Press Release
Last Updated on January 17, 2024
A colleague asked me about my opinion on the differences between HITRUST Certification and ISO 27001 Certification. More specifically, he asked three very important questions. I decided to share my thoughts and reply on the blog because I believe it will provide a lot of value readers.
1) ISO Certification focuses on the Information Security Management System. What would you say the focus of HITRUST is?
ISO does indeed focus on the ISMS… more specifically a risk assessment/management focused ISMS leveraging the 27002 control set to mitigate the risks to an acceptable level. I would argue that HITRUST is focused on providing a prescriptive set of controls that are cross mapped and referenced to standards and regulations relevant to healthcare to simplify the process of becoming largely compliant with relevant laws and regulations and mitigating most risks that a typical hospital has to an acceptable level. An over-simplified view is that HITRUST is a set of predefined controls for an assumed set of risks and compliance requirements – with an IT-GRC like mapping. It’s a pre-customized CSF in a box.
2) If a company became ISO certified, what is the remaining effort to become HITRUST certified?
If an organization was ISO-27001 certified and scoped the certificate to the same information & processes that HITRUST covered – I think the organization would need to extend a small amount of additional effort. HITRUST simplifies this process by cross-mapping the 27002 controls to HITRUST. Although HITRUST “assumes” a set of risks it also includes a Statement of Applicability (like 27001) – so I think there would be little chance that the 27001 driven ISMS would not fully match the HITRUST defined ISMS.
3) If a company became HITRUST certified, what is the remaining effort to become ISO 27001 certified?
If an organization was HITRUST certified using levels of HITRUST applicability equivalent to what the ISO 27001 applicability would be – I think the organization would need to extend a small amount of additional effort.
Which To Do First?
So, the obvious question is if I’m going to do both – which should I do first? As the primary driver for both 27001 and HITRUST are often attestation – I think the most important question is – which form is more important right now? Assuming neither has a greater sense of urgency – I think ISO-27001 has the advantage of broader acceptance and better addresses potential risks non-specific to HITRUST. It would likely take a little longer on the front end – but adding HITRUST would probably be faster on the back-end. I think HITRUST has the advantage of being a bit “simpler” as the risks and risk treatments are largely defined. It would be a little faster on the front end – but adding ISO-27001 on the back end would probably be slower as some of the artifacts (e.g., the Risk assessment) may not have been fully developed for HITRUST.
More About ISO 27001 & HITRUST Certification
About a year ago I blogged about HITRUST in an article called HITRUST vs. ISO-27001 (or is it?), and I think the three points say the same thing in a slightly different way.
Visit our HITRUST page to learn more, or to find out how we can help your company with certification, contact us.
