Skip to main content

Explainers

What Is HITRUST? R2, I1 and E1 Levels Explained

HITRUST issues three assessment levels, e1, i1 and r2, with very different scope and validity. Here is what each one actually certifies.

Solomon AmosPublished 10 Oct 20269 min read

HITRUST shows up on vendor trust centres as a single badge, usually just the word HITRUST next to a tick. That one word hides three very different assessments, e1, i1 and r2, each with its own scope, its own validity period and its own assurance depth. A vendor holding an e1 assessment and a vendor holding an r2 certification can both display HITRUST on the same trust centre page, and a buyer who treats the two as equivalent is making a mistake that a five-minute check would catch. This explainer sets out what HITRUST actually is, what each assessment level tests, and how to read the HITRUST framework page so you check the level a vendor actually holds rather than the word on the badge.

What is HITRUST?

HITRUST is a private organisation, formally the HITRUST Alliance, that publishes a control framework called the HITRUST CSF, the Common Security Framework. The CSF does not invent its own control language from scratch. It maps and harmonises requirements drawn from other standards and regulations, including ISO 27001, the NIST Cybersecurity Framework, the HIPAA Security Rule and PCI DSS, into one set of control requirements that an organisation can be assessed against once rather than many times separately. HITRUST licenses external assessor firms to carry out the fieldwork, then HITRUST itself performs quality assurance on the assessor's evidence before it issues a result. That two step structure, an independent assessor followed by HITRUST's own review, is what the programme points to when it argues its output is more consistent than a self-attested questionnaire.

What is HITRUST certification?

Certification is a specific word inside the HITRUST programme, not a general description of any HITRUST activity. HITRUST issues three assessment types and only one of them produces a certification in HITRUST's own terminology. The Risk-based, 2-year, r2 assessment produces HITRUST CSF Certification. The Implemented, 1-year, i1 assessment produces a validated assessment result, not a certification. The Essentials, 1-year, e1 assessment also produces an assessment result, aimed at a lower assurance bar than either of the other two. A vendor that writes HITRUST certified under a trust centre badge without saying which assessment type sits behind it has given you a brand name, not evidence. The useful question before taking the word at face value is which of the three it actually refers to.

The word certified is doing less work than it looks

HITRUST reserves the word certification for the r2 assessment path. The e1 and i1 paths produce assessment results, not certificates, and vendor marketing pages do not always make that distinction clear. The same looseness turns up with other frameworks: a vendor cannot claim "SOC 2 certified" status because SOC 2 produces a report, not a certificate, a point explained further in why there's no such thing as a SOC 2 certification.

HITRUST r2: the certification tier explained

The r2 assessment, formerly marketed simply as HITRUST CSF Certification before HITRUST introduced the e1 and i1 tiers, is the deepest and most expensive option. It is risk-based: the organisation and its assessor select a tailored subset of controls from the full CSF catalogue, scoped to factors such as the type of data handled, the regulatory environment and the system risk profile. Because the control set is tailored rather than fixed, two vendors' r2 certifications are not automatically testing an identical list of controls, which is worth remembering when comparing two r2 vendors side by side on /compare. An r2 certification is valid for two years, with a required interim assessment at the one year mark to confirm controls are still operating as tested. If a vendor's trust centre shows an r2 certificate with no interim update at the midpoint, that gap is worth asking about directly.

The r2 Assessment is the most comprehensive assessment and offers the highest level of assurance, resulting in a two-year HITRUST CSF Certification.

HITRUST i1: the implemented assessment

The i1 assessment sits between e1 and r2. It uses a fixed, curated set of controls that HITRUST updates periodically to reflect current threats, rather than the risk-tailored selection used in r2. That makes i1 faster and cheaper to complete than r2 while still testing implementation evidence, not just policy documents. HITRUST calls the i1 outcome a validated assessment, and it is valid for one year before it needs repeating. Vendors sometimes choose i1 as a first step toward a future r2, or as a permanent landing point for a product that carries moderate risk but not the volume of regulated data that would justify the cost of a full r2 scope.

