HITRUST
Readiness
HITRUST is the framework healthcare buyers ask for when HIPAA alone is not enough, and it is certifiable - which makes it prescriptive about evidence in a way HIPAA is not. We run readiness so the assessment you commit to is the one you can pass.
Who this is for
Readiness earns its cost when something is waiting on the other side of it. These are the situations where it pays for itself.
Healthcare organisations and their vendors whose customers require HITRUST certification
Digital health companies whose health system buyers will not accept SOC 2 alone
Teams choosing between the e1, i1 and r2 assessment types and unsure which is right
Organisations who hold HIPAA documentation and need it turned into something certifiable
What the engagement does
Your Lorikeet team runs the assessment, collects and vets the evidence, and keeps control status current. You are not handed a spreadsheet and wished well.
- Determine which assessment type fits - e1, i1, or r2 - before the effort is committed in the wrong direction
- Scope the assessment and define the systems and facilities in it
- Assess the control domains in scope and record where you stand
- Build evidence against the maturity levels HITRUST scores, which is what catches people out
- Close the gap list with your team
- Prepare for and support the validated assessment with your external assessor
What you walk away with
The right assessment type chosen deliberately, a scoped environment, and evidence that satisfies HITRUST scoring rather than merely existing. HITRUST scores maturity, not presence - a control that exists but is not measured or managed does not score, and readiness is where that gets fixed.
How it runs
Four phases. You always know which one you are in and what is outstanding.
Scoping call
We establish what is in scope, which assessment path applies, and what you already have. It costs nothing, and it ends with a straight answer about whether readiness is the right spend right now.
Assessment
We walk the control set and record where you actually stand, control by control. The gap list lands early so your team can start on the long items while the rest of the assessment continues.
Remediate and evidence
We work the gap list down with your team and collect what each control needs, filed against the control it belongs to with an owner and an expiry date rather than dumped in a folder.
Hand off to your assessor
You go in with a package that maps requirement to control to evidence, and we stay available through the assessment itself.
What the assessment covers
The control areas we walk for HITRUST. Each breaks down into individual controls carrying status, owner and evidence in Talon.
Validated assessments are performed by a HITRUST authorised external assessor and certified by HITRUST. We prepare you and work alongside your assessor.
It runs in Talon, not in a spreadsheet
Every control, its status, its owner and its evidence sit in the portal your team already uses, so the readiness picture you see is the one your Lorikeet team is maintaining rather than a copy that went stale a fortnight ago.
- Control-by-control status, kept current by the people doing the work
- Evidence filed against the control it satisfies, with expiry dates tracked
- The auditor request list, so nothing is chased over email
- A readiness view that shows what an assessor would see
Tools like Vanta monitor controls continuously once they exist and work. Readiness is the part before that: deciding the boundary, designing the controls, and closing the gaps a monitoring tool would otherwise report as permanently red. We work alongside them, and we are a Vanta MSP partner.
Our partnersAsked on almost every HITRUST call
e1 is a foundational assessment with the smallest requirement set. i1 is a substantial moderate-assurance assessment. r2 is risk-based, tailored to your environment, and the heaviest. Customer requirements usually dictate it; where they do not, the honest answer is often lower than expected.
Because it is scored. HIPAA asks whether you have safeguards; HITRUST scores how mature each one is across policy, procedure, implementation and measurement. Controls that pass a HIPAA review routinely score poorly on first HITRUST assessment.
A good deal of it, particularly access control, logging, incident management and vendor oversight. The gap is usually in the maturity evidence rather than the control itself.
It depends on the assessment type, with interim requirements for the longer-lived certifications. We build the programme so the interim obligations are routine rather than a second project.
Rarely run alone
Controls overlap heavily between frameworks, and evidence collected once counts everywhere it applies. A second framework costs a fraction of the first.
HITRUST readiness, on your timeline
A scoping call costs nothing and ends with a straight answer: what the work involves, what it costs, and whether you need it yet.
