HITRUST readiness engineering
When a health system asks your team for a HITRUST certification, the assessment tests controls that live in your product and cloud. Agnotic Technologies builds and documents those controls so your team reaches the e1, i1 or r2 assessment ready.
Trusted by global innovators
What does HITRUST readiness mean for software?
HITRUST readiness software development is the engineering work that builds and documents the controls a HITRUST CSF assessment tests: access control, encryption, logging, vulnerability management and incident response. Health tech CTOs need it when health system customers ask for an e1, i1 or r2 certification and the controls must already run before an external assessor arrives.
e1 vs i1 vs r2
Which HITRUST assessment fits your product?
HITRUST e1, i1 and r2 are all built on the HITRUST CSF and differ in control count, validity and fit. This is how we help teams choose where to start.
| Assessment | Control requirements | Valid for | Usually fits |
|---|---|---|---|
| e1 | 43 foundational cybersecurity controls | 1 year | Startups and products with a limited risk profile, or a first step toward i1 or r2 |
| i1 | 182 control requirements focused on leading practices | 1 year | Teams with an established security program that need to show leading practices |
| r2 | Tailored, with the highest level of control requirements | 2 years | Vendors that must show compliance with sources such as HIPAA and the NIST Cybersecurity Framework, or need tailored controls |
Figures from HITRUST's assessments page, checked October 2026. Agnotic builds and documents the controls; an external assessor performs the validated assessment.
How does Agnotic build HITRUST readiness?
A structured, risk-based approach to HITRUST readiness, tailoring the CSF's control domains to your risk factors and building to the required maturity levels.
Scoping & Readiness
We determine your CSF scope and assessment type (e1, i1, or r2), map inheritance, and identify gaps against the required control domains.
Control Tailoring
We tailor the CSF control domains to your organizational, system, and regulatory risk factors, so you implement the controls that actually apply.
Implementation & Maturity
We implement controls to the required maturity levels (policy, process, and implemented) with the documentation the assessor scores against.
Assessment Support
We support your authorized external assessor through validation, remediate findings, and prepare the evidence for certification.
App gallery
View AllLera Health
Readiness-first delivery
A repeatable process for HITRUST CSF engineering that builds controls to the required maturity from the start, so the validated assessment checks work that is already done.
Scope & Factor Analysis
We define the assessment type and scope, capture your risk factors, and determine the applicable CSF controls.
Control Implementation
We implement the required controls across access, encryption, monitoring, and governance to the CSF's maturity expectations.
Documentation & Maturity Scoring
We produce policy and process documentation and evidence so each control scores at the required maturity level.
Validated Assessment & Certification
We support the external assessor through validation and remediation on the path to r2 certification.
Which controls does
the HITRUST CSF test?
Safeguards mapped to the HITRUST CSF control domains (access, encryption, network protection, audit logging and incident response), implemented and documented to the maturity levels the assessment scores.
What does HITRUST publish about its assessments?
Short facts from HITRUST and the HIPAA Security Rule, each linked to its primary source.
HITRUST's e1 assessment covers 43 foundational cybersecurity controls and its i1 covers 182 control requirements, each valid for 1 year. The r2 is tailored, carries the highest level of control requirements and is valid for 2 years.
Source: HITRUST, Assessments and CertificationsThe e1, i1 and r2 are all built on the HITRUST CSF, so work from one assessment can be applied to a more comprehensive one, and organizations can inherit controls from certified cloud service providers.
Source: HITRUST, Assessments and CertificationsHITRUST describes the r2 as best suited to organizations that must show compliance with authoritative sources such as HIPAA and the NIST Cybersecurity Framework, or that need expanded tailoring of controls.
Source: HITRUST, Assessments and CertificationsThe HIPAA Security Rule requires administrative, physical and technical safeguards for electronic protected health information.
Source: 45 CFR Part 164 Subpart C (eCFR)
Which standards sit alongside HITRUST?
HIPAA
Health Insurance Portability and Accountability Act
Protect PHI with privacy-first architecture, encrypted storage and transmission, strict access controls, and traceable audit logs.
GDPR
General Data Protection Regulation
Implement lawful consent flows, data minimization, retention controls, and secure processing for sensitive health data.
FHIR
Fast Healthcare Interoperability Resources
Enable standardized health data exchange across apps, care teams, and systems through standards-based FHIR APIs.
HL7
Health Level Seven International
Support enterprise-grade interoperability with HL7-based integrations for records, events, and clinical messaging workflows.
HITRUST
Health Information Trust Alliance
Align security programs to healthcare-specific control and risk management practices trusted by providers and ecosystem partners.
HITECH
Health Information Technology for Economic and Clinical Health Act
Design with breach notification readiness, digital record safeguards, and operational controls that support regulated care programs.
SaMD
FDA Software as a Medical Device
Plan software quality, traceability, and documentation pathways for products that may require SaMD review and submission.
MDR (EU)
Medical Device Regulation (European Union)
Prepare EU market-ready processes for risk classification, evidence tracking, and lifecycle governance under MDR expectations.
SAMHSA
Substance Abuse and Mental Health Services Administration
Apply confidentiality controls and consent-aware sharing models for behavioral and mental health data experiences.
Featured case study
Read Case StudyLera Health: compliant health platform
Related proof of controls-first delivery: for Lera Health we engineered access controls, encryption and audit-ready logging into the data layer, the same kind of controls the HITRUST CSF measures.
HITRUST readiness FAQs
Build compliantly