HITRUST offers three levels of validated assessment: e1 (essential cybersecurity hygiene), i1 (leading security practices), and r2 (risk-based, comprehensive assurance). The r2 is the most rigorous of the three. Its control requirements are tailored to an organization’s specific risk factors and regulatory obligations, drawing on HIPAA, NIST, ISO, and other frameworks harmonized in the HITRUST CSF.
An r2 assessment is not a self-attestation. Controls are tested by an independent, HITRUST-authorized external assessor, and every assessment then goes through HITRUST’s own centralized quality review before certification is granted. An r2 Certification is valid for two years, with an interim assessment in between, so the work does not stop at the certificate.
Customer communications sit at the intersection of sensitive data and regulatory scrutiny. For insurers, health plans, financial institutions, and government agencies, a CCM platform touches protected health information, personally identifiable information, and financial data at scale. That makes the CCM vendor a critical part of third-party risk management.
HITRUST r2 Certification gives your security, compliance, and procurement teams an independently validated, widely recognized benchmark to use in vendor reviews. In practice, that can mean fewer open questions, a faster path through security review, and more confidence in the controls protecting your customers’ data.
We believe in being precise about certifications. This HITRUST r2 Certification covers Elixir Cloud as hosted on Amazon Web Services (AWS) in regions across the United States, Canada, Europe, Asia Pacific, and the Middle East, including data centers in Virginia, Ohio, California, Oregon, Quebec, London, Frankfurt, Sydney, and Abu Dhabi. If you have questions about how it applies to your deployment or to other Elixir products, your account team can walk you through it.
Security is not a one-time project. Elixir Cloud has run on a cloud-native architecture since 2010, and earning HITRUST r2 reflects the work our teams have put into building and operating controls that meet a demanding standard, and we will continue to maintain and test those controls through the interim and recertification cycle.
Customers and prospects can request a copy of our HITRUST certification letter and related security documentation in the Elixir Trust Center at https://trust.elixir-security.com/ (login required) or by emailing security@elixir.com.
About the Author:
Hart Johnson is the Executive Managing Director of DevSecOps at Elixir Technologies, a visionary leader at the forefront of integrating development, operations, and security. With an MS in Cyber Security and Information Assurance (MSCSIA) and certifications as a Certified Ethical Hacker (CEH) and Computer Hacking Forensic Investigator (CHFI), Hart brings a wealth of expertise to his role. His extensive experience in both DevOps and Security and Compliance departments drives innovation and enhances infrastructure with a strategic focus in the SaaS industry. Hart’s background in teaching and his collaborative approach contribute to a culture of continuous improvement and shared success within Elixir Technologies.