HITRUST r2 Certification Readiness for a Pharmacy Benefit Administrator
r2 certified on the first validated assessment, keeping three health-plan contracts that required it.
Client name withheld by agreement- Client
- Pharmacy benefit administrator
- Region
- Nashville, Tennessee
- Year
- 2023
- Duration
- 30 weeks
- Scope
- 19 domains · 38M claims a year · 2 data centers
- Practice
- AI, Cloud & Digital Trust
The challenge
What was at stake.
A pharmacy benefit administrator adjudicates 38 million claims a year for regional health plans and self-insured employers. Three of its largest health-plan clients made HITRUST r2 certification a contract requirement with a fixed renewal date.
The company had a strong security team but inconsistent documentation, two data centers built at different times, and claims processing that could not slow down during remediation.
What we did
The approach, step by step.
- 01
Scope set to the claims platform
We defined the assessment scope around claims adjudication, member data and pharmacy network systems, and set risk factors that matched the real environment.
- 02
Maturity scored requirement by requirement
Every requirement statement was scored for policy, procedure and implementation, giving the team a clear list of what to fix and in what order.
- 03
Data centers brought to one standard
Logging, encryption, configuration management and vulnerability remediation were aligned across both sites.
- 04
Vendor oversight formalized
Pharmacy network partners and claims clearinghouses were brought into a documented third-party risk process with contract terms to match.
- 05
Assessor-ready evidence
Evidence was organized by requirement so the HITRUST external assessor could test efficiently and quality assurance moved without rework.
Outcomes
What changed, in numbers.
- 1st
- validated assessment led to r2 certification
- 19
- domains scored at implemented or above
- 3
- health-plan contracts retained
- 0
- interruptions to claims processing
We met the deadline our biggest clients set, and the certification has opened conversations with plans we could not reach before.
Services delivered
Related engagements
More work in AI, Cloud & Digital Trust.
-
Denver, Colorado · 15 weeks
AI, Cloud & Digital Trust · 2025SOC 2 Type II for a Legal E-Discovery PlatformAn unqualified Type II report covering Security and Confidentiality, delivered before the Am Law 100 renewal cycle.
-
Seattle, Washington · 22 weeks
AI, Cloud & Digital Trust · 2026 · OngoingISO/IEC 42001 and Adversarial Testing for a Contact-Center AI ProviderVoice agents that can no longer be talked into reading back card numbers, and an AI management system heading for certification.
-
Houston, Texas · 24 weeks
AI, Cloud & Digital Trust · 2024Cloud Security Platform for a Genomics LaboratoryPetabytes of patient genomes locked behind one set of guardrails, with no slowdown in sequencing turnaround.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.