HITRUST Certification Cost: What Drives the Price of an e1, i1, or r2
HITRUST certification cost depends less on company size than on which assessment is chosen, how much of the environment is in scope, and how ready the controls are on day one. That is why published figures vary so widely, and why a number quoted without a scope is not a budget. This article does not quote prices. It explains the cost components, what moves each one, how to compare quotes, and how to plan an e1, i1, or r2 so the total is predictable. It does not replace a scoped quote from an assessor and from HITRUST, which are the only sources for actual fees. What Drives HITRUST Certification Cost The Assessment Type: e1, i1, or r2 HITRUST offers three certifiable assessments, and the choice sets the baseline for effort. Assessment Requirements Validity What it adds to cost e1 A fixed set of 44 requirements covering foundational security hygiene One year The smallest testing effort, renewed every year i1 A fixed set of 182 requirements covering leading practices One year, with a rapid recertification option More requirements to evidence than the e1, with a lighter renewal r2 A risk-based set tailored to scope and risk factors, the broadest of the three Two years, with an interim assessment at the one-year mark The largest testing effort and a mid-cycle interim assessment The table shows that cost follows the number of requirements and the renewal pattern. The e1 and i1 are renewed every year, so their costs repeat annually. The r2 spreads its cost over two years but carries the largest first cycle and an interim assessment in the middle. Elevate’s i1 or r2 post covers how to choose between them. Scope: Systems, Locations, and Data The systems, applications, data, facilities, and user populations in scope drive both testing effort and remediation. A narrow scope tied to a single product costs less to assess and to fix than an enterprise-wide one. The scope also has to be defensible, because it is reviewed as part of the assessment, and a scope drawn only to keep cost down can be challenged. Readiness and Remediation This is the largest and least predictable component. Controls that already exist and are documented cost little to evidence, while gaps cost whatever it takes to close them: tooling, process changes, and staff time. Organizations that already hold a SOC 2 report, an ISO 27001 certificate, or a HIPAA risk analysis usually have part of the evidence, because HITRUST requirements cross-reference those frameworks. Elevate’s SOC 2 readiness assessment and HIPAA security risk assessment guides describe the evidence that carries over. Fees and Cost Lines Cost line What it is What moves it HITRUST platform and report fees Access to the MyCSF platform and HITRUST’s review and issuance of the report Assessment type and the number of assessments run External assessor The HITRUST-approved firm that tests controls and submits the validated assessment Assessment type, scope, and quality of evidence Readiness and remediation Gap assessment, new controls, tooling, and staff time How many controls already operate and are documented Interim assessment (r2 only) A check at the one-year mark that the program still operates Changes in scope and controls since the first assessment Internal time Staff hours collecting evidence and answering assessor questions How organized and automated the evidence is The table shows where budgets go wrong. Most plans include the first two lines and underestimate the third and the fifth. The platform and the assessor are priced and fixed by the assessment type, while remediation and internal time depend on the state of the program, which only a readiness review can reveal. Why Published HITRUST Certification Cost Figures Differ So Much Ranges Rest on Different Assumptions Anyone comparing published HITRUST cost figures will find wide gaps between sources. The gaps come from different scopes, different assessment types, different company sizes, and different inclusions: some figures count only the assessor, some add platform and report fees, and some add remediation. A figure without its scope and its inclusions cannot be compared with another, and none of them substitutes for a quote on your own scope. Questions to Ask Before Accepting a Quote Ask whether platform and report fees are included. Ask whether readiness and remediation are in the price or separate. Ask what happens to the cost if the scope changes during the assessment, whether the interim assessment for an r2 is included, and what year two costs. A quote that cannot answer these is an estimate of the assessor’s fee, not of the total cost of certification. How to Plan HITRUST Certification Cost for e1, i1, and r2 Choose the Assessment Your Buyers Actually Require Start with the customers or partners that are driving the requirement and ask which assessment they accept. The cheapest assessment that satisfies them is the right one, and moving up a tier because it sounds stronger adds cost without adding a contract. If the answer is unclear, an r2 offers the highest assurance, but it is also the broadest and the most expensive to run, so it should be a deliberate decision. Right-Size the Scope Before Anything Else Define the systems, data, and locations that actually support the product or service the buyers care about, and exclude what does not. Scope is the one lever that lowers assessment effort and remediation at the same time. Write the scope rationale down, because the assessor and HITRUST will ask for it. Run a HITRUST Readiness Assessment First A readiness assessment compares the environment to the requirements of the chosen assessment before the validated assessment begins. It shows how large the gap is, which is the most uncertain number in the plan, and it lets the budget include remediation instead of discovering it midway. Elevate’s HITRUST service starts from that gap assessment, and its risk assessment work supplies the risk analysis that several requirements depend on. Reuse Evidence From Other Frameworks Evidence collected for SOC 2, ISO 27001, or HIPAA often supports HITRUST requirements, because the frameworks cross-reference
HIPAA Penetration Testing: What Is Required, What Is Coming, and How to Scope It
