HITRUST or SOC 2+HITRUST: Which Should You Choose?

One of my favorite quotes from Ghostbusters is the exchange between Ray Stantz and Peter Venkman:

Ray Stantz: “Hey, where do these stairs go?”
Peter Venkman: “They go up.”

It’s a great line and an amazingly simple answer to the question.  The answer is not so simple, however, for those organizations that are tasked with achieving HITRUST CSF Certification before the end of 2017.  Due to a 2015 press release that announced many healthcare organizations will be requiring their business associates to obtain the certification to demonstrate effective security and privacy practices, many organizations are scrambling to determine the best approach for meeting this need or if an alternative approach will be acceptable.

One alternative to obtaining a HITRUST CSF Certification is the SOC 2+HITRUST report that was recently announced as a collaboration between HITRUST and the AICPA.  There are many similarities and differences between the two reports, but they are both intended to be used as tools to illustrate an organization’s security and privacy practices for protected health information (PHI).

Both reports utilize the HITRUST CSF as the base framework for addressing security and privacy practices.  While the SOC 2 does have its specific criteria for each of the Trust Services Principles (TSP)  of security, availability, processing integrity, and confidentiality, HITRUST and the AICPA have mapped the CSF controls to these criteria to provide full coverage of the CSF controls required for CSF Certification (to date, the privacy principle has not been mapped).  However, since HITRUST has different level requirements for controls based on scoping factors for organizations, it is still critical for organizations undergoing a SOC 2+HITRUST to declare the organization, system, and regulatory factors that determine the true scope of HITRUST requirements that have to be tested for SOC 2 criteria.  The factors for one organization may only require Level 1 implementations in an examination, while the factors for another organization could require up to Level 3 implementations. 

Although the same scope of controls is tested whether we are talking about a CSF assessment or a SOC 2 examination, how the controls are examined is different.  HITRUST requires a maturity rating to be established for each control requirement, whereas SOC 2+HITRUST will only test for the design of the control for a Type 1 engagement and both the design and operating effectiveness of the control for a Type 2 engagement.  HITRUST also allows for Corrective Action Plans (CAPs) to help with the achievement of certification.  SOC 2+HITRUST does not identify CAPs and only reports the control deviations that are determined through testing.

Both reports require an independent third party examination performed by a qualified professional.  The SOC 2 report obviously requires the services of a CPA, and HITRUST CSF Certification requires the services of a HITRUST approved CSF Assessor organization.  A third reporting option actually combines the two separate SOC 2+HITRUST and HITRUST certification reports into a single SOC 2+HITRUST + HITRUST Certification report.  This reporting option merely requires that both types of examinations be performed and have the results of the HITRUST CSF Certification placed into the unaudited section of the SOC 2 report.

The frequency in which the full examinations for each report have to be performed are also different.  The HITRUST Certification is valid for 2 years.  During the second year of the certification, the CSF Assessor is required to test a sample of at least one control from each of the 19 assessment domains and provide the results to HITRUST for review and continuation of the certification for the second year.  SOC 2+HITRUST reports differ in that the CPA firm performing the examination must perform the full scope of testing for each examination that is performed.

The table below provides the different reporting options associated with SOC 2 and HITRUST and some of the characteristics associated with each.  When making a decision about the type of report to prepare for clients, prospects, or providers, ensure that your organization selects the CPA firm/HITRUST Assessor that understands the distinct difference between the reporting options and that it partners with your organization to provide the service and expertise necessary for HITRUST reporting.

SOC 2 / HITRUST Reporting Options

¹ The CPA firm must have a valid license to utilize the HITRUST CSF.

² Year 2 of a HITRUST Certification requires an annual review to be performed by the CSF Assessor that consists of testing a minimum sample of one control from each domain.