HITRUST does not issue certifications limited solely to privacy-related requirements. While privacy is a critical part of the CSF—reflected in domains such as Data Protection & Privacy—HITRUST certifications require coverage of all 19 domains. This is because security and privacy are interdependent: without robust security, privacy cannot be protected. An entity may emphasize privacy controls during scoping and reporting, but certification itself is always tied to a full CSF assessment. Privacy-related frameworks, such as GDPR or HIPAA Privacy Rule, can be added as regulatory factors, which introduce additional privacy-focused requirements. However, the output will still be a standard HITRUST validated report or certification covering the entire environment, not a “privacy-only certification.”