HITRUST runs three validated assessments, and they are built as steps on the same ladder: each covers more controls and gives customers more assurance than the one before it. All three are performed by an authorized HITRUST External Assessor and result in a HITRUST certification when the requirements are met (HITRUST).
How do e1, i1 and r2 compare?
| e1 | i1 | r2 | |
|---|---|---|---|
| Controls | 43 core controls | 182 control requirements | Tailored to your risk profile; the largest of the three |
| Assurance | Foundational (“essentials”) | Leading security practices, threat-adaptive | Most comprehensive, risk-based |
| Valid for | 1 year | 1 year | 2 years (interim assessment during the cycle) |
| Typical fit | Startups and lower-risk vendors | Organizations with a mature program | Organizations that must show compliance with HIPAA, NIST CSF or other authoritative sources |
| Scoring | Implementation | Implementation | Multiple maturity levels |
Control counts and requirements are set by HITRUST and change with CSF versions, so confirm the current numbers on hitrustalliance.net before you scope.
When is the e1 enough?
The e1 is HITRUST’s entry-level assessment, built around a core set of cybersecurity controls (HAA 2023-004). It suits:
- Early-stage companies selling into healthcare for the first time
- Vendors with limited access to sensitive data
- Organizations that want a credible first certification and plan to step up later
The e1 is the fastest and least expensive path to a HITRUST certification, but some customers will ask for more.
When should you choose the i1?
The i1 covers far more controls, focused on leading security practices, while staying on an annual cycle. It fits organizations with an established security program that need stronger assurance than the e1 without the full scope of an r2. Work completed for an i1 can be applied toward an r2 later (HITRUST).
When do you need the r2?
The r2 is HITRUST’s most comprehensive assessment. Instead of a fixed control set, it is tailored to your organization’s risk factors and the regulations you must meet, such as HIPAA or the NIST Cybersecurity Framework, and it scores controls across several maturity levels. It is valid for two years, which offsets some of its larger effort.
Choose the r2 when:
- Large health systems, payers or other enterprise customers specifically require it
- You handle significant volumes of protected health information
- You need one assessment that maps to several frameworks at once
How to decide
- Start with your contracts. Many healthcare customers name the HITRUST level they require. That requirement usually settles the question.
- Match the level to your risk. The more sensitive data you handle and the larger your customers, the more likely you need an i1 or r2.
- Plan the path, not just the first step. Because e1 and i1 work carries forward, many organizations start lower and step up as they grow.
- Talk to an authorized External Assessor about scope before you commit; they can also run a readiness assessment first.
Which External Assessors can help?
All validated HITRUST assessments are performed by an authorized External Assessor. Three examples from HITRUST’s External Assessor list, listed alphabetically (not a ranking or endorsement):
| Assessor | Headquarters | Profile |
|---|---|---|
| 360 Advanced | St. Petersburg, FL | View profile |
| A-LIGN | Tampa, FL | View profile |
| Schellman | Tampa, FL | View profile |
Listings were verified against HITRUST’s directory on August 19, 2026. Ask each firm which assessments it performs (e1, i1, r2, readiness) and confirm current authorization with HITRUST before engaging.
Compare authorized HITRUST External Assessors in our assessor directory, or get matched with assessors that fit your assessment type and timeline.
Frequently asked questions
What is the difference between HITRUST e1, i1 and r2?
They are three levels of HITRUST validated assessment. The e1 covers 43 foundational controls and is valid for one year. The i1 covers 182 controls focused on leading security practices and is valid for one year. The r2 is tailored to your risk profile and the regulations you must meet, is the most comprehensive, and is valid for two years.
Which HITRUST assessment is required for HIPAA?
HIPAA does not require HITRUST certification. Organizations that need to demonstrate compliance with authoritative sources such as HIPAA or the NIST Cybersecurity Framework generally choose the r2, because it is tailored to those requirements. Many healthcare customers simply ask vendors for a specific HITRUST level, so check your contracts.
Can I start with an e1 and move up to an r2?
Yes. HITRUST designed the assessments so that work done for an e1 or i1 can be applied toward a higher assessment, which makes stepping up over time a common path.
How long is a HITRUST certification valid?
e1 and i1 certifications are valid for one year. An r2 certification is valid for two years, with an interim assessment required during the cycle to keep it in good standing.