It is possible to test only privacy-related requirements to obtain a HITRUST privacy certification.

HITRUST does not issue certifications limited solely toprivacy-related requirements. While privacy is a critical part of the CSF—reflected in domains such asData Protection & Privacy—HITRUST certifications require coverage ofall 19 domains. This is because security and privacy are interdependent: without robust security, privacy cannot be protected. An entity may emphasize privacy controls during scoping and reporting, but certification itself is always tied to a full CSF assessment. Privacy-related frameworks, such as GDPR or HIPAA Privacy Rule, can be added as regulatory factors, which introduce additional privacy-focused requirements. However, the output will still be a standard HITRUST validated report or certification covering the entire environment, not a “privacy-only certification.”