What HITRUST Controls Can a Health System Inherit From Microsoft?

A common place for the question to surface is the assessment scoping meeting, when someone points out that Microsoft holds a HITRUST certification and proposes treating everything in the cloud as inherited. That is half right. Microsoft’s certification can carry part of the assessment, through a request that Microsoft approves, for the services its certification letter names. It does not reach the tenant settings, the identities or the data, and it does not reach a Microsoft service outside its scope. This page is for the IT leader who has to decide what to request from Microsoft, what the team configures and evidences itself, and what the assessment type allows, before fieldwork starts. Every HITRUST and Microsoft page cited on this page was read on October 19, 2026.

What Inheritance Is, in HITRUST’s Words

When a scoping plan treats inheritance as an exemption from the assessment, it gets the mechanism backwards: an inherited result is carried into the assessment and scored there. HITRUST’s Shared Responsibility and Inheritance Program page says the program “allows organizations to reuse inheritable controls from internal and external third-party organizations.” and “Controls can be inherited from vendors, major cloud service providers (CSPs) and your organization’s existing HITRUST Validated or Certified Assessments.” HITRUST’s Cybersecurity Compliance Certifications and Assessments page says “Organizations working to attain certification can also inherit existing controls from their certified cloud service providers.”

HITRUST’s January 19, 2022 blog post on shared responsibility and inheritance in the cloud describes two MyCSF mechanisms. External inheritance “Enables organizations to inherit assessment results and scores from their hosting, cloud, and service providers’ assessment(s).” Internal inheritance “Enables organizations to inherit assessment results and scores from one of their assessments and apply them to another of their assessments.”

Responsibility is split requirement by requirement, and that is the unit of inheritance. HITRUST’s press release of January 7, 2021 said “the HITRUST Shared Responsibility Matrix documents which HITRUST CSF controls are full, partial, or shared responsibility between cloud service providers and their customers.” HITRUST’s Inheritance Calculator page says “MyCSF should always be viewed as the source of truth for scoring calculations.”

The planning rule i3solutions recommends: treat inheritance as a scored result carried into your assessment, not as an exemption from it, and read the scores in MyCSF rather than in any estimate made outside it.

Which Microsoft Services Are in Scope, and Where the Scope Stops

When a scoping plan lists Microsoft 365 as inherited, a common over-claim is that Microsoft 365 as a whole is HITRUST certified. Microsoft does not say that. Microsoft’s Azure compliance page HITRUST, last updated April 5, 2023, says “The Azure HITRUST certification letter covers Azure, Dynamics 365, Power Platform, and select Microsoft 365 cloud services.” and lists its applicability as Azure and Azure Government.

Microsoft’s Health Information Trust Alliance (HITRUST) Common Security Framework (CSF) page, last updated December 4, 2025, lists its in-scope cloud platforms and services as Azure and Azure Government, Microsoft Intune, Microsoft Managed Desktop, Office 365, and Windows 365 (Commercial). Its Office 365 applicability table has one row, Commercial, and the in-scope services it lists there are Activity Feed Service, Bing Services, Delve, Exchange Online Protection, Exchange Online, Microsoft Teams, Office 365 Customer Portal, Office Online, Office Service Infrastructure, Office Usage Reports, OneDrive for Business, People Card, SharePoint Online, and Windows Ink. The same page says “The HITRUST CSF certification of Office 365 is valid for two years.”

A service that is not on the list is not inherited. Microsoft Learn’s regulatory page says “If a service isn’t included in the current scope of a specific compliance offering, your organization is responsible for assessing the risks based on your compliance obligations and determining how you process the data in that service.”

Only the current letter, not a summary page, fixes the scope. Microsoft’s Azure page says “You can access Azure HITRUST audit documents from the Service Trust Portal (STP) Healthcare and Life Sciences section.” Microsoft’s October 3, 2023 Azure blog post, Microsoft Azure achieves HITRUST CSF v11 certification, said “Azure customers can obtain the HITRUST CSF Letter of Certification, which contains the full scope of certified Azure offerings and regions, at the Service Trust Portal”. The dates, version and exact services on today’s letter are in that portal, and this page does not restate them.

The planning rule i3solutions recommends: list every Microsoft service in your assessment scope, check each one against the current letter in the Service Trust Portal, and request inheritance only for the services the letter names.

