We're proud to share that MindWise Health has earned HITRUST Essentials, 1-year (e1) Certification — an independently validated assessment of our security and privacy controls under the HITRUST CSF v11.8.0 framework. For the behavioral health practices, group homes, addiction recovery programs, and psychiatric organizations that entrust us with their patient data every day, this is a meaningful milestone. It is third-party confirmation that the controls protecting your information are designed, documented, and operating the way we say they are.
What HITRUST e1 actually is
HITRUST is a healthcare-focused security and privacy framework that consolidates requirements from HIPAA, NIST, ISO 27001, GDPR, and other regulatory and industry standards into a single, certifiable control set. The e1 — short for Essentials, 1-year — certification is HITRUST's foundational tier, focused on the security practices that defend against the threats responsible for the majority of real-world breaches: phishing, credential abuse, ransomware, and lateral movement once a foothold is gained.
For an organization to earn e1, every required control is reviewed by a HITRUST Authorized External Assessor, scored on a maturity scale, and then subjected to HITRUST's own quality assurance review. There is no self-attestation and no checkbox compliance. The bar is independent validation.
What's in scope
Our HITRUST e1 certification covers the MindWise Health platform hosted on Amazon Web Services in AWS's Virginia US region. That includes the EHR, scheduling, clinical documentation, telehealth, billing and RCM, e-prescribing, assessments, and reporting capabilities used by behavioral health providers across the country. The underlying infrastructure layer is itself HITRUST-, SOC 2-, and HIPAA-aligned; the certification we earned validates that everything we have built on top of it meets the same standard.
In-scope platforms: MindWise Health residing at Amazon Web Service (AWS).
In-scope facilities: Amazon Web Service (AWS) (Data Center) managed by Amazon Web Service.
Read the official press release for the full announcement.
Why it matters for your practice
A HITRUST certification on your EHR vendor is more than a logo. It reduces the work your practice has to do across several real-world scenarios:
- Vendor due diligence and renewals. Health systems, payers, and ACOs increasingly ask for HITRUST status as part of their third-party risk reviews. A certified vendor shortens that conversation from weeks to a single document.
- Payer and ACO contracts. Some value-based care contracts and managed Medicaid programs now require — or strongly prefer — HITRUST-certified clinical systems. Being on a certified platform means your practice can pursue those contracts without an infrastructure blocker.
- State licensing and audits. For group homes, ABA providers, and SUD treatment organizations, state surveys and audits often request evidence of the security posture protecting client records. The HITRUST validated assessment report is recognized evidence.
- Breach posture. The e1 control set is specifically tuned to the threats that drive the majority of healthcare breaches. Being certified does not make a breach impossible — nothing does — but it shifts the probability and severity in the right direction.
How we got here
HITRUST is one of the more rigorous certifications in healthcare technology, and the work behind it is not quick. Over the assessment period, our security and engineering teams documented and demonstrated controls across access management, encryption, vulnerability management, incident response, configuration hardening, third-party risk, and continuous monitoring. The External Assessor validated each control's maturity, and HITRUST's quality assurance team reviewed the results before issuing certification.
Behind the formal language is a more mundane truth: a HITRUST-ready posture is the result of doing the unglamorous work consistently — patching systems on a published cadence, rotating keys, reviewing access quarterly, running tabletop exercises, monitoring for anomalies, and being honest about gaps when you find them. The certification does not replace that work. It validates that the work is being done.
What's next
The e1 certification is valid for one year. We have committed to ongoing monitoring of the assessed controls and to re-validating annually. Over time, we plan to expand the scope of our HITRUST program to align with the more demanding tiers (i1 and r2) as our customer base grows into health systems and payer organizations that require those levels.
In the meantime, we are making the cert letter available to current and prospective customers under NDA, alongside our SOC 2 and HIPAA documentation, for any due diligence reviews that need it.
Get the cert letter
If your practice is in the middle of a payer due diligence cycle, a state survey, or your own annual security review and you need a copy of our HITRUST e1 certification letter, please reach out. Our customer success team can have it in your hands the same day.