Spruce Earned HITRUST CSF Certification in 2018
-
David Craig, MD
- September 16, 2026
In 2018, after a year of audit and assessment against the HITRUST Common Security Framework, Spruce earned HITRUST CSF Certified status for its core application and underlying infrastructure. HITRUST was a demanding standard to meet because it folded federal and state regulations, standards, and frameworks including HIPAA, NIST, ISO, COBIT, and SOC 2 into one risk-based set of security controls, and certification placed an organization in a small group worldwide. This post is a record of that 2018 milestone. Spruce’s security program today is covered by its annual SOC 2 Type II audits.
Great news! We’ve been hard at work at Spruce over the past year having our core Spruce platform and its underlying infrastructure audited and assessed against the HITRUST Common Security Framework (CSF), and we recently achieved certification for this important healthcare compliance benchmark.
Check out the announcement below!
Spruce Health Achieves HITRUST CSF® Certification to Manage Risk, Improve Security Posture, and Meet Compliance Requirements
San Francisco, CA – Spruce Health, a leading provider of cloud-based medical communications and modern healthcare workflow solutions, today announced that its core Spruce platform, as well as its underlying infrastructure, has earned Certified status for information security by HITRUST.
HITRUST CSF Certified status demonstrates that the organization’s Spruce platform has met key regulations and industry-defined requirements and is appropriately managing risk. This achievement places Spruce Health in an elite group of organizations worldwide that have earned this certification. By including federal and state regulations, standards, and frameworks, and incorporating a risk-based approach, the HITRUST CSF helps organizations address these challenges through a comprehensive and flexible framework of prescriptive and scalable security controls.
Spruce Health’s Medical Director, Dr. David Craig, led the organization’s effort to achieve HITRUST CSF certification for Spruce, in conjunction with the full support and direction of the company’s CEO, Ray Bradford, as well as its engineering leadership.
“Organizations like ours have a great responsibility to meet the complex regulatory and compliance requirements that are vital to trust and security in healthcare, including those of HIPAA, NIST, ISO, COBIT, and SOC 2,” said Mr. Bradford. “The HITRUST CSF is the gold-standard for our industry, and Spruce Health is pleased to be able to demonstrate its commitment by achieving HITRUST CSF Certification.”
“HITRUST has been working with the industry to ensure the appropriate information protection requirements are met when sensitive information is accessed or stored in a cloud environment. By taking the steps necessary to obtain HITRUST CSF Certified status, Spruce Health is distinguished as an organization that people can count on to keep their information safe,” said Ken Vander Wal, Chief Compliance Officer, HITRUST.
About Spruce Health
Spruce Health is a healthcare technology company that is dedicated to providing solutions that enable modern care to occur outside of face-to-face interactions and the four walls of the medical office. Spruce serves a diverse set of medical organizations, from solo providers through to large multi-site, multi-specialty practice groups, and the company offers advanced solutions in telemedicine, telephony, secure messaging, team collaboration, population management, workflow efficiency, and many other necessary areas and functions of healthcare today.
For more information, contact support@sprucehealth.com.
