HITRUST i1 Certification for a Behavioral Telehealth Network
i1 certified on the first validated assessment, inside the deadline set by its two largest payer contracts.
Client name withheld by agreement- Client
- Behavioral telehealth provider, 1,900 clinicians
- Region
- Raleigh, North Carolina
- Year
- 2023
- Duration
- 20 weeks
- Scope
- 182 requirements · video visits, e-prescribing and EHR · 42 CFR Part 2 records
- Practice
- AI, Cloud & Digital Trust
The challenge
What was at stake.
A behavioral telehealth provider delivers therapy and psychiatry by video through 1,900 licensed clinicians, most of them working from home. Its two largest payer partners added HITRUST certification to their network agreements with a twelve-month deadline.
Its records include substance use treatment data protected under 42 CFR Part 2, with stricter consent rules than HIPAA. Clinicians used their own devices, and the security team was two people.
What we did
The approach, step by step.
- 01
Assessment chosen to fit the risk
We recommended the i1 assessment, which met both payers’ requirements, and scoped it around the video platform, EHR and e-prescribing systems.
- 02
Clinician devices brought under management
Device management enrollment and a minimum standard for every clinician laptop and phone made encryption, screen lock and remote wipe enforceable.
- 03
Part 2 consent built into the record
Consent capture and redisclosure controls for substance use records were configured in the EHR, with audit trails the compliance team reviews monthly.
- 04
Policies and evidence by requirement
Policies were rewritten for a remote clinical workforce, and evidence was organized by requirement so the HITRUST external assessor could test without rework.
Outcomes
What changed, in numbers.
- 182
- requirements assessed
- 1st
- validated assessment led to certification
- 1,900
- clinician devices under management
- 2
- payer agreements kept on schedule
We are a clinical organization with a small security team. They gave us a path we could actually walk.
Services delivered
Related engagements
More work in AI, Cloud & Digital Trust.
-
Boston, Massachusetts · 16 weeks
AI, Cloud & Digital Trust · 2024SOC 2 Type II with Evidence Built into ServiceNow Change RecordsAn unqualified Type II report with zero exceptions, and change-management evidence that now collects itself.
-
New York, New York · 20 weeks
AI, Cloud & Digital Trust · 2026 · OngoingISO/IEC 42001 and Adversarial Testing for a Commercial Underwriting AI PlatformDoctored broker submissions no longer steer risk rankings, and an AI management system is on track for its certification audit.
-
Pittsburgh, Pennsylvania · 22 weeks
AI, Cloud & Digital Trust · 2025Multi-Cloud Security Guardrails for a Regional Health SystemClinical imaging and analytics in two clouds under one set of guardrails, with no change to how radiologists read studies.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.