Strengthening Our Security Canopy: Health Gorilla Earns HITRUST r2 Recertification

Well, we did it again. Health Gorilla reaffirmed our commitment to the highest standards of security, privacy, and compliance in health data exchange by earning our HITRUST Risk-Based Recertification (r2) this month.

But while HITRUST may feel like a baseline expectation for today’s healthcare technology landscape, achieving this level of certification and recertifying it is no small milestone. In the interoperability jungle, it’s a major win .

This recertification reflects more than the successful completion of a rigorous audit. It represents six months of intensive preparation, cross-functional coordination, and meticulous documentation across Governance, Engineering, Operations, and Security teams. HITRUST’s r2 requirements evolve every year to reflect new threats, emerging safeguards, and updated industry expectations. Staying aligned with those standards requires discipline, operational maturity, and an unwavering commitment to doing things the right way.

Why HITRUST Matters for Interoperability

Healthcare interoperability only works when every participant in the ecosystem trusts the data, the infrastructure, and the organizations handling it. As a national interoperability provider powering data exchange for health systems, payers, digital health innovators, and now federal-aligned initiatives, Health Gorilla sits at the center of this trust fabric.

HITRUST is more than a checkbox. It is the most widely adopted and prescriptive security framework in healthcare, mapping controls across HIPAA, NIST, ISO, CMS requirements, and many other regulatory and risk management standards. Achieving r2 status demonstrates that Health Gorilla has implemented and continuously upholds the highest level of validated security controls available in the HITRUST framework.

This matters because:

● Sensitive health data is one of the most targeted assets in cybersecurity.

● Interoperability networks increase the number of exchange points and therefore the attack surface.

● Providers, payers, and innovators need absolute confidence that the exchange infrastructure they rely on is secure, compliant, and well-governed.

5 December

● Federal initiatives like TEFCA and CMS-Aligned Networks expect rigorous, independently validated security programs.

Our HITRUST r2 recertification signals to every organization we serve that Health Gorilla meets and exceeds these expectations.

Security Is Not a Layer, It Is the Core of Our Platform

From national clinical exchange to patient-authorized retrieval to FHIR-based APIs and lab ordering, security touches every product we build and every process we operate. Maintaining HITRUST r2 recertification ensures:

● Continuous risk management and monitoring

● Stronger safeguards for identity, access, and authentication

● Robust controls across infrastructure, code, and operational processes

● Alignment with rapidly evolving cybersecurity and regulatory requirements

In other words, it ensures we stay worthy of the trust our clients and partners place in us every single day.

A Recertification That Reinforces a Bigger Vision

At a time when the healthcare industry is moving toward more connected, real-time, AI-ready data systems, security is not optional. It is the foundation required for innovation. Interoperability will only scale if it is built on a structure strong enough to withstand modern cybersecurity threats and rigorous enough to satisfy regulatory expectations.

Our HITRUST r2 recertification is a validation of that foundation.

To our clients, partners, and the broader community: thank you for trusting us with your data. We will continue investing in the highest standards of security and governance as we expand the nation’s interoperability infrastructure.

‍