HIPAA and HITRUST
Readiness Assessment
Built on Real Evidence
HIPAA and HITRUST readiness
Protect Health Data and Prepare for HITRUST With Confidence
Healthcare providers, health technology companies and their business associates must safeguard electronic protected health information (ePHI). iSpyCyber delivers HIPAA Security Rule risk analysis and HITRUST CSF readiness assessments, then supports remediation so you are prepared for the validated assessment performed by a HITRUST authorised External Assessor.
Why organisations choose iSpyCyber
ePHI-first scoping
We follow health data across systems, vendors and workflows, so safeguards are assessed where ePHI actually lives.
Defensible risk analysis
A documented HIPAA risk analysis that addresses the Security Rule requirement and informs risk management decisions.
Realistic HITRUST scoring
Requirements scored against HITRUST maturity levels so you know where you stand before engaging an External Assessor.
Technically validated
Our offensive security team verifies access, encryption and logging controls rather than relying on policy alone.
Practical remediation
Policies, procedures and technical fixes prioritised to close gaps efficiently ahead of validation.
Ongoing readiness
Periodic reviews and iefyx, our AI-native VAPT platform, help keep safeguards effective between assessments.
Coverage
Safeguards and Control Areas We Assess
Coverage spans the HIPAA Security Rule, relevant Privacy and Breach Notification Rule touchpoints and the HITRUST CSF control categories in your chosen scope.
Security management process
Risk analysis, risk management, sanctions policy and information system activity review.
Access control
Unique user IDs, role-based access, emergency access, automatic logoff and MFA.
Audit controls and monitoring
Logging of ePHI access, log review, alerting and retention.
Integrity and transmission security
Encryption at rest and in transit, integrity controls and secure messaging.
Business associate management
Business associate agreements, vendor due diligence and downstream subcontractors.
Incident and breach response
Security incident procedures and alignment with breach notification obligations.
Contingency planning
Data backup, disaster recovery, emergency mode operation and testing.
Physical and device safeguards
Facility access, workstation security, device and media controls.
Workforce security and training
Workforce clearance, security awareness training and policy acknowledgement.
Methodology
A Structured Six-Phase Readiness Methodology
Aligned to the HIPAA Security Rule, HHS risk analysis guidance, NIST SP 800-66 and the HITRUST CSF, and tailored to your organisation and target assessment.
- HIPAA Security Rule
- HITRUST CSF
- NIST SP 800-66
- NIST SP 800-30
- NIST CSF 2.0
4–8
weeks for a typical readiness assessment
6
structured readiness phases
100%
gaps mapped to remediation actions
01
- Week 1
Scope and ePHI mapping
Systems, locations, vendors and workflows that create, receive, maintain or transmit ePHI identified and scoped.
Key activities
- Map ePHI data flows and systems
- Identify business associates and agreements
- Agree HIPAA and HITRUST scope and objectives
- Output: Scope and ePHI inventory
02
- Weeks 1–2
Risk analysis
A HIPAA Security Rule risk analysis of threats and vulnerabilities to the confidentiality, integrity and availability of ePHI.
Key activities
- Identify threats and vulnerabilities to ePHI
- Assess likelihood and impact
- Document current safeguards
- Output: HIPAA risk analysis
03
- Weeks 2–4
Safeguard assessment
Administrative, physical and technical safeguards assessed against HIPAA and the relevant HITRUST CSF requirements.
Key activities
- Review policies, procedures and training
- Test access, audit, integrity and transmission controls
- Assess physical and device safeguards
- Output: Safeguard assessment results
04
- Weeks 3–5
HITRUST readiness scoring
Requirements scored against HITRUST maturity levels to estimate readiness for the chosen assessment type.
Key activities
- Select target assessment such as e1, i1 or r2
- Score policy, procedure and implementation levels
- Identify requirements at risk of falling short
- Output: Readiness scorecard
05
- Weeks 5–6
Report and roadmap
Gaps prioritised into a remediation roadmap with realistic timelines ahead of the formal validated assessment.
Key activities
- Prioritise gaps by risk and effort
- Build a remediation plan with owners
- Brief leadership and compliance teams
- Output: Readiness report and roadmap
06
- Until validation
Remediation support
Hands-on support for policies, controls and evidence so you are prepared for your authorised External Assessor.
