The HITRUST e1 Assessment Explained: What You Need to Know

Over the past couple of years, HITRUST has expanded exponentially to become an all-encompassing certification that can be achieved by a wide variety of industries and organizations. When HITRUST endeavored to become more accessible to more institutions, they introduced alternatives to the now-typical 2-year (r2) certification.

One of HITRUST's most notable expansions is a lower-effort validated cybersecurity assessment option they have designated as their HITRUST Essentials, 1-year (e1) Assessment.

As experienced HITRUST assessors, we’re going to explain the basics of this assessment option, including its benefits and a high-level comparison of all three HITRUST assessments. The e1 option represents an exciting opportunity for those who have perhaps not yet committed to HITRUST certification—read on to find it if it’s the right move for you.

What is the HITRUST e1 Assessment?

Presuming you’re familiar with the HITRUST i1 and r2 assessments, the e1 assessment offers clients a certification alternative that is significantly lower effort and cost than the typical r2 assessment.

Like its siblings—the i1 and r2—the e1 is also designed to be threat-adaptive. HITRUST consistently reevaluates the most pressing cyber threats through its quarterly reconciliation of cyber threat intelligence to the HITRUST CSF requirements—therefore, when changes are necessary, they will be included in major and minor releases of the HITRUST CSF.

However, with its static baseline of only 44 requirements, the e1 assessment can be completed in a much shorter timeframe while still providing your clients with assurance regarding your good security hygiene.

This e1 assessment can also serve as just a first step for those who are:

• New to HITRUST
• Planning to continue onto the more thorough i1 and r2 assessments
• Interested in evaluating the risk management of your (potential) third-party vendors

Should you complete the e1 certification process, your deliverables will include the certification report, certification letter, and certification letter with scope, which can be distributed to your clients as evidence of your foundational benchmark of proper cybersecurity controls.

Key Benefits of the e1 Assessment

HITRUST wouldn’t introduce an assessment option without established use cases, but there are a few key considerations when deciding if the e1 is the right option for your organization:

• Flexibility: The e1 assessment can be performed as a readiness or validated assessment – and readiness assessments can be performed with an External Assessor or as a self-assessment.
  • If you opted for the former, the scope of your e1 assessment would be fully inheritable for your subsequent i1 and r2 assessment, as all controls are nested into the more comprehensive certifications.
• Broad Appeal: The e1 assessment’s focused scope contains key controls that are inherently expected for nearly all entities, making it relevant to any and all industries seeking proper cybersecurity hygiene.
• Addresses Modern Threats: As per HITRUST’s commitment to threat adaptability, such threats addressed include those that are potentially high impact like phishing and ransomware.
• Lean and Low Effort: The curated set of 44 cybersecurity controls focuses on fundamental cybersecurity practices while remaining lean and relatively low effort when compared to the i1 and r2 assessments.
  • e1 assessments focus mostly on implemented evidence, which significantly reduces the amount of Policy and Procedure updates, compared to that which is necessary for the r2 assessment.
• Shorter Turnaround: The Quality Assurance phase of the e1 assessment—during which HITRUST reviews and issues the certification—is significantly reduced. You would receive certification no more than 30 days after submission (or your next e1 Validated Report is complimentary). 

HITRUST e1 vs. i1 vs. r2

To help put all of this into perspective, we put together a breakdown of the high-level elements of all three HITRUST assessments. If you’re brand new to HITRUST, this might provide a good starting point for understanding all three of your options:

For further details on the i1 and r2, you can also check our article here.

Key Considerations for HITRUST Certification

Through it's significant expansions, HITRUST has grown its key offerings from two to three assessments. The newest option in the e1 represents both a lighter lift in proving your cybersecurity hygiene as well as an avenue to the more robust HITRUST assessments.

Though you may now understand more about the e1, HITRUST certification features many complexities you’ll need to navigate, no matter which assessment you choose. To learn more about these intricacies, check out our other content further detailing different aspects:

• What is the HITRUST Process?
• How to Prepare Your Service Providers for HITRUST Certification
• HITRUST Self-Assessments Explained

Of course, you may find you have more organizationally specific questions regarding this framework—if so, please feel free to contact us, and our experts would be happy to address your needs and clear the way for your moving forward with HITRUST.