HITRUST

Prepare for HITRUST.
Build a program you can keep running.

HITRUST can become one of the most operationally demanding compliance initiatives a growing company takes on. 22 helps organize the people, policies, controls, remediation, evidence, and recurring work behind the effort so your internal team isn't trying to run it from the side of someone's desk.

Talk to 22 about HITRUST See how 22 works

Official HITRUST readiness and validated assessment activities are performed through appropriately authorized HITRUST organizations. 22 focuses on helping your company build, coordinate, and operate the underlying program.

The real work

HITRUST isn't one compliance task.

A HITRUST initiative touches nearly every part of a company's security and compliance program.

Policies need to match reality. Controls need owners. Technical processes need to operate consistently. Evidence needs to exist. Gaps need to be remediated. People across engineering, IT, HR, legal, operations, and leadership need to participate.

And all of that work has to move toward the requirements of the assessment.

The framework may define what needs to be demonstrated. Someone still has to run the work.

That's where 22 fits.

Program support

Give the HITRUST work an owner.

Program Planning

Turn a large compliance initiative into an operating roadmap with priorities, responsibilities, dependencies, and deadlines.

Policy Program

Create, update, organize, and maintain the policies needed to support the organization's security and compliance program.

Control Coordination

Help translate compliance expectations into defined internal responsibilities and coordinate the people responsible for operating those processes.

Gap Remediation

Turn identified deficiencies into clear remediation work with owners, priorities, status, and follow-through.

Evidence Preparation

Help internal teams understand, organize, and prepare the documentation and evidence needed to support their assessment activities.

Risk Management

Maintain risk information, treatment decisions, remediation activity, and supporting documentation as part of the broader compliance program.

Internal Coordination

Coordinate across engineering, IT, HR, legal, operations, security, and leadership so the compliance program doesn't depend on one overloaded executive.

Assessor Coordination

Help organize the internal work surrounding the relationship with your authorized HITRUST External Assessor.

Ongoing Operations

After an assessment or certification milestone, continue operating policies, reviews, risks, controls, remediation, and recurring compliance work.

Beyond the project

Certification is a milestone.
The program keeps going.

The worst time to rediscover how your compliance program works is when the next assessment begins.

Policies change. Systems change. People change. Vendors change. Risks change. Evidence changes. Customer expectations change.

22 helps keep the underlying program operating between major assurance events so the next compliance cycle doesn't require rebuilding everything from scratch.

The objective isn't simply to prepare for HITRUST. It's to build a compliance function capable of supporting HITRUST over time.

Explore 22 Compliance

Right-sized assurance

e1, i1, or r2?

HITRUST offers multiple assessment paths designed for different levels of organizational complexity, risk, and assurance. The right starting point depends on what your customers require, the maturity of your program, the systems in scope, and the level of assurance you need to demonstrate.

Foundational assurance

Designed as a more focused entry point for organizations seeking validated assurance around foundational cybersecurity practices.

Broader cybersecurity assurance

Designed for organizations that need a broader level of assurance around established cybersecurity practices.

Risk-based, tailored assurance

The most comprehensive of the three core assessment approaches, designed for organizations that require more extensive tailoring based on risk, regulatory requirements, and the environment being assessed.

Work across the HITRUST assessment portfolio is designed to be increasingly reusable as organizations move toward more comprehensive assurance.

Talk to 22 about where you are starting

HITRUST + SOC 2

HITRUST or SOC 2?

For many technology companies, the answer depends less on which framework sounds better and more on what their customers actually require.

SOC 2 is widely used by technology and SaaS companies to provide independent assurance around controls relevant to security and other applicable Trust Services Criteria. HITRUST provides a prescriptive cybersecurity assurance framework and certification program that is particularly prominent in healthcare and other risk-sensitive industries, while also being used more broadly by technology and service organizations.

Some companies need one. Some eventually need both.

What assurance will satisfy the customers and market you're selling into?

High-level comparison of SOC 2 and HITRUST
Consideration	SOC 2	HITRUST
Common use	B2B technology and service-provider assurance	Cybersecurity assurance across healthcare, technology, and other risk-sensitive environments
Structure	Based on applicable Trust Services Criteria	HITRUST CSF-based assurance program
Outcome	Independent SOC 2 report	HITRUST certification when certification requirements are met
External party	Independent CPA firm	HITRUST Authorized External Assessor and HITRUST
Program need	Operating controls and evidence	Operating controls, evidence, and assessment-specific HITRUST requirements

Talk to 22 about your compliance path Explore SOC 2 readiness

Where programs get stuck

The hard part is coordination.

Too many owners

Security and compliance responsibilities are spread across multiple teams.

Policies don't match operations

Documents exist, but they no longer describe how the company actually works.

Evidence starts too late

Teams discover during assessment preparation that expected documentation was never consistently generated or retained.

Remediation has no operating owner

A gap gets identified but nobody owns driving it through completion.

Compliance software becomes another inbox

The organization has a platform but still lacks someone responsible for moving the work.

Everything depends on one person

A CTO, security lead, IT leader, or compliance employee becomes the single point through which the entire program flows.

HITRUST becomes much more manageable when the compliance program underneath it has clear ownership.

Clear roles

Your assessor assesses.
Your team operates.
22 helps keep the work moving.

A HITRUST certification effort requires appropriately authorized HITRUST assessment resources. 22 does not replace that role. Instead, 22 can support the organization around the assessment.

