HITRUST e1 vs i1 vs r2: Which Assessment Is Right for You?

Quick answer: HITRUST e1 is the lightest validated assessment and fits organizations that need foundational assurance quickly. HITRUST i1 is a mid-level assessment with a fixed set of leading-practice requirements and stronger assurance. HITRUST r2 is the most rigorous, risk-based assessment, tailored to your scope and risk factors, and is the one most often requested by large healthcare and enterprise customers.

Customers in healthcare, insurance and financial services increasingly ask vendors for a HITRUST certification. The challenge for many teams is not whether to pursue one, but which one. HITRUST offers three validated assessments, e1, i1 and r2, and the choice affects scope, effort, timeline and what your customers will accept.

This guide compares HITRUST e1 vs i1 vs r2 in practical terms so you can match the assessment to your customers' expectations and your resources. If you want help selecting and preparing for one, see Privaxi's HITRUST certification services.

What Is HITRUST?

HITRUST is a security and privacy assurance program built around the HITRUST CSF, a framework that harmonizes requirements from standards and regulations such as HIPAA, NIST, ISO 27001 and PCI DSS. Instead of passing several separate audits, an organization can undergo one validated assessment against the CSF and share a single certification report with many customers.

A validated assessment means an independent HITRUST-authorized external assessor tests your controls, and HITRUST reviews the results before issuing a report or certification. The three levels differ in how much they test and how much assurance they provide.

HITRUST e1 Assessment: Foundational Assurance

The HITRUST e1 assessment is the entry-level validated option. It focuses on essential cybersecurity hygiene, covering a limited set of requirements aimed at the controls that matter most against common threats such as ransomware and phishing.

• Best for: startups, smaller vendors, and organizations responding to a first customer request for third-party assurance.
• Effort: the lightest of the three, with a smaller control set and a faster path to a report.
• Validity: one year.
• Trade-off: some large enterprises and payers ask for i1 or r2 instead, so confirm what your customers accept before you start.

HITRUST i1 Assessment: Leading-Practice Assurance

The HITRUST i1 assessment sits in the middle. It uses a fixed, curated set of requirements selected to address current cyber threats, informed by threat intelligence and security best practices. Because the set is predefined, there is less tailoring and a more predictable preparation process. Privaxi's article on how i1 control selection works explains how the requirements are chosen.

• Best for: growing companies that need stronger assurance than e1 without the full scope of r2.
• Effort: moderate, with clearly defined requirements and a repeatable approach.
• Validity: one year.
• Trade-off: it does not adapt to your specific risk profile in the way r2 does.

HITRUST r2 Certification: Risk-Based Assurance

HITRUST r2 certification is the most comprehensive option. The set of requirements is tailored to your organization using scoping factors such as the type of data you handle, regulatory obligations, and the size and complexity of your environment. That makes it the most defensible assessment for organizations that handle large volumes of sensitive health data.

• Best for: health systems vendors, payers, large SaaS and data processors, and any organization whose customers specifically require r2.
• Effort: highest, with the broadest control set and the most evidence to collect.
• Validity: two years, with an interim assessment between certification cycles.
• Trade-off: significantly more preparation, time and cost than the other levels.

HITRUST e1 vs i1 vs r2: Side-by-Side Comparison

How Much Does HITRUST Certification Cost?

There is no single price, because HITRUST certification cost depends on several variables:

• Assessment level. e1 costs less than i1, and i1 costs less than r2.
• Scope. The number of systems, locations, business units and third parties in scope drives effort.
• Readiness. Organizations with mature policies and evidence prepare faster and spend less.
• HITRUST fees. Platform, assessment and QA fees are paid to HITRUST in addition to assessor and consultant fees.
• Remediation. Gaps found in a readiness assessment need fixing before validation.

To estimate your own range, Privaxi's guide on using the HITRUST calculator to estimate certification costs walks through the inputs.

How to Choose the Right HITRUST Assessment

1. Ask your customers. Find out which level they accept, and whether they will treat e1 or i1 as sufficient.
2. Look at your data. Large volumes of protected health information usually point toward r2.
3. Consider timing. If a deal depends on a report this quarter, e1 or i1 can be faster.
4. Plan for the path. Many organizations begin with e1 or i1 and move to r2 as customers and scope grow.
5. Check regulatory drivers. HIPAA, state laws and contracts may point to a particular level.

