WHO SHOULD COMPLY?

Although HITRUST CSF is not federally mandated for any business, it is often required by organizations that handle Protected Health Information. Most hospitals and health plans have adopted the framework in some way, either as a best-practices resource or as the basis for their information protection program.

Companies that create, access, store, or exchange personal health and financial information are frequently required to be HITRUST CSF certified and compliant. Furthermore, companies that must be compliant with frameworks such as NIST, HIPAA, PCI DSS, and ISO 27001 should obtain the HITRUST CSF Certification as well.