HITRUST e1: the essentials assessment

The e1 assessment is the entry point. It tests a small set of foundational cybersecurity controls, the kind of baseline hygiene that most security teams would expect any vendor to have regardless of size or sector. It is the quickest and least expensive of the three to obtain, it is valid for one year, and HITRUST positions it as a way for lower risk vendors, or vendors early in a security programme, to produce independently assessed evidence rather than a self-scored questionnaire. An e1 result tells a buyer that a narrow, defined baseline was checked. It does not tell a buyer anything about controls outside that baseline, and it should not be read as a stand-in for an r2 certification.

LevelHITRUST nameTypical validityControl approachBest read as
e1Essentials, 1-year Assessment1 yearFixed, small baseline control setFoundational hygiene check, not a full security review
i1Implemented, 1-year Assessment1 yearFixed, broader curated control set updated for current threatsModerate assurance, implementation evidence required
r2Risk-based, 2-year Assessment2 years, with a year-1 interimTailored control set scoped to risk factorsHITRUST's full certification, the only tier using that word

The three HITRUST assessment levels, by scope, validity and what the result actually means.

Diagram comparing the scope, validity period and assurance depth of HITRUST e1, i1 and r2 assessments
e1, i1 and r2 test different control sets for different lengths of time.
3
Distinct HITRUST assessment levels in use
e1, i1 and r2, listed separately in the CertReports index on 2026-10-10
2 years
Maximum validity of an r2 certification
subject to a required interim assessment at year one
1 year
Validity of both e1 and i1 results
both must be repeated annually to stay current

Why the level matters next to a HIPAA claim

HITRUST is popular with healthcare vendors because the CSF maps its controls to the HIPAA Security Rule, and a HITRUST assessment can make a vendor's HIPAA posture easier to evidence in an audit. That mapping does not change what HIPAA itself requires. HIPAA has no certificate to earn, and a vendor that describes itself as "HIPAA certified" is using a phrase that does not correspond to anything the regulation issues, a point covered in detail in HIPAA eligible vs HIPAA compliant and in what HIPAA asks of your vendors. What a covered entity actually needs from a vendor handling protected health information is a signed business associate agreement, not a HITRUST badge of any level. A vendor can hold a full r2 certification and still have no BAA on file, and a vendor with only an e1 result might have a BAA in place and no HITRUST programme at all. The two pieces of evidence answer different questions, and a buyer needs both answered, not one used to assume the other.

How to check which level a vendor actually holds

  1. 1

    Find the assessment type

    Look for the exact wording e1, i1 or r2 on the vendor's trust centre or in the letter HITRUST issues, not just the word HITRUST on its own.

  2. 2

    Check the validity window

    An r2 certificate should show a two year window with an interim checkpoint at twelve months. e1 and i1 results expire after one year and need a visible renewal date.

  3. 3

    Check who performed the fieldwork

    HITRUST-authorised external assessor firms carry out the work. The assessor's name should appear on the certificate or letter, separate from HITRUST's own quality review.

  4. 4

    Match the scope to your use case

    A tailored r2 scope might exclude a system you care about. Ask which systems and locations were in scope rather than assuming the whole company was covered.

  5. 5

    Ask for the BAA separately

    If protected health information is involved, request the business associate agreement directly. A HITRUST result of any level is not a substitute, as the BAA checklist sets out.

Trust centres rarely spell out HITRUST assessment levels in the same breath as HIPAA claims, which is exactly where a live evidence card helps. The Intercom entry in the index is a useful example of the gap this article is about: its trust centre carries a HIPAA badge without a captured business associate agreement, sitting next to several other framework claims. Look at how the HIPAA row reads against the badge, not at any number on the card, to see the same certification-versus-claim gap that applies to a HITRUST line.