The result is a clearer division of responsibility. Your authorized assessor remains responsible for the official assessment work. 22 helps your organization operate the program being assessed.

Organize internal stakeholders
Manage remediation work
Maintain supporting policies
Coordinate control owners
Organize documentation
Track evidence preparation
Manage deadlines
Prepare internal teams for requests
Coordinate outstanding work
Keep leadership informed
Continue operating the program after the assessment

Tools

MyCSF for the assessment.
Groundset for the operating work when it makes sense.

HITRUST's proprietary assessment environment and framework content should remain within appropriately licensed HITRUST systems and workflows. Groundset can provide a home for the work around the program.

Project status
Internal responsibilities
Remediation tasks
Company policies
Internal risk register
Evidence-request workflow
Due dates
Internal compliance activities
Assessment milestones
Executive reporting

Plus links or references to externally maintained assessment items, so nothing proprietary is duplicated outside the systems that hold it.

The proprietary HITRUST assessment stays where it belongs. The operational work can still be organized.

Already have another GRC or project-management environment? That's fine. 22's service does not depend on using Groundset.

See how Groundset fits

Who we help

Built for companies with a serious assurance requirement.

Healthcare Technology

Organizations selling products and services into healthcare environments where customers expect mature security and assurance practices.

SaaS + Technology

Technology companies whose customers specifically require HITRUST or whose market is increasingly asking for stronger third-party assurance.

Data + Infrastructure Providers

Companies entrusted with sensitive customer information or supporting systems where customers expect formal cybersecurity assurance.

Growing Companies Without a Dedicated HITRUST Team

Organizations capable of operating the program but without enough internal compliance capacity to coordinate the entire effort alone.

Scope

Priced around the work, not a package.

HITRUST program support is scoped based on the current environment, assessment path, remediation needs, and level of ongoing operating support required.

The starting conditions vary too widely for a fixed price to mean anything. A company with accurate policies and owned controls needs a fraction of the work of one starting from a blank page.

External Assessor fees, HITRUST and MyCSF costs, certification fees, penetration testing, and other specialized technical assessments are separate third-party costs unless a proposal specifically says otherwise.

See engagement options

HITRUST questions

What is HITRUST?

HITRUST provides a cybersecurity assurance framework and certification program built around the HITRUST CSF. Organizations use HITRUST assessments to demonstrate that defined cybersecurity controls are implemented and operating at the level required by the applicable assessment.

Is HITRUST the same as HIPAA?

No. HITRUST and HIPAA are not the same thing. HIPAA is a U.S. regulatory framework applicable to certain healthcare organizations and activities. HITRUST is a cybersecurity assurance framework and certification program that can incorporate requirements from multiple authoritative sources. Whether HIPAA applies to your business is a legal determination for qualified counsel.

Is HITRUST only for healthcare companies?

No. HITRUST has strong adoption in healthcare, but its cybersecurity assurance programs are also used by technology companies, service providers, and other organizations that need to demonstrate security maturity to customers and business partners.

What is the difference between HITRUST e1, i1, and r2?

They represent different levels of assurance and assessment depth. e1 provides a more focused foundational approach, i1 provides broader cybersecurity assurance, and r2 provides the most comprehensive and risk-tailored approach. The appropriate path depends on customer requirements, risk, program maturity, and scope.

Can 22 determine which HITRUST assessment we need?

22 can help your team evaluate the business drivers, customer requirements, current program, and operational implications of the available paths. Formal assessment decisions should also be coordinated with the appropriate authorized HITRUST resources.

Does 22 perform HITRUST assessments?

22 supports the internal program work surrounding a HITRUST initiative. Official HITRUST readiness and validated assessment activities must be performed by appropriately authorized HITRUST organizations. 22 does not represent itself as an authorized HITRUST External Assessor or Readiness Licensee unless that status is specifically established in the future.

Can 22 help us prepare for a HITRUST assessment?

Yes. 22 can help build and operate the underlying security and compliance program, coordinate internal owners, maintain policies, manage remediation, organize evidence preparation, and keep the overall effort moving alongside the appropriate authorized HITRUST assessment resources.

Can 22 work with our HITRUST External Assessor?

Yes. A major part of 22's role can be helping your internal organization stay coordinated around requests, remediation, documentation, deadlines, and program activities while the External Assessor performs its authorized assessment responsibilities.

Can Groundset replace MyCSF?

No. Groundset is not positioned as a replacement for MyCSF or as a HITRUST assessment platform. Groundset can be used to organize internal compliance work, remediation, policies, risks, evidence workflows, and program responsibilities surrounding the HITRUST effort.

What happens after HITRUST certification?

The security and compliance program still needs to operate. Systems change, employees change, policies need review, risks evolve, and controls continue to require ownership. 22 Compliance can provide ongoing compliance operations after the certification milestone.

How is HITRUST program support priced?

HITRUST program support is scoped based on the current environment, assessment path, remediation needs, and level of ongoing operating support required. There is no fixed price, because the range of starting conditions is too wide for one to be meaningful.

Are External Assessor and HITRUST fees included?

No, unless a proposal specifically says so. External Assessor fees, HITRUST and MyCSF costs, certification fees, penetration testing, and other specialized technical assessments are separate third-party costs.

Can we work with 22 if we already have a compliance platform?

Yes. 22 can work within the environment you already use. Groundset is available when it is useful, but the service is not dependent on replacing an existing platform.

Keep reading