HITRUST · ISO 27001

In one line

ISO 27001 certifies that you run a management system for information security. HITRUST certifies against a health-oriented control framework that maps several regulations onto one set of controls. Both are real. Neither means you are secure.

What ISO 27001 actually certifies

This is the most misread certification in the industry, so be precise: ISO 27001 certifies the management system, not the security.

It attests that you have identified your assets, assessed risks, selected controls, documented decisions, assigned owners, and that you review it on a cycle. An auditor checks that the process exists and runs.

Which means — and this genuinely surprises people — you can be ISO 27001 certified with a known vulnerability, provided you identified it, assessed the risk, documented a decision to accept it, and someone with authority signed. The standard doesn't require you to be safe. It requires you to be deliberate.

That's less cynical than it sounds. Most breaches don't come from accepted risks; they come from risks nobody was looking at. A system that forces you to look has real value. Just don't read the certificate as a statement about your defences.

HITRUST, and the problem it solves

The health-specific pain: a US hospital vendor must satisfy HIPAA, and their customers ask about NIST, and their EU work touches GDPR, and a payer wants SOC 2. Each has overlapping controls, different vocabulary, and separate audits.

HITRUST CSF normalises them: one control framework mapped to many authorities, so you implement once and demonstrate against several. It is prescriptive where ISO is process-oriented — it tells you what the control should look like, scaled to your risk factors.

Its real currency is commercial. In US healthcare, HITRUST certification is frequently what gets a vendor through procurement — not because it proves safety, but because it lets a hospital's risk team stop asking questions. It is expensive, and that expense is a moat: it prices out small vendors, which is worth naming as a market effect rather than a security one.

What none of them cover

The gap that matters:

• A certificate is a point in time. Audited in March, breached in June, and both facts are compatible. Configuration drifts; the certificate doesn't.
• Scope is chosen by you. "ISO 27001 certified" for which systems? A narrow scope certifies the easy part. Always read the scope statement — that's where the honesty lives.
• Compliance ≠ security. Every large breached organisation was compliant with something on the morning of the breach.
• They say nothing about clinical safety. A perfectly secure system can still kill someone with a bad alert. These frameworks protect confidentiality; they have almost nothing to say about whether the data is right.

The honest use

Treat certification as a floor and a forcing function, not an achievement:

• It forces asset inventory, which most organisations genuinely lack.
• It creates named owners for risks that were previously everyone's and nobody's.
• It gives security a budget line and a boardroom hearing.
• It answers procurement so your engineers can stop filling in spreadsheets.

And pair it with something that tests reality rather than paperwork: threat modelling before you build, penetration testing after, and audit logs that someone actually reads.

A certificate proves someone checked. It does not prove they were right.