HIPAA penetration testing is not named in the current Security Rule, but it is moving from good practice toward a stated requirement: HHS proposed annual testing in January 2025, and a Senate-passed bill would direct HHS to require monitoring that includes penetration testing. Neither is in force today. That does not make the question academic, because the current rule already requires a risk analysis and a periodic evaluation of security controls, and a test is the strongest evidence most organizations can produce for both. This guide explains what the rule says now, what is proposed, how a penetration test differs from a vulnerability scan and a risk analysis, what a HIPAA-focused test should cover, and how to turn the results into evidence an auditor or OCR investigator will accept. HIPAA Penetration Testing Requirements Today What the Current Security Rule Says The current HIPAA Security Rule does not mention penetration testing or vulnerability scanning by name. It requires two things that testing supports. The first is an accurate and thorough risk analysis of the risks to the confidentiality, integrity, and availability of ePHI (45 CFR 164.308(a)(1)(ii)(A)). The second is a periodic technical and nontechnical evaluation of how well the security policies and procedures meet the rule (45 CFR 164.308(a)(8)). A penetration test is a widely used way to make both defensible, because it shows what an attacker can actually reach rather than what a policy says should be protected. Findings also feed the risk management requirement, which obliges an organization to reduce identified risks to a reasonable and appropriate level. HHS has stated that the current Security Rule remains in effect while the rulemaking described below continues. Why the Lack of a Named Requirement Still Creates Exposure The absence of a named requirement is not the same as safety. OCR has made failures to conduct an accurate and thorough risk analysis the centerpiece of its enforcement since launching its Risk Analysis Initiative in October 2024, and a risk analysis built only on questionnaires and policy review has no technical evidence behind it. Enterprise customers, health plans, and cyber insurers also often ask for a recent third-party test report during security reviews, whether or not HIPAA asks for one. There is a practical argument as well. A risk analysis states that a vulnerability exists; a test shows whether it can be exploited and what it leads to. That difference is what lets a compliance officer rank risks by evidence instead of by opinion. Elevate’s guide to the HIPAA security risk assessment covers how the two fit together. What Is Changing: The HHS Proposal and the Senate Bill The HHS Proposal Would Make Annual Testing Explicit HHS published a proposed update to the Security Rule on January 6, 2025. It would require penetration testing at least once every 12 months, or in accordance with the organization’s risk analysis, whichever is more frequent, and it would require vulnerability scanning at least every six months. The proposal defines who may perform the test: a qualified person with appropriate knowledge of and experience with generally accepted cybersecurity principles and methods for protecting the confidentiality, integrity, and availability of ePHI. It applies to covered entities and business associates. The text is in the Federal Register, and HHS’s fact sheet summarizes it. It is still a proposal. Reporting on HHS’s rulemaking schedule places a final rule no earlier than July 2027 and notes that it may never be finalized. The practical reading is that the proposal describes what HHS considers good practice, so an organization that tests annually is aligned with it whether or not it becomes final. The Senate Bill Names Penetration Testing Too The Health Care Cybersecurity and Resiliency Act (S. 3315) passed the Senate by unanimous consent on September 30, 2026. Section 8 would direct HHS to update the Security Rule to require covered entities, business associates, and other non-governmental entities in the Healthcare and Public Health Sector to adopt minimum risk-based practices, including requirements to conduct monitoring, including penetration testing, to maintain the protections of information systems. The bill is not law, the House must still act, and any resulting regulations would take effect 36 months after enactment. Unlike the HHS proposal, the bill sets no testing frequency and leaves that to rulemaking. The text is on Congress.gov. Two independent efforts, one regulatory and one legislative, now name the same control. That makes penetration testing a reasonable baseline to plan around even though neither effort has produced a binding rule. Penetration Testing vs Vulnerability Scanning vs Risk Analysis How the Three Fit Together The three terms are often used interchangeably, and that confusion is the most common reason an organization believes it has done more than it has. Each answers a different question, and HIPAA needs all three eventually. Activity Question it answers Method Role under HIPAA Risk analysis Where is ePHI, and what could harm it? Structured review of assets, threats, vulnerabilities, likelihood, and impact Required today Vulnerability scan Which known weaknesses exist? Automated tools run against systems Proposed at least every 6 months Penetration test Can an attacker get in and reach ePHI? A qualified person simulates attacks and chains weaknesses Proposed at least every 12 months; named in S. 3315 The table shows why a scan cannot stand in for a test. A scan lists weaknesses and assigns severity from a database, while a test shows whether those weaknesses combine into a path to patient data. A test is also not a risk analysis: it is one input to it. A report that says an attacker reached a billing database through a forgotten VPN account is evidence for the risk analysis, but it does not identify every place ePHI lives or rank every threat. Elevate’s Vulnerability Management as a Service covers the scanning layer between tests. What a HIPAA Penetration Test Should Cover Start From the ePHI Inventory, Not the IP Range The scope of a HIPAA test should follow the data. Begin with the systems that create, receive, maintain,