HIPAA is a US federal law that sets privacy and security duties for covered entities and their business associates handling protected health information. HITRUST is a private assurance framework and certification that many healthcare buyers ask for. You must follow HIPAA if it applies; HITRUST is a business choice.
What is HIPAA?
HIPAA is administered by the US Department of Health and Human Services. Its Security Rule requires administrative, physical and technical safeguards for electronic protected health information. It applies to covered entities such as health plans and many providers, and to business associates that handle that data for them. HHS pages blocked our automated fetch, so check the HHS site for rule text. Note that HHS does not issue a HIPAA certificate, which is why people look for other proof.
What is HITRUST?
HITRUST says its CSF harmonizes more than 70 standards and regulations, including ISO/IEC, NIST, HIPAA, PCI and GDPR requirements, and that its e1, i1 and r2 assessments are all built on the framework. It is a private organization with its own assessors and reports.
How do they differ?
Authority. HIPAA is law, enforced by regulators. HITRUST is voluntary and run by a private body.
Proof. HIPAA has no official certificate. A HITRUST report is a third party validated statement a buyer can read.
Specificity. The Security Rule states safeguards at a fairly high level and many are flexible depending on your size and risk. HITRUST provides a detailed control set and defined assessment methods.
Coverage. HIPAA concerns health data in specific regulated relationships. HITRUST can cover broader requirements you choose to include.
How do they overlap?
HITRUST includes HIPAA among the sources it maps, so a HITRUST assessment can produce evidence that supports HIPAA safeguards. It does not replace HIPAA obligations such as business associate agreements, breach notification rules or privacy policies, and HITRUST certification is not a legal determination of compliance.
A constructed example
A startup builds a patient messaging tool for clinics. As a business associate, it must sign agreements with clinics and apply Security Rule safeguards, whether or not it ever gets HITRUST. After a few hospital prospects ask for HITRUST, it weighs the cost of an assessment against the deals. It chooses an assessment type after confirming what each buyer accepts.
How to decide
- Determine whether you are a covered entity or business associate. Ask counsel.
- Complete a HIPAA risk analysis and fix the findings.
- Sign business associate agreements where needed.
- Collect buyer requests for HITRUST in writing.
- Ask what alternatives they accept.
- Scope a single product environment for any assessment.
- Budget time for evidence collection.
Safeguard's compliance automation can help track evidence and tasks. It does not certify you or give legal advice.
What do buyers usually want?
A healthcare security team typically wants evidence in three areas: that you understand your HIPAA role, that you have safeguards in place, and that someone independent has looked. A signed business associate agreement answers the first. A risk analysis and policies answer the second. A third party report answers the third, and HITRUST is one way to supply it. Some buyers accept other independent reports. Ask early and in writing, so you do not buy an assessment the customer did not require. Keep in mind that state laws and other federal rules may also apply to health data, so involve counsel.
Quick check
Does HITRUST make us HIPAA compliant?
No. It can support your HIPAA work but compliance is a legal question.
Is there an official HIPAA certification?
No. HHS does not certify organizations. Third party reports fill that gap for buyers.
Sources
- HITRUST CSF framework page
- HHS, HIPAA Security Rule (page blocked automated fetch; verify there)
Last reviewed: 18 October 2026.