HITRUST Readiness Assessment: Why It Comes First

A HITRUST readiness assessment is a self-guided or consultant-led review against the requirements for your chosen level before the validated assessment begins. It shows where evidence is missing, which controls need work and how long remediation will take. Skipping it is the most common cause of delays and surprise costs. Our 2026 HITRUST readiness guide walks through the preparation steps, and an assessor's view of what you need to know covers what happens during validation.

Where Penetration Testing Fits in a HITRUST Assessment

Technical vulnerability management is part of the HITRUST CSF, and penetration testing is a common way to evidence it. How much testing is expected depends on the assessment level and your scope, so confirm the specific requirements for your assessment. If you need testing as part of your preparation, see Privaxi's HITRUST penetration testing service and our guide to penetration testing scope.

HITRUST Certification Timeline: What to Expect

Timelines vary with scope and readiness, so treat the sequence below as the order of work rather than a schedule:

1. Scoping and level selection. Decide which systems, business units and data are in scope, and confirm the level with your customers.
2. Readiness assessment. Compare your current controls and evidence with the requirements and list the gaps.
3. Remediation. Close gaps, write or update policies and procedures, and start collecting evidence.
4. Validated assessment. An authorized external assessor tests your controls and reviews evidence.
5. Quality assurance. HITRUST reviews the submission and may ask for clarification.
6. Report and certification. You receive the report and, if you meet the criteria, certification you can share with customers.
7. Maintenance. Continue operating controls, and complete the interim or annual obligations for your level.

Evidence generally has to cover a period of operation, not just a point in time, which is why organizations that start collecting evidence early finish sooner.

Questions to Ask Before You Commit to a HITRUST Level

• Which HITRUST level do our top five customers or prospects accept, in writing?
• Is there a contractual or regulatory driver that names a specific level?
• Which systems and data will be in scope, and can we reduce scope sensibly?
• Do we already have SOC 2, ISO 27001 or HIPAA work we can reuse as evidence?
• Who will own evidence collection internally, and how much time can they give?
• Do we have a budget for HITRUST fees, assessor fees and remediation, not just the assessment?
• Will we need penetration testing, and have we planned it early enough to fix and retest?

Because HITRUST maps to many other frameworks, organizations that already hold other certifications often reuse a large share of their evidence. That overlap is the reason compliance teams look at how to engineer controls once and prove them many times, which we discuss in compliance fatigue and framework overlap.

Common HITRUST Mistakes to Avoid

• Choosing the level before talking to customers. The wrong choice means starting again.
• Setting scope too broadly. Include what you must, and segment what you can.
• Collecting evidence late. Evidence needs to cover the assessment period, not just a snapshot.
• Treating HITRUST as a one-time project. Annual upkeep and interim assessments need an owner.
• Ignoring third parties. Inherited controls and vendor evidence need planning.

Frequently Asked Questions

What is the difference between HITRUST e1, i1 and r2?

e1 is the foundational validated assessment with a limited requirement set, i1 is a mid-level assessment with a fixed, curated requirement set, and r2 is the most rigorous risk-based assessment with requirements tailored to your scope and risk factors.

Which HITRUST assessment should I start with?

Start with whichever level your customers accept. Many organizations begin with e1 or i1 for speed and move to r2 as scope and customer demands grow. If a key customer requires r2, go straight to r2.

How long is a HITRUST certification valid?

e1 and i1 certifications are valid for one year. r2 certification is valid for two years, with an interim assessment between certification cycles.

How much does HITRUST r2 certification cost?

It varies by scope, readiness and assessor, and r2 is the most expensive level because of its larger control set and evidence needs. A readiness assessment and cost calculator give a more accurate range for your situation.

Is a HITRUST readiness assessment required?

It is not mandatory, but it is strongly recommended. It identifies gaps and evidence needs before validation and reduces delays and rework.

Does HITRUST require penetration testing?

Technical vulnerability management is part of the HITRUST CSF, and penetration testing is a common way to meet it. The expectation depends on the assessment level and your scope, so confirm the requirements for your assessment.

Final Thoughts

Choosing between HITRUST e1 vs i1 vs r2 comes down to what your customers accept, how sensitive your data is and how quickly you need a report. Start with the customer conversation, run a readiness assessment and pick the lowest level that satisfies the people who are asking.

Privaxi helps organizations scope, prepare for and complete HITRUST assessments. Talk to us about HITRUST certification services to choose the right path.