Key activities
- Support policy and control remediation
- Review closure evidence
- Prepare evidence for the validated assessment
- Output: Assessment readiness pack
Effort distribution
Where the assessment time goes
Most of the effort goes into analysing risk and testing safeguards against evidence. Percentages are indicative for a typical combined HIPAA and HITRUST readiness assessment.
Quality built into every phase
Evidence-backed status
Each safeguard rating is supported by reviewed evidence.
Risk-based priorities
Gaps ranked by risk to ePHI, not by checklist order.
Independent review
Every report is quality-reviewed before release.
Clear boundaries
Readiness support only; certification is issued by HITRUST.
Engagement options
Choose the Readiness Path That Fits Your Goals
Every option uses the same safeguard mapping, so work carries forward from a first HIPAA review to HITRUST validation.
HIPAA risk analysis
A Security Rule risk analysis and safeguard gap assessment. Best for covered entities and business associates meeting HIPAA obligations.
HITRUST readiness assessment
Scoring against your target HITRUST assessment with a prioritised remediation roadmap. Best for organisations preparing for e1, i1 or r2 validation.
Remediation and ongoing readiness
Hands-on remediation support, evidence preparation and periodic reviews. Best for teams approaching validation or maintaining readiness year-round.
Not sure which option you need?
Our specialists will recommend an approach based on your customers, data flows and HITRUST goals.
Deliverables
Outputs for Leadership, Compliance and Assessors
A clear readiness position for leadership and organised evidence to support your validated assessment.
Executive summary
Overall HIPAA and HITRUST readiness, key risks and priorities in plain language.
HIPAA risk analysis report
Documented threats, vulnerabilities, likelihood, impact and risk ratings for ePHI.
Remediation roadmap
Prioritised actions with owners and timelines ahead of HITRUST validation.
Readiness scorecard and evidence
Requirement-level readiness scores and organised evidence for your External Assessor.
Supports your compliance and assurance requirements
- HIPAA Security Rule
- HIPAA Privacy Rule
- HIPAA Breach Notification Rule
- HITRUST CSF
- NIST SP 800-66
- NIST CSF 2.0
- ISO/IEC 27001
- SOC 2
- DPDP Act 2023
- GDPR
iSpyCyber provides HIPAA risk analysis, HITRUST readiness assessment and remediation support. iSpyCyber does not issue certifications; HITRUST certification is issued by HITRUST following a validated assessment performed by an authorised External Assessor.
HIPAA and HITRUST readiness for healthcare and beyond
FAQ
HIPAA and HITRUST readiness questions, answered
Can’t find what you need? Talk to our security team.
The basics
Who needs a HIPAA risk analysis?
Covered entities such as healthcare providers and health plans, and business associates that handle ePHI on their behalf, are required by the HIPAA Security Rule to conduct an accurate and thorough risk analysis.
Can iSpyCyber certify us for HITRUST?
No. HITRUST certification is issued by HITRUST following a validated assessment performed by an authorised External Assessor. We deliver readiness assessments and remediation support that prepare you for that validation.
Is there an official HIPAA certification?
No. HHS does not recognise a HIPAA certification. Compliance is demonstrated through documented risk analysis, safeguards, policies and ongoing risk management, which our assessment helps you establish.
We are outside the US. Does this apply to us?
Yes, if you process ePHI for US covered entities as a business associate, for example as a health technology, billing or support provider. Many clients also align HIPAA work with the DPDP Act 2023 and GDPR.
Working with us
Which HITRUST assessment should we target?
It depends on customer expectations and your risk profile. We help you compare the e1, i1 and r2 assessments and recommend a target during scoping.
How long does a readiness assessment take?
Most readiness assessments take four to eight weeks, depending on the size of your environment, the number of systems holding ePHI and the target HITRUST assessment.
Do you help with remediation?
Yes. We support policy, procedure and technical remediation, review closure evidence and help organise evidence ahead of your validated assessment.
Get started
Protect Patient Data.
Prepare for HITRUST.
Talk to our specialists about a HIPAA and HITRUST readiness assessment scoped to your organisation.
- ISO/IEC 27001 and ISO 9001 certified
- 40+ enterprise and government clients
- 15+ countries