HITRUST CSF Assessment Services

HITRUST e1 is an assessment option under the HITRUST Assurance Program, which is designed to evaluate the information security controls of service providers that handle sensitive information. The e1 assessment enables service providers to evaluate their compliance with the HITRUST CSF controls and requirements and report their results to their customers and stakeholders. 

The e1 assessment is intended for small service providers or those with limited exposure to sensitive healthcare information. It includes a subset of the HITRUST CSF controls and requirements, focusing on the most critical security and privacy requirements. The e1 assessment is a cost-effective way for service providers to demonstrate their commitment to protecting sensitive healthcare information and provide assurance to their customers. 

The e1 assessment includes a set of questions that cover the following areas: 

1. Organization and policies: This area focuses on the service provider's organizational structure, policies and procedures related to information security. 
2. Physical security: This area covers the service provider's physical security controls, such as access controls, security monitoring and environmental controls. 
3. Technical security: This area covers the service provider's technical security controls, such as access controls, encryption, network security and vulnerability management. 
4. Incident management and response: This area covers the service provider's incident management and response processes, including incident detection, response and reporting.  
5. Business continuity and disaster recovery: This area covers the service provider's business continuity and disaster recovery processes, including backup and recovery procedures and testing. 

Overall, the e1 assessment provides a streamlined and cost-effective way for small service providers or those with limited exposure to sensitive healthcare information to demonstrate their compliance with the HITRUST CSF controls and requirements. 

HITRUST i1 is an assessment option under the HITRUST Assurance Program, which is designed to evaluate the information security controls of service providers that handle sensitive healthcare information. The i1 assessment is a streamlined, low-cost assessment that enables service providers to evaluate their compliance with the HITRUST CSF controls and requirements and report their results to their customers and stakeholders. 

The i1 assessment is intended for service providers with limited exposure to sensitive healthcare information or those that provide non-core services to the healthcare industry. It includes a subset of the HITRUST CSF controls and requirements, focusing on the most critical security and privacy requirements. The i1 assessment is a cost-effective way for service providers to demonstrate their commitment to protecting sensitive healthcare information and provide assurance to their customers.

The i1 assessment includes a set of questions that cover the following areas: 

1. Organization and policies: This area focuses on the service provider's organizational structure, policies and procedures related to information security. 
2. Physical security: This area covers the service provider's physical security controls, such as access controls, security monitoring and environmental controls. 
3. Technical security: This area covers the service provider's technical security controls, such as access controls, encryption, network security and vulnerability management. 

Overall, the i1 assessment provides a streamlined and cost-effective way for service providers with limited exposure to sensitive healthcare information or those that provide non-core services to demonstrate their compliance with the HITRUST CSF controls and requirements. 

HITRUST r2 is an assessment option under the HITRUST Assurance Program, which is designed to evaluate the information security controls of service providers that handle sensitive healthcare information. The r2 assessment is a rigorous, comprehensive and independent assessment that evaluates an organization's compliance with the HITRUST CSF controls and requirements. 

The r2 assessment is intended for service providers that handle large volumes of sensitive healthcare information and are required to demonstrate a high level of information security and privacy controls. The assessment involves a thorough review of the organization's information security policies, procedures, and technical controls, as well as an evaluation of its risk management practices. 

The r2 assessment covers all of the HITRUST CSF controls and requirements, including the privacy and regulatory requirements, and is conducted by a qualified and independent HITRUST assessor. The assessment includes an onsite audit, interviews with key personnel, and testing of the organization's technical controls and processes. 

The r2 assessment provides a comprehensive evaluation of an organization's information security controls and practices, and enables the organization to demonstrate its compliance with the HITRUST CSF controls and requirements to its customers and stakeholders. The assessment also helps organizations identify areas for improvement and prioritize their information security investments to better protect sensitive healthcare information.