Q: If a vendor says they have undergone a HITRUST audit, is that the same thing as being certified?
A: Not necessarily. HITRUST isn't an audit. It's an assessment.
In a certification, audits are usually more about an opinion on compliance, while an assessment defines the current state versus the ideal state and identifies weaknesses and gaps. So I suppose one could go through a HITRUST-based audit without the full assessment and certification. But to become HITRUST certified, the assessment process must go through an approved external assessor and then go through a HITRUST audit themselves.
