HealthStream’s CredentialStream® Application and Products Achieve HITRUST r2 Certification, the Highest Level of Healthcare Data Security

Rhea-AI Summary

HealthStream (HSTM) announced that its CredentialStream application, CredentialStream Hub, and Network have achieved HITRUST r2 Certification, the highest level of information protection and compliance assurance. CredentialStream is used by hospitals and health systems for credentialing, privileging, and enrollment.

The certification process involved a comprehensive evaluation of 921 baseline controls across 19 domains, including data protection, network security, and business continuity. This achievement is particularly significant given that healthcare faces increased risk exposure due to protected health information and regulatory requirements. According to HHS data, 720 security breaches were reported in 2024, with 520 from healthcare providers, while HITRUST-certified environments reported only 0.64% of security breaches in 2022-2023.

Positive

• Achieved highest level HITRUST r2 Certification, enhancing market competitiveness
• Significantly lower security breach risk (0.64%) compared to non-certified healthcare providers
• Enhanced protection for CredentialStream platform, a key revenue-generating product

Negative

• None.

Insights

Information Security Analyst

The HITRUST r2 Certification for HealthStream's CredentialStream platform represents a significant competitive advantage in the healthcare technology sector. With healthcare providers facing increasing cybersecurity threats - evidenced by 520 provider breaches in 2024 - this certification positions HealthStream as a premium vendor in the critical credentialing and privileging space.

The certification's value proposition is compelling: HITRUST-certified environments show a mere 0.64% breach rate, compared to the industry's much higher incident rate. This translates to tangible risk reduction for healthcare organizations, potentially leading to lower cybersecurity insurance premiums and reduced breach-related costs, which average $9.4 million per incident in healthcare.

For investors, this certification carries three key implications:

• Enhanced market positioning in RFPs and vendor selections, as healthcare organizations increasingly require HITRUST certification
• Reduced risk profile through comprehensive security controls across 19 domains
• Potential for accelerated revenue growth as security-conscious healthcare providers prioritize certified solutions

The timing is particularly strategic, as healthcare organizations face mounting pressure to protect sensitive credentialing and privileging data. HealthStream's proactive investment in achieving the highest level of certification demonstrates forward-thinking risk management and positions the company favorably for enterprise-level contracts.

NASHVILLE, Tenn.--(BUSINESS WIRE)-- HealthStream (Nasdaq: HSTM), a leading healthcare technology platform for workforce solutions, announced today that its SaaS-based CredentialStream application, along with the CredentialStream Hub and Network by HealthStream, have earned HITRUST r2 Certification, the highest level of information protection and compliance assurance. CredentialStream is a market-leading application currently used by hospitals and health systems for credentialing, privileging, and enrollment.

It is widely acknowledged that the healthcare industry has greater risk exposure than many other industries due to protected health information, data volumes, extensive regulatory compliance requirements, and other risk factors. According to the U.S. Department of Health and Human Services Office for Civil Rights, for the full-year 2024, 720 security breaches were reported in their healthcare breach database with 520 of those reported by healthcare providers. Across all industries, HITRUST’s 2024 Trust Report stated that only 0.64% of HITRUST-certified environments reported a security breach throughout 2022 and 2023. From these statistics, it’s clear to see why vendors’ platforms and products that have earned HITRUST certification are preferred by healthcare organizations as an additional protective step in the management of their data.

Through a stringent year-long initiative, HealthStream underwent a meticulous and thorough vetting process consisting of 921 baseline controls across 19 domains. The certification journey covered a range of security categories, including data protection and privacy; network protection; information protection program; password management; access control; audit logging and monitoring; business continuity and disaster recovery.

“HealthStream is continuously enhancing its data security and risk management—and, therefore, we’re pleased to have earned the prestigious HITRUST r2 Certification for CredentialStream,” said Robert A. Frist, Jr., Chief Executive Officer, HealthStream. “This achievement represents the outstanding work of many employees and their teams, for which we are all grateful.”

About HealthStream

HealthStream (Nasdaq: HSTM) is the healthcare industry’s largest ecosystem of platform-delivered workforce solutions that empowers healthcare professionals to do what they do best: deliver excellence in patient care. For more information, visit http://www.healthstream.com or call 800-521-0574.

This press release includes certain forward-looking statements (statements other than solely with respect to historical fact) that involve risks and uncertainties regarding HealthStream. These statements are based upon management’s beliefs, as well as assumptions made by and data currently available to management. This information has been provided in reliance on the “safe harbor” provisions of the Private Securities Litigation Reform Act of 1995. HealthStream cautions that forward-looking statements involve known and unknown risks, uncertainties, and other factors that may cause actual results, performance, or achievements to be materially different from future results, performance, or achievements expressed or implied by such forward-looking statements, including as the result of risks referenced in HealthStream’s Annual Report on Form 10-K for the year ended December 31, 2023, filed on February 26, 2024, and in HealthStream’s other filings with the Securities and Exchange Commission from time to time. HealthStream undertakes no obligation to update or revise any such forward-looking statements.

View source version on businesswire.com: https://www.businesswire.com/news/home/20250213293339/en/

Mollie Condra, Ph.D.

Head, Investor Relations &

Communications

HealthStream

(615)-301-3237

mollie.condra@healthstream.com

Source: HealthStream

FAQ

What certification did HealthStream (HSTM) receive for its CredentialStream platform in 2024?

HealthStream's CredentialStream platform received HITRUST r2 Certification, the highest level of information protection and compliance assurance in healthcare data security.

How many security controls were evaluated for HSTM's HITRUST r2 Certification?

HealthStream underwent evaluation of 921 baseline controls across 19 domains during the HITRUST r2 Certification process.

What is the security breach rate for HITRUST-certified environments according to the 2024 Trust Report?

According to HITRUST's 2024 Trust Report, only 0.64% of HITRUST-certified environments reported security breaches throughout 2022 and 2023.

How many healthcare security breaches were reported in 2024 according to HHS?

According to the U.S. Department of Health and Human Services, 720 security breaches were reported in 2024, with 520 of those reported by healthcare providers.