The gold standard for healthcare security
When a partner won't accept anything less than the highest level of assurance, HITRUST is what they're asking for. It's the most rigorous certification in healthcare security — and the most demanding to earn. We scope it, build the controls, and stand with you through the assessment.
What HITRUST actually is
HITRUST is a certifiable security framework built for organizations that handle healthcare data. Where HIPAA tells you what the law requires, HITRUST gives you a detailed, prescriptive set of controls to prove you're meeting it.
The HITRUST CSF
The Common Security Framework pulls together HIPAA, ISO, NIST, and other standards into one control set. That's part of why partners trust it.
e1, i1, and r2
e1 is the entry-level assessment, focused on foundational cybersecurity. i1 covers a broader set of controls. r2 is the most rigorous, risk-based assessment, and the highest level of assurance.
How it relates to HIPAA
HIPAA is the federal law you must follow. HITRUST is a certification that proves how well you follow it — and then some. Many organizations pursue it because a partner wants harder proof than a HIPAA program alone.
Who needs HITRUST
HITRUST usually enters the picture when a partner demands it. You likely need it if you're:
- A healthcare organization or business associate whose partners require HITRUST
- Under contractual pressure to show a higher level of assurance than a policy binder
- Already running HIPAA and ready for a certifiable control set on top of it
How we guide you through it
HITRUST is demanding, which is exactly why you don't want to attempt it alone. We guide the whole path.
01
Scoping
We help you land on the right assessment type — e1, i1, or r2 — so you're not over- or under-shooting what your partners actually need.
02
Readiness
We measure you against the CSF and show you the gaps before the assessor ever does.
03
Control implementation
We build and implement the controls to close those gaps.
04
Assessment support
We coordinate with the assessor and stand with you through the assessment.
What you get
A typical HITRUST engagement includes:
Readiness assessment
Where you stand against the CSF, before an assessor arrives.
Control build
Implementation of what the framework actually requires.
Evidence collection
Organized in your Book of Evidence.
Assessor coordination
We manage the relationship so you aren't doing it alone.
Training
So the controls survive after the assessment.
This much rigor takes real expertise
HITRUST is not a framework you automate your way through. The r2 assessment in particular demands judgment, interpretation, and controls that genuinely work — the kind of thing a dashboard can't fake.
Teams certified with us
Benjamin Pure
VP Client Solutions, Patient Connect
“Before VanRein, audits were a constant source of stress. Since putting their recommendations in place and building out our Book of Evidence, onboarding new clients is simple — we just submit and move forward. VanRein lets my team focus on delivering excellent service instead of worrying about HIPAA compliance.”
Lori Horton
President, A Professional Image
“We are so thankful to have partnered up with VanRein. Anyone needing help with HIPAA compliance should connect with them. I only wished we would have found them before our first audit.”
Jill L.
CEO, eLivelihood
“The team at VanRein is fantastic. They have been our compliance partner for 2 years and we've been very impressed. They've been on top of our compliance and ongoing training, extremely responsive to any questions we've had, and made our experience a positive one.”
Kim H.
Carolyn's Communication
“There is no shortage of excellence from VanRein Compliance, Rob and Dawn Van Buskirk, when it comes to their clientele. We relied heavily on them to ensure compliance across our company.”
Nathan C.
Northsite Data
“My business partner and I came to Rob needing help to become HIPAA compliant. Rob and his team are absolute professionals. They know how to audit, identify areas that need improvement, and set up processes to get us further down the path each year.”
Michelle Mata
“A huge thank you to VanRein for making HIPAA compliance smooth and stress-free! Their professionalism and guidance have been outstanding every step of the way. Truly the best partner we could ask for! Rob is the best for helping us get everything in order and keep us up to date on HIPAA compliance.”
Andrew Charles
AMBS Call Center
“The Ambs Call Center team loves working with VanRein Compliance for our HIPAA compliance certification!”
Aidan Brooks
“Working with VanRein Compliance has been instrumental in helping us move forward with confidence. Their support gave us the structure and clarity we needed to take meaningful steps toward protecting patient information.”
Brianna Burke
Nationwide Inbound
“We've had an exceptional experience partnering with VanRein Compliance for our data security and HIPAA compliance needs at Nationwide Inbound. Their proactive approach, tailored solutions, and unwavering support have provided us with invaluable peace of mind. Rob, Dawn and team's expertise and dedication shine through in every interaction, making them an indispensable asset to our organization. We wholeheartedly recommend VanRein Compliance to any business in need of a top-tier partner to help navigate the ever-evolving arena of data security regulations. Thank you, VanRein Compliance, for your outstanding service and commitment to our data security!”
Julia Szwed
“The entire team at VanRein Compliance is exceptional. They are well organized, professional and have superb customer service. During our annual reviews they help us to ensure that we are running our business with safeguards in place to protect us and our clients. I would give VanRein 10 stars for their work as the value is immeasurable. Grateful!”
Shari Brown
“We have worked with Rob and Dawn at VanRein Compliance for several years. We have a medical practice and they have been invaluable to us in navigating the requirements of our profession! They are quick to respond to any questions or concerns and make it simple to understand and implement processes and procedures to keep us compliant with regulations. Well worth it to partner with this company!”
Prisca Gloor
“We are very impressed with VanRein Compliance. They are very knowledgable, they explain the process so it is understandable, they are there for us at any step, and the people are really nice. Out of the companies we checked to go through this process, VanRein Compliance was the best and they have exceeded our expectations. We are so happy we went with them and we highly recommend them.”
Trusted By
HITRUST questions we hear a lot
See more QuestionsDo we have to start at r2?
No. e1, i1, and r2 are different depths. We scope the assessment to what your partners actually require, instead of overshooting on day one.
Does HITRUST replace HIPAA?
No. HIPAA is the law. HITRUST is a certification that proves how you meet it, and more. Most teams already have a HIPAA program before they take this on.
Can a platform get us through r2?
The r2 assessment needs judgment and controls that work in practice. We guide scoping, readiness, implementation, and the assessor relationship.
Let's talk about where you stand
Whether you're starting from scratch or shoring up a program you already have, the first step is a straight conversation about your organization and your risk.