Your inbox (or LinkedIn feed, perhaps) is inundated by organizations that claim to help you keep your data safe. But you need more than claims to know if you can trust their products. One very easy and effective way to establish a trust baseline is to look for HITRUST certification on the product or solution. In this article, we’ll review what HITRUST CSF is, its rigorous requirements, and why this important certification matters to you.
What is HITRUST and the HITRUST Certification?
HITRUST is a non-profit organization that was founded in 2007 by a consortium of healthcare, technology, and security organizations, with the goal to help organizations better and more easily safeguard information and manage risk. While the HITRUST Common Security Framework (CSF) was originally established to assist healthcare organizations, HITRUST now serves, and is applicable to, all industries, particularly those that work with a high volume of sensitive information. Achieving HITRUST Certification is no small feat; this certificate is considered the “gold standard” for demonstrating the seriousness and robustness of an organization’s approach to security, privacy, and compliance protection.
What Does the Framework Look Like?
The HITRUST framework is a set of controls that brings together over 40 standards and regulations. HIPAA, HITECH, PCI, GDPR, NIST, ISO and state-specific regulations are included, among others. The HITRUST certification mark means that a service or product meets the requirements laid out by all these standards and regulations. As the most comprehensive framework available, HITRUST CSF includes 14 control categories:
0.0 Information Security Management Program
1.0 Access Control
2.0 Human Resources Security
3.0 Risk Management
4.0 Security Policy
5.0 Organization of Information Security
6.0 Compliance
7.0 Asset Management
8.0 Physical and Environmental Security
9.0 Communications and Operations Management
10.0 Information Systems Acquisition, Development and Maintenance
11.0 Information Security Incident Management
12.0 Business Continuity Management
13.0 Privacy Practices
Within each of these categories, there are objectives. Each category has one or more objectives for a total of 48 among the 14 categories. Each objective can also have one or more “references” or requirements. Adding up all the objectives, categories and requirements, there are a minimum of 156 and a maximum of well over 500 controls (or requirements) a company must implement to become certified. In addition to implementing the controls, each requirement must also be verified, either through a self-assessment, or by a third-party assessor. Each response must be backed by specific evidence demonstrating that the company not only has policies and procedures in place, but also follows them on a regular basis. HITRUST certifications are valid for two years and after that, must be recertified. The certification process typically takes nine months to a year. Because of this rigorous process, you can be assured that HITRUST certified services and products will provide your organization’s data with some serious protection.
Why Look for HITRUST Certification?
Information security and privacy mechanics tend to live in the background, rather than front and center where we can easily see them. This makes it challenging to fully evaluate a product or service’s trustworthiness at first. But when that product or service is HITRUST certified, you can rest assured that a rigorous set of controls have been applied to keep your organization’s information secure and protected.
In short, it’s all about trust, and seeing the company’s credentials for yourself.
Using HITRUST-certified products and services also demonstrates to your customers and partners that you are serious about their information privacy and security. In today’s security-conscious world, customers will often switch businesses after a security breach. In fact, a 2019 study from PCI Pal shows that after a breach, 83% of customers will stop spending with a business for several months. Using a HITRUST certified product can help mitigate both the risk of a breach and of losing customer trust.
No matter what you do, there will always be security risks for your information. It’s no different than getting in the car every morning and driving to work. There’s always a risk of having an accident and sustaining an injury. But by following safety procedures and rules, such as staying alert and wearing a seatbelt, you can mitigate risk, even if you have an accident. HITRUST certified products and services – like DataMotion’s secure mail and Direct Secure Messaging platforms – do the same thing for your information. Reduce your risk by choosing a HITRUST certified service.
Read more about DataMotion’s HITRUST CSF Certification in our press release.
Still have some questions on what the HITRUST CSF Certification is? Stop by our frequently asked questions.
