HIPAA and HITRUST assessments, by certified assessors.

1. 01

   Scoping: HIPAA, HITRUST, or both

   HIPAA is a legal obligation; HITRUST is a certifiable framework that many covered entities and their partners require contractually. They are related but not the same, and buying the wrong one is expensive. We establish which applies before quoting.

2. 02

   Asset and ePHI inventory

   Where ePHI lives, how it moves, who touches it, and which vendors handle it. Almost every organisation we assess finds ePHI somewhere it did not expect — a mailbox, a reporting tool, a legacy share.

3. 03

   Security Risk Analysis

   The Security Risk Analysis is explicitly required by the Security Rule and is the single most commonly cited deficiency in enforcement actions. We conduct it to the standard and document it so it stands as evidence, not as an internal note.

4. 04

   Safeguard assessment

   Administrative, physical and technical safeguards are assessed individually with findings recorded against each. Where a safeguard is addressable rather than required, we document the reasoning for your choice, because that reasoning is itself what regulators ask to see.

5. 05

   Remediation and documentation

   Gaps are prioritised by risk to ePHI, with policies, procedures and workforce training produced or revised to match. Documentation is the deliverable regulators actually inspect.

6. 06

   Certification support

   For HITRUST we prepare you through readiness and support you through the certification process with your chosen external assessor.

Common questions

What is the difference between HIPAA and HITRUST?

HIPAA is the U.S. law that requires healthcare organizations and their business associates to protect electronic protected health information (ePHI), including a mandatory Security Risk Assessment. HITRUST CSF is a certifiable framework that maps HIPAA and other standards into prescriptive, testable controls, so you can prove your security with an independent certification. HIPAA is the obligation; HITRUST is a way to certify you meet it.

Is a HIPAA risk assessment required?

Yes. The HIPAA Security Rule explicitly requires covered entities and business associates to conduct an accurate and thorough risk analysis of the confidentiality, integrity, and availability of ePHI (45 CFR 164.308(a)(1)(ii)(A)). The absence of a genuine risk assessment is the single most common finding in HHS Office for Civil Rights enforcement actions.

What is HITRUST certification?

HITRUST CSF certification is an independent validation that your security controls meet the HITRUST Common Security Framework. It comes in tiers (e1, i1, and r2) of increasing rigor, and is widely requested by healthcare customers and partners as proof that a vendor protects PHI. SubRosa provides readiness assessments, mock assessments, and full support through certification.

What is the difference between HIPAA compliance and HITRUST certification?

HIPAA is a legal obligation with no certificate — no body certifies HIPAA compliance, whatever a vendor may imply. HITRUST is a certifiable framework that incorporates HIPAA requirements alongside others, and many covered entities require it contractually from their partners. They are related but distinct, and buying the wrong one is expensive.

Do we really need a Security Risk Analysis?

Yes. It is explicitly required by the HIPAA Security Rule, and its absence or inadequacy is the single most commonly cited deficiency in enforcement actions. A risk analysis that exists as an internal note rather than as documented evidence conducted to the standard will not help you.

What is an addressable versus a required safeguard?

Required safeguards must be implemented. Addressable ones must be implemented if reasonable and appropriate — and where they are not, you must document why and what you did instead. Addressable does not mean optional, and treating it that way is a frequent and consequential misreading.

Can you take us through HITRUST certification?

We prepare you through readiness and support you through certification with your chosen external assessor. As with SOC 2 and ISO 27001, we do not both remediate and certify — the independence is the point of the certificate.