HITRUST e1 validates that your organization has essential cybersecurity controls in place, giving customers and partners confidence in your security program. Thoropass combines readiness, automation, and assessment in one connected experience, with a HITRUST Accredited Assessor and AI-powered Audit Lifecycle Platform guiding you from scoping through validation.
Companies across the healthcare ecosystem trust Thoropass
.svg)
.svg)
Thoropass brings readiness, automation, and assessment together in one connected experience. Your HITRUST Accredited Assessor works alongside your team from scoping through validation, while the Audit Lifecycle Platform keeps scope, evidence, requests, reviews, issues, and milestones in one place.
Thoropass is the only fully integrated audit platform that is also a HITRUST Accredited Assessor. With direct two-way synchronization between Thoropass and HITRUST MyCSF, controls and evidence stay aligned automatically, eliminating duplicate work and reducing administrative overhead.
Reuse controls, policies, and evidence across frameworks to reduce duplicate work, lower compliance costs, and manage everything from one connected platform.
Your assessor is involved from the beginning, helping define scope, answer questions, review evidence, and keep your assessment moving. With one dedicated team throughout the engagement, you avoid unnecessary handoffs, reduce surprises, and stay aligned from readiness through certification.
Maegan Stamps
Operations and Implementations Specialist
OrthoTOM
From preparation to assessment and certification, Thoropass has been helping organizations navigate the HITRUST framework with confidence since 2022 - all in one intuitive platform. Thoropass helps manage information security and protect sensitive data, ensuring your organization meets various regulatory and privacy regulations.
One vendor. A seamless experience. Thoropass supports HITRUST compliance efforts as part of a comprehensive risk mitigation strategy, offering a more unified and user-friendly approach to managing various regulations and frameworks, including SOC 2, ISO 27001, PCI DSS, HIPAA, and more.
HITRUST e1 is a 1-year validated assessment focused on foundational cybersecurity assurance. It evaluates a defined set of essential controls and gives organizations a more efficient path to independent HITRUST validation.
HITRUST e1 can be a good fit for growing organizations, lower-risk environments, companies new to HITRUST, or teams that need a credible assurance report without the broader scope of i1 or r2.
HITRUST e1 is the most focused assessment in the portfolio. HITRUST i1 provides broader, threat-adaptive assurance through a larger set of implemented controls, while HITRUST r2 is a tailored, risk-based assessment designed for complex organizations with higher assurance needs.
Yes. HITRUST designed e1, i1, and r2 as a traversable assessment portfolio, which means work completed for e1 can help support a future move toward more comprehensive HITRUST assessments.
Thoropass brings experienced HITRUST assessors, a structured assessment process, and an audit lifecycle platform together in one connected experience. Your team gets clearer requests, organized evidence review, expert guidance, and support through certification delivery.
Close
Leith Khanafseh
Audit Managing Partner, Thoropass Assurance
Leith founded and leads Thoropass’s Assurance practice, bringing 15 years of audit experience to the role. At Thoropass, he oversees the audit and assessment offerings, shapes product direction, and drives innovation that modernizes traditionally outdated audit practices.
Matt Udicious
Director of Infosec Assurance
Matt is a seasoned InfoSec assurance professional with over a decade of experience in cybersecurity, specializing in security, auditing, and compliance.
Matt’s career has included roles, across security, auditing, and compliance. He gained invaluable insights during his tenure as a former auditor, concentrating on SOC 2 compliance for technology companies within the prestigious Big 4 consulting firms. His meticulous approach and deep understanding of industry standards have made him a trusted authority in information security.
Bruce Edwards
Senior Manager, PCI Assurance
Bruce has more than 15 years of experience in security and risk management, both as an external consultant and an internal practitioner. His experience includes penetration testing, PCI QSA, ASV, and cloud security, and in his previous role as a security director, Bruce led PCI DSS assessments for Fortune 500 companies in the fintech and healthcare sectors, both in the U.S. and around the world.
.avif)
Lucas Baiocchi
Senior Manager, HITRUST InfoSec Assurance
Lucas has more than eight years of experience in information security audits and assessments. As Thoropass’ HITRUST InfoSec Assurance Senior Manager, he leads and executes HITRUST assessments, working closely with organizations to evaluate their security posture, validate control effectiveness, and deliver clear, actionable insights that align compliance objectives with broader business goals. His approach ensures not only regulatory and standards-based compliance, but also the adoption of efficient, scalable, and realistic security solutions.
Tom Miller
Senior Manager, Enterprise Team, InfoSec Solutions
Tom is an information security and technology audit leader with more than a decade of experience delivering assurance engagements for organizations ranging from large public corporations to high-growth startups. He owns Thoropass’ largest and most strategic client portfolio, leading complex multi-framework audits and serving as a trusted advisor to executive stakeholders on control design, security requirements, and remediation strategy.
Chris Beiro
Senior Director, InfoSec Solutions
Chris is a seasoned cybersecurity executive with over 15 years’ experience in compliance and audit. He has helped hundreds of organizations – from high-growth startups to Fortune 500 enterprises - strengthen their cybersecurity programs, meet rigorous compliance standards, and mitigate risk. Prior to joining Thoropass, he spent more than 13 years in cybersecurity and audit leadership roles at KPMG and Coalfire.
Austin Newcomer
Senior Manager, InfoSec Assurance
Austin is a Senior Information Assurance leader with more than eight years of experience and expert-level command of AICPA attestation standards. Prior to joining Thoropass, he spent three years at IT auditor Coalfire, where he supported clients ranging from Silicon Valley startups to Fortune 100 corporations.
Today, he leads more than 40 concurrent SOC 1, SOC 2, and HIPAA audits for emerging, mid-market, and enterprise technology companies, with particular depth in healthcare compliance and complex cloud environments across AWS, Azure, and GCP. His work spans the full audit lifecycle — assessing security procedures, reviewing configurations, interviewing control owners, and documenting results — including combined assessments across multiple compliance frameworks.
Emmanuel Amos-Abanyie
Head of Quality Assurance, InfoSec Solutions
As Head of Quality Assurance for InfoSec Solutions, Emmanuel leads the firm’s quality assurance program, driving consistency, technical excellence, and standardization across every audit engagement. He works closely with audit teams to strengthen audit methodologies, enhance reporting quality, and promote continuous improvement, helping clients receive accurate, rigorous, and reliable audit deliverables.
