIPAA | HITRUST

Consider sugar and salt—both are “spices” of a kind, and since they’re both often in the form of fine white grain, they look similar as well. So similar in fact, you might mistakenly switch one in for the other, setting yourself up for quite the surprise at first bite.

Though not spices, both HIPAA and HITRUST address regulatory compliance for healthcare organizations to some degree, and so they too are often thought to be interchangeable. As providers of both services for years now—HIPAA attestations and HITRUST certifications—we’re going to explain why they aren’t, saving you the possibility of that “surprise at first bite.”

To start, HIPAA is a law while HITRUST (and its CSF) is a control framework, but in this article, we’re going to get into the other key differences between these two while also answering the common question of “if I have one, do I have the other?”

If you’re a healthcare organization unsure of which direction to choose or what’s appropriate/applicable for you, read on to find more clarity in your direction moving forward.

What is HIPAA?

An acronym for the Health Insurance Portability and Accountability Act of 1996, HIPAA is a U.S. law that mandates the privacy and security of protected health information (or PHI). It contains three rules applicable organizations must follow regarding Privacy, Security, and Breach Notification.

Such applicable organizations include:

  • Covered Entities: Healthcare providers, plans, and clearinghouses
  • Business Associates: Any organization contracted by covered entities or other Business Associates to perform work including ePHI on their behalf 

If you fall under this umbrella, you’re expected to adhere to the three types of security safeguards:

  • Physical
  • Technical
  • Administrative

That includes complying with the organizational requirements and policies and procedures and documentation requirements. Each of these features a series of standards and specifications to address risks associated with the confidentiality, integrity, and availability of PHI.

HIPAA also includes an evaluation standard that requires periodic technical and nontechnical evaluations to ensure compliance; however, there is no official designation of compliance with HIPAA—rather, you can

report their compliance by only providing a completed risk assessment and control documentation, for example in the form of an attestation report issued by a CPA firm.

For those that do not comply, HIPAA is enforced by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR), which will investigate possible violations and issue penalties—both financial and otherwise. 

What is HITRUST? 

While HIPAA is a federal act that sets compliance standards, HITRUST is an organization that first established its CSF—a security risk and compliance framework—in 2009. And though HITRUST was initially created to support healthcare industries with specific devotion to the protection of ePHI and PHI, it has since evolved beyond that and can now suit organizations of any industry.

That’s because the HITRUST CSF brings together several compliance frameworks, including:

  • HIPAA;
  • NIST;
  • PSI; and
  • ISO, as well as some requirements unique to HITRUST.

The HITRUST CSF includes control categories, control objectives, and control specifications. (which may contain multiple levels of control components) spread over multiple Assessment Domains. To become HITRUST certified, you must meet the appropriate scoring levels for each assessment domain. (This will depend on if you choose an i1 or r2 certification.)

Yes, when going through the assessment process, you can tailor your requirements based on unique factors such as your type of organization, size, systems, and appropriate legal regulations. Speaking of which, HITRUST also offers a self-assessment option if you’d prefer to do the work internally.

However, it’s recommended that even if you’re not opting for one of the certifiable assessments—the i1 or the r2—your self-assessment could still benefit enormously from the expertise of a qualified CSF assessor organization.

To help you get the most out of your effort, these third parties can help identify the strengths and weaknesses of your information security program and to make recommendations about how to address any issues—and, of course, you’ll establish an early relationship with them should you also need/wish to progress to a certifiable assessment.

As many organizations do, you might consider HITRUST an attractive compliance option, as the CSF and its combined, comprehensive, and prescriptive nature allows for the finding of efficiencies and meeting multiple compliance initiatives through a single audit.

The Difference Between HIPAA and HITRUST

We’ve established that there’s a relationship between HIPAA and HITRUST. Both also share a common objective of safeguarding healthcare information and ePHI. But there are still at least 3 key differences between the two—some of which we’ve already alluded to—and we’ll lay them out here.

HIPAA

Key Difference

HITRUST

HIPAA has defined (often steep) penalties for security breaches, including fines and sometimes even criminal penalties, depending on the violation.

Penalties for
Breaches/Non-Compliance

Failure to meet the required HITRUST standard has no direct federal liability.

(You could still face contractual or commercial consequences—a customer taking their business elsewhere, for instance.)

While you can undergo a HIPAA attestation to assess your compliance with the 3 HIPAA rules, there’s no certification body or path for HIPAA.

Certification Options

HITRUST offers 2 certifications:

  • Implemented, 1-year (i1) Validated Assessment + Certification
  • Risk=based, 2-year (r2) Validated Assessment + Certification

Because the HIPAA Security Rule was originally intended to apply to a wide range of organizations from small clinics to large hospital chains, the requirements are often considered subjective and vague—for instance, the audit logs requirement.

This can make it sometimes (or often) necessary to also rely on ISO or NIST assessments to achieve total reassurance in compliance.

Range/Applicability

With the more prescriptive and risk-based HITRUST CSF, requirements are adjusted based on your specific risks.

Because the HITRUST approach also considers compliance with other regulations, it allows for more organizations of various sizes and industries to take advantage of a comprehensive approach to meeting compliance and information security objectives.

 “If I’m HITRUST Certified, Does That Mean I’m HIPAA Compliant?”

Because HITRUST CSF is so holistic and makes HIPAA considerations, this question often comes up.

And while it’s true that HITRUST offers measurable criteria and objectives for applying appropriate administrative, technical, and physical safeguards that are also covered by HIPAA’s Security Rule, being HITRUST compliant only proves you’ve met some of the HIPAA-mandated requirements.

Implemented correctly, HITRUST certification should allow you to demonstrate you are taking reasonable steps to operate in line with HIPAA, but it’s important to remember that HITRUST—due to the aforementioned vague language in the HIPAA requirements—may not cover all of the specifications of the HIPAA Security Rule. It’s also never been formally endorsed by OCR.

So no, you’re not automatically HIPAA compliant if you become HITRUST certified. Still, HITRUST is widely accepted as a good approach for evaluating risk and it can provide a path for reaching full HIPAA compliance.

Moving Forward with Compliance

It’s a common misconception that, because HIPAA and HITRUST have relevancy for healthcare organizations, they’re interchangeable or so closely related that if you’re good with one, you’re good with the other. But now you understand their foundational and other key differences, so you can decide whether sugar or salt is right for your compliance recipe.

As you take further steps towards whichever project is better suited to your needs, read our other content that can provide in-depth insight on different facets, as well as tips for getting ready and finding what you need:

And of course, if you find you have further questions or would like to explore whether Schellman is the right firm to provide you with either of these services, please feel free to contact us so that we can schedule a conversation—our team of experts would be happy to address any concerns you have.

About Kellie Worley

Kellie Worley is a Senior Associate with Schellman. Prior to joining the firm, she was a HIPAA Compliance Consultant at Clearwater and served as AVP of Compliance and Privacy Officer for a hospital company with facilities across the U.S.. Having previously operated as Privacy Officer in other healthcare organizations, she has 20+ years experience in healthcare compliance .