How the Inheritance Request Reaches Microsoft

Inheritance happens only on request, and a plan that assumes otherwise will find the gap at validation. Microsoft’s Azure HITRUST page says “The program enables you to pre-populate your assessment with fully inherited or shared responsibility controls for Azure in the HITRUST MyCSF tool.” It describes the steps: “Sign in to the HITRUST MyCSF tool and pre-populate your assessment for your solution hosted on Microsoft Azure with either fully inherited or shared responsibility controls for Azure.” and “A Microsoft HITRUST administrator will then complete the Microsoft part of the assessment in the MyCSF tool.”

Microsoft’s January 14, 2021 Azure blog post, Azure and HITRUST publish shared responsibility matrix, said “When a customer is completing their HITRUST CSF Assessment, they can select “Request Inheritance” through the HITRUST MyCSF SaaS platform for any requirements you plan to inherit from Azure.” and “Microsoft will then approve all the relevant controls from the request and notify the customer.”

The matrix tells you what to request. Microsoft’s Azure HITRUST page says “Moreover, the Azure HITRUST shared responsibility matrix is available directly from HITRUST.” and “It lists HITRUST CSF controls, clarifies shared responsibility per control (customer, shared, or Azure), and provides Azure control implementation details where appropriate.”

Microsoft’s pages describe this request flow and this matrix for Azure. Before you plan a request for a Microsoft 365 or Dynamics 365 service, confirm the route against the current letter and with Microsoft rather than assuming the Azure flow carries over.

What Stays Yours, in Microsoft’s Words

The failure that costs the most at validation is a shared requirement no one on the customer side owns. Microsoft’s Azure HITRUST page answers the question “Does Microsoft certification mean that if my organization uses Azure, it is HITRUST compliant?” with “No. You’re ultimately responsible for your own HITRUST CSF compliance.” It also says “If your business requires HITRUST certification for implementations deployed on Azure, you can build on Azure HITRUST certification when you conduct your compliance assessment. However, you’re responsible for evaluating the HITRUST requirements and controls within your own organization.”

How much you can rely on Microsoft depends on your own build. The same page says “This reliance is dependent on which Azure offerings you’re using and how you implemented them.” and “In addition, some requirements are entirely part of your implementation responsibility to meet HITRUST CSF compliance.”

Microsoft Learn’s regulatory page draws the line: “Microsoft manages most of the infrastructure controls, including physical security, network controls, and application-level controls.” and “Your organization is responsible for managing access controls and protecting your sensitive data.” It adds “Building on that framework, your organization needs to implement and maintain its own data protection controls to meet HITRUST CSF requirements.” Microsoft’s Shared responsibility in the cloud page, last updated August 24, 2026, says “For all cloud deployment types, you own your data and identities.”

The planning rules i3solutions recommends: map each requirement to full, shared or customer responsibility from the matrix before fieldwork starts; name an owner and an evidence source, such as a configuration export, report or log, for every shared and customer requirement; and treat identities, access control and data protection as yours on every Microsoft service, inherited or not.

How the Assessment Type Changes the Work

Two organizations with the same Microsoft estate can face different inheritance rules because they chose different assessments. HITRUST’s Cybersecurity Compliance Certifications and Assessments page says “HITRUST offers a traversable portfolio of three core cybersecurity assessments and certifications based on an organization’s size, needs, and risk objectives.” According to HITRUST, the e1 and the i1 are 1-year validated assessments and the r2 is a 2-year validated assessment. According to HITRUST, “The e1 provides foundational assurance with 43 core controls for low-risk entities.” and “The i1 offers threat-adaptive protection with 182 controls focused on leading practices.” The same page says “The r2 assessment and certification is best suited for organizations that need to demonstrate regulatory compliance with authoritative sources like HIPAA, the NIST Cybersecurity Framework, and dozens of others or that require expanded tailoring of controls based on other identified risk factors.”

HITRUST’s December 28, 2021 advisory, HAA 2021-012: i1 Introduction and r2 Enhancements, set out the carve-out rule: “HITRUST CSF requirements performed by the assessed entity’s service providers (such as cloud service providers) on behalf of the organization can be carved out / excluded from consideration in i1 validated assessments, but such carve-outs are not permitted in r2 assessments.” According to HITRUST’s advisory, “r2 certifications are valid for 2 years, while i1 certifications are valid for 1 year.” and “Both require an Authorized HITRUST External Assessor Organization to inspect documented evidence to validate control implementation.”

