Mental health is personal and private. People who take the brave and important step of seeking mental health support must feel safe. They need to be able to share sensitive information and know that it will remain private.

Learn to Live is committed to protecting the confidentiality, privacy, integrity, and availability of all electronic protected health information (PHI) that we receive, maintain, and process on behalf of our users. We have valued these principles since the company’s inception, and always strived to build and maintain the highest standards regarding our products and services. We proactively pursued HITRUST Certification of our technical infrastructure, processes, and procedures in 2021, and just completed our 2-year re-certification in August , 2023. We also completed a SOC 2 Type 1 re-attestation.

What is HITRUST Certification?

HITRUST certification is the gold standard for security and privacy in the healthcare industry. It is an information protection standards organization and certifying body that enables organizations to demonstrate that they are taking the most proactive approach to cybersecurity, data protection, and risk mitigation. Thousands of companies across industries safeguard their sensitive information using the HITRUST framework, assurance program, and assessment tools. HITRUST also helps organizations manage and mitigate cybersecurity threats, address and comply with applicable regulations, and be proactive with risk management.

HITRUST Certification indicates an organization is serious about data protection, privacy, and security – all crucial things for building trust with users in the healthcare sector. It demonstrates rigorous compliance with healthcare regulations and reassures users that the company meets high standards in protecting sensitive data.

The Value of HITRUST Certification

The extensive HITRUST Certification process examines the comprehensive policies, procedures, controls, and safeguards an organization has implemented to protect sensitive data such as PHI. The rigorous assessment and testing process helps organizations identify and remediate any gaps in their information security defenses.

Once certified, organizations can assure their customers, partners, and stakeholders that they meet the highest industry standards when it comes to managing risk, ensuring compliance with regulations, and safeguarding sensitive data. HITRUST Certification signifies an organization’s commitment to information security best practices and responsible stewardship of confidential data.

In addition, the HITRUST CSF framework incorporates global regulations and standards including HIPAA, NIST, ISO, COBIT, and dozens more. This greatly simplifies compliance efforts for organizations by supporting “Assess Once, Report Many” capabilities. By taking a risk-based approach, a HITRUST r2 Certification provides prescriptive requirements tailored to an organization’s unique risk environment.

HITRUST Certification delivers robust validation of information security practices, risk analysis, regulatory compliance, and privacy safeguards. The certification journey results in more resilient data protection and highly reliable cybersecurity defenses.

Why It Matters for Mental Health Technology Companies

As mental health apps and digital platforms revolutionize care delivery, upholding security standards is imperative. HITRUST Certification enables mental health technology companies to demonstrate their commitment to safeguarding user data. There are several key reasons HITRUST Certification matters:

• Compliance. HITRUST incorporates global compliance regulations like HIPAA, allowing companies to take a coordinated approach to managing regulatory requirements.
• Trust. Certification provides assurance to users that their sensitive mental health data is secure, building engagement and confidence.
• Partnerships. Meeting HITRUST standards facilitates business relationships, as partners can trust HITRUST-certified organizations.
• Best Practices. HITRUST promotes comprehensive and consistent information security practices.
• Risk Management. Companies benefit from HITRUST’s holistic risk analysis, control selection, and mitigation approach.

Furthermore, the increase in third-party data breaches suggests that cyber criminals are shifting tactics to target vendors, rather than healthcare companies. This tactical evolution urges caution for healthcare organizations when selecting business associates. Many covered entities request that their business partners also become HITRUST Certified.

HITRUST drives technology organizations to continually evolve their privacy and security programs with rigorous certification requirements and thorough assessments, setting the highest bar possible for healthcare data protection.

What is a SOC 2 Attestation?

System and Organizational Controls (SOC) is a framework for providing regular, independent attestation of the controls that a company has implemented to mitigate information-related risk. In a SOC 2 audit, an organization describes the policies, procedures, and systems in place to protect information across five categories called Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. An independent auditor evaluates the evidence supplied about the controls in each category and when completed, companies receive an official SOC 2 report that can be shared with customers and business partners to assure them that their data will be handled securely.

Why Pursue Both HITRUST and SOC 2?

There are a few key reasons why Learn to Live, as a software as a service (SaaS) organization, pursues both HITRUST and SOC 2 certifications:

• Broad coverage. HITRUST shows that we adhere to healthcare data protection standards, and SOC 2 shows broader security compliance for companies that store customer information, across all industries. These include:
  • SaaS organizations.
  • Companies that deal with business intelligence or analytics.
  • Financial service institutions.
  • Any other organization that stores customer data in the cloud.
• Comprehensive. The HITRUST CSF is a control framework, and the SOC 2 is a reporting framework. Using the HITRUST CSF, the HITRUST r2 is a risk-based, validated assessment and certification that can be tailored to cover specific risk factors. The SOC 2 is less prescriptive and does not provide a certification.
• Customer requirements. Some health care customers may require HITRUST while other customers want SOC 2. Pursuing both certifications allows us to meet a wider range of customer and prospect security requirements.
• Market reputation. Having both HITRUST and SOC 2 certifications conveys to the market that our SaaS company takes every aspect of security and compliance seriously and follows best practices.

The HITRUST Certification and SOC 2 attestation processes provide a strong third-party validation that Learn to Live meets the security controls that our customers expect. They provide assurances across multiple dimensions and demonstrate commitment to security best practices.