Intercom logo

Intercom · Trust report

Customer support · Public evidence as of 12 Oct 2026

Visit trust centreFull evidence

Framework overview

CertReports state for each framework with public evidence: 1 verified, 10 vendor-stated.

2 more frameworks on the evidence page

2Documents and agreements

Legal and review documents Intercom publishes or offers, as of 30 Sep 2026.

1Security practices

Public statements from Intercom, shown as statements, not attestations, as of 30 Sep 2026.

  • Penetration testing · annual

14Subprocessors

Named on Intercom's public subprocessor list, last seen 30 Sep 2026.

Intercom's trust centre pairs a HIPAA badge with other framework claims, without a captured BAA on file. Every line is a dated public record from the Data Privacy Framework list and Intercom's trust centre. A framework not shown means no public evidence was found, not that Intercom lacks it.CertReports
Illustration of a vendor review checklist with separate rows for HITRUST assessment level, HIPAA BAA status and evidence validity date
A HITRUST row and a HIPAA row answer different questions and need separate evidence.

Questions worth putting in your next questionnaire

The list below works well dropped into a questionnaire pre-fill process or into a manual review using the vendor security review checklist.

  • Which HITRUST assessment type do you hold, e1, i1 or r2, and what is the exact validity window?
  • Which systems, products and locations were inside the assessed scope?
  • Which external assessor firm performed the fieldwork, and when was HITRUST's own review completed?
  • If an r2 certification is older than twelve months, has the required interim assessment been completed?
  • Separately from any HITRUST result, can you provide a signed business associate agreement if protected health information is involved?

HITRUST is not one assurance level wearing different hats. e1, i1 and r2 test different control sets for different lengths of time, and only r2 earns the word certification in HITRUST's own language. Read the assessment type before the badge, check the validity window before the logo, and keep any HIPAA claim on a separate line from any HITRUST line. The framework index lists vendors by the specific assessment type they hold, which is the only version of HITRUST certified worth repeating to your own leadership.

People also ask

What is hitrust?

HITRUST is a private organisation, the HITRUST Alliance, that publishes the HITRUST CSF, a control framework that harmonises requirements from ISO 27001, NIST, the HIPAA Security Rule and PCI DSS into one assessable set. External assessor firms carry out the fieldwork and HITRUST performs its own quality review before issuing a result. It is a voluntary industry programme, not a government or legal requirement.

What is hitrust certification?

Certification is the specific outcome of HITRUST's r2 assessment path, called HITRUST CSF Certification, valid for two years with a required interim check at year one. The e1 and i1 paths produce assessment results rather than certifications, even though vendor marketing sometimes labels all three HITRUST certified. Checking which assessment type a vendor actually holds matters more than the single word on a badge.

What is hitrust r2?

HITRUST r2, the Risk-based, 2-year assessment, is HITRUST's deepest tier and the only one that produces a HITRUST CSF Certification. It uses a tailored control set scoped to the organisation's own risk factors rather than a fixed list, is valid for two years, and requires an interim assessment at the twelve month mark to confirm controls are still operating as originally tested.

What is hitrust csf certification?

HITRUST CSF Certification is the result issued after a successful r2 assessment against the HITRUST CSF, the framework's harmonised control set. It is valid for two years, carries a required interim assessment at year one, and is the only HITRUST outcome that uses the word certification. The lighter e1 and i1 assessments test smaller or less tailored control sets and expire annually.

HITRUSTHIPAAhealthcare compliancevendor risk managementcompliance evidence
S

Solomon Amos · Founder, CertReports

Solomon builds CertReports, the public evidence index for vendor security reviews. PhD in machine learning and cybersecurity, two years embedded at HMRC digital programmes, founder of TapTax. He writes about what registries, trust centres and auditors actually publish, and how buyers can use it before the questionnaire goes out.

Read next on CertReports

You might also like