HITRUST

Learn about achieving HITRUST compliance on Aptible

Compliance Fast-Track

Overview

Aptible’s story began with a focus on serving digital health companies. As a result, the Aptible platform was designed with high compliance in mind. It automates and enforces all the necessary infrastructure security and compliance controls, ensuring the safe storage and processing of PHI and more.

Achieving HITRUST on Aptible

1. Provision a Dedicated Stack to run your resources

   Dedicated Stacks are available on Production and Enterprise plans.

   Dedicated Stacks live on isolated infrastructure and are designed to support deploying resources with higher requirements— such as HIPAA and HITRUST. Aptible automates and enforces majority of the necessary infrastructure security and compliance controls for HITRUST compliance. When you request your first dedicated stack, an Aptible team member will also reach out to coordinate the execution of a HIPAA Business Associate Agreement (BAA).

2. Review the Security & Compliance Dashboard and implement HITRUST required controls

   

   The Security & Compliance Dashboard serves as a great resource for showing off compliance. When a Dedicated Stack is provisioned, most HITRUST controls will show as complete by default, the remaining controls will show as needing attention.

   Understanding the HITRUST Readiness Score

   The HITRUST Common Security Framework (CSF) Certification is a compliance framework based on ISO/IEC 27001. It integrates HIPAA, HITECH, and a variety of other state, local, and industry frameworks and best practices. Independent assessors award this certification when they find that an organization has achieved certain maturity levels in implementing the required HITRUST CSF controls.

   HITRUST CSF is unique because it allows customers to inherit security controls from the infrastructure they host their resources on if the infrastructure provider is also HITRUST CSF certified, enabling you to save time and resources when you begin your certification process. Aptible is HITRUST certified, meaning you can fully inherit up to 30% of security controls implemented and managed by Aptible and partially inherit up to 50% of security controls.

   The Aptible Security & Compliance Dashboard provides a HITRUST readiness score based on controls required for meeting the standards of HITRUST CSF regulation. The HITRUST score tells you what percentage of infrastructure controls you have successfully implemented to meet relevant HITRUST guidelines.

3. Request HITRUST Inhertiance from Aptible

   Aptible is HITRUST CSF Certified. If you are pursuing your own HITRUST CSF Certification, you may request that Aptible assessment scores be incorporated into your own assessment. This process is referred to as HITRUST Inheritance.

   While it varies per customer, approximately 30%-40% of controls can be fully inherited, and about 20%-30% of controls can be partially inherited.

   How to request HITRUST Inhertiance from Aptible
4. Show off your compliance

   Use the Security & Compliance Dashboard to prove your compliance and show off with a Secured by Aptible badge

   

Related Resources

• HITRUST Shared Responsibility Matrix - To see Aptible’s shared responsibility matrix
• Aptible’s Trust Center - To see Aptible’s HITRUST certification, reports, and assessment