A later advisory, HITRUST’s January 17, 2023 HAA 2023-004: e1 Assessment Introduction, described “The Inclusive method, whereby HITRUST CSF requirements performed by the service provider are included within the scope of the HITRUST Assessment and addressed through full or partial inheritance, reliance on third-party assurance reports, and/or direct testing.” It said “Cross-assessment-type inheritance is allowed, meaning that i1 or r2 Assessment results can be inherited into an e1 Assessment (and vice versa).” and “Controls nest into the i1 and r2 to be fully inheritable, so e1 work can be reused.” Those rules are quoted as HITRUST published them on those dates; confirm the current rule with HITRUST and your assessor before you scope an r2 around a carve-out.

HIPAA configuration inside Microsoft 365 is a separate body of work from HITRUST inheritance, with its own control mapping. i3solutions has delivered M365 compliance implementations across defense, healthcare, and financial services environments, as set out in Microsoft 365 compliance consulting.

What Microsoft’s Tools Show, and What They Do Not

When a green dashboard is read as an assessment result, the gap shows up at validation. Microsoft’s Azure HITRUST page says “Each HIPAA/HITRUST control is associated with one or more Azure Policy definitions.” and “These policies may help you assess compliance with the control; however, compliance in Azure Policy is only a partial view of your overall compliance status.”

For risk assessment, Microsoft Learn’s regulatory page says “Specifically, for HITRUST CSF, we recommend that you perform risk assessments using the NIST 800-53 and NIST CSF assessments in Compliance Manager.” Neither tool’s dashboard or report replaces the evidence an assessor inspects, and neither is the MyCSF score.

When Inheritance Will Not Carry the Weight

If any of these describes your assessment, plan for more customer-side work than the inheritance request suggests:

• A Microsoft service outside the current letter’s scope. It carries no inheritance, and Microsoft says the risk assessment for it is yours.
• An r2 assessment. HITRUST’s December 28, 2021 advisory said provider-performed requirements “can be carved out / excluded from consideration in i1 validated assessments, but such carve-outs are not permitted in r2 assessments.”
• Controls in the tenant itself. Access control, data protection, identities and data stay yours on every service, as Microsoft’s pages say.
• A question that is really about the HIPAA business associate agreement. The BAA and a HITRUST assessment are different instruments, and this page does not cover the BAA.
• A need for a legal reading. Microsoft’s regulatory page says “Information provided in this section does not constitute legal advice and you should consult legal advisors for any questions regarding regulatory compliance for your organization.”

What to Ask of Whoever Does the Work

Whether the work is done by your own team or an outside firm, ask for these, in writing:

• A list of every Microsoft service in the assessment scope, checked against the current Microsoft letter in the Service Trust Portal.
• A requirement-by-requirement responsibility map from the matrix: full, shared or customer.
• An owner and an evidence source, such as an export, report or log, for each shared and customer requirement.
• A plain statement that the validated assessment is performed by an Authorized HITRUST External Assessor Organization, and that the implementation team does not certify anything.
• US-based delivery.
• A plain statement that the HITRUST program and its controls remain yours to operate after the project.

How i3solutions Approaches It

If the work needs an outside firm, it is a project: checking the Microsoft services in the assessment scope against the current letter, building the responsibility map from the matrix, and doing the Microsoft 365 and Azure configuration work that produces the exports, reports and audit logs used as customer-side evidence, handed to the owners you name.

i3solutions delivers its full service portfolio into the healthcare vertical exactly as it does into defense manufacturing and finance, including identity work with Okta and Entra ID, AI work, Power Platform, and Dynamics 365 integration. Separately, i3solutions runs migrations against named control families across CMMC, HIPAA, SOC 2, and NIST 800-171, producing artifacts auditors can review. i3solutions has evaluated a Microsoft estate for a healthcare network operating under HIPAA Security Rule and HITRUST CSF compliance requirements, as described in Microsoft technology stack evaluation. Delivery is senior and US-based.

On the operating side, i3solutions does not run your HITRUST program, your MyCSF assessment, your controls or their audit evidence as an ongoing managed service; specialists embedded inside your team are an engagement model i3solutions offers. An i3solutions project engagement does not by itself include ongoing support of what it delivers, which i3solutions scopes separately as Application Managed Services, and it is not a replacement for the internal team, open-ended scope expansion, or vendor lock-in.

The wider governance practice is described in enterprise governance and compliance solutions.