Your customers can now rate your information risk. Here's what moves the score.
HITRUST launched IRIDX, an information risk rating for third parties. For small vendors and healthcare suppliers, organized, verified evidence matters as much as the controls behind it.
A renewal that goes differently
Picture a 30-person medical billing company. It has served a regional hospital for six years. Its controls are sound: multi-factor sign-in everywhere, encrypted laptops, tested backups, a signed business associate agreement. Every year it fills in the hospital’s security questionnaire, and every year the contract renews.
This year the hospital’s vendor-risk team adds a step. Each supplier’s evidence goes through a third-party information risk rating, and the result goes to the hospital’s risk committee next to the contract. The billing company’s rating comes back weaker than its owners expected. The controls didn’t change. The evidence did not show them well: an answered questionnaire, a policy binder last revised two years ago, and no assessment against any named standard.
That scenario is now realistic. On October 27, 2026, HITRUST announced IRIDX, an information risk ratings company, and said it is generally available (HITRUST, October 27, 2026).
What IRIDX does
According to the announcement, IRIDX measures residual information risk, meaning the risk that remains after a company’s controls, and estimates what that risk could cost. It does this from evidence that already exists rather than from a new assessment. The release lists that evidence as assessments, certifications, questionnaires, telemetry and external risk signals. HITRUST states that IRIDX develops and governs its methods under its own governance framework, separately from HITRUST’s assurance and certification programs, and applies the same criteria to evidence whatever its source.
The release describes four outputs:
- The IRIDX Score. A measure of residual information risk that also explains the factors driving the result.
- An evidence-confidence indicator. It separates real control weaknesses from gaps or uncertainty in the evidence.
- Authoritative Alignment Scores. These show alignment and gaps against specified regulatory, standards, supervisory, and AI governance or security requirements.
- Information Risk Financial Exposure (IRFE). A Low, Base and High range of modeled financial exposure for a specific relationship, before insurance, indemnity or other recovery. The release says underwriters can use the score, evidence confidence and IRFE when deciding on a specific relationship, and that insurers set coverage and terms themselves.
The intended users are enterprises, boards, underwriters, insurance brokers and regulators. HITRUST also reports that in a comparative review, median analyst review time fell from 5.3 hours to 35 minutes, with the note that individual results vary. Faster reviews make it practical for a large customer to rate every supplier, not just the biggest ones.
The release does not list pricing or a partner program, and it names no specific attestation reports as inputs beyond the general categories above.
The problem for small suppliers: thin evidence reads as weak controls
The evidence-confidence indicator is the part small vendors should pay the most attention to. A rating built from evidence can only credit what the evidence shows. If your proof is a self-answered questionnaire and an old policy, the rating has little to work with, even if the protections in place are good.
Three things tend to make sound controls look weak:
- No named standard. “We follow best practices” can’t be compared with anything. Controls mapped to a published standard can.
- Stale or unverified documents. A policy that no longer matches how the company works, or a screenshot with no date, gives little confidence.
- Scattered proof. Evidence spread across inboxes and shared drives, with no owner, comes in incomplete when a customer asks.
The good news is that all three can be fixed without rebuilding the security program. They are mostly about organizing and verifying what you already do.
The solution: controls you can show, against standards your customers recognize
Pick a standard, and know how it relates to the law
A law tells you what you must achieve, and a standard gives you a structured way to do it and show it. HIPAA is a law. A healthcare supplier meets its Security Rule requirements by putting controls in place and documenting them against a standard, such as the NIST Cybersecurity Framework (CSF). Calling HIPAA a standard blurs that line, and so does treating a standard as if it were the law.
Climb the standards in a sensible order
Most small suppliers follow a similar path as their customers ask for more:
- NIST CSF 2.0. A plain, widely recognized baseline for organizing the whole program.
- The sector rule. For healthcare suppliers, showing how those controls meet the HIPAA Security Rule.
- SOC 2. An independent auditor’s report that larger customers often ask for.
- ISO 27001. An international certification of the security management system, often next for suppliers selling to large or global organizations.
Each step reuses the evidence from the one before, so organized evidence early on makes every later step easier.
Keep evidence current and in one place
For each control, know what proves it, who owns that proof and when it was last checked. Date your documents, retire the ones that no longer apply, and keep the set somewhere you can hand over quickly when a customer asks.
Who does what
| Task | Your company | An outside assessor or advisor | Your customer, or a rating provider |
|---|---|---|---|
| Run the controls day to day | Yes | ||
| Choose the standard to measure against | Decides | Recommends one that fits your customers and sector | May require a specific one |
| Find gaps in controls and in evidence | Gives access and answers | Assesses and reports | |
| Set maturity levels against named standards | Scores each control area | ||
| Organize and verify evidence before an audit or review | Owns and maintains it | Checks it is complete and current | |
| Rate residual risk from your evidence | Rates it using their chosen method |
Where Security Medic Consulting fits
Security Medic Consulting has no affiliation with HITRUST or IRIDX, and no advisor can promise a particular rating. What we can do is help your controls and your evidence tell the same story:
- A free assessment finds the gaps, both in controls and in the evidence behind them.
- A paid assessment scoped to one or two named standards, such as NIST CSF and the HIPAA Security Rule, sets a maturity level for each area so you know where you stand and what to fix first.
- Pre-audit preparation verifies that your evidence is complete, current and organized before a customer review, a rating or an audit.
The three steps, and what each one delivers, are on our IRIDX readiness page.
Book a free 30-minute call, or email support@securitymedic.com.
Source
- HITRUST, HITRUST Launches IRIDX, an Information Risk Ratings Company to Standardize Information Risk Measurement, Governance and Financial Exposure, press release, October 27, 2026.