HIPAA is a law (created by lawmakers) while HITRUST is a framework (created by a collective of security experts). HITRUST includes aspects of HIPAA and can be used to demonstrate compliance with HIPAA.