HITRUST has announced that the next major update to the existing HITRUST CSF is scheduled for July 2017.
Organizations that have already self-evaluated against the current version 8.1, or those now beginning planning activities, should be aware of:
Organizations wishing to certify against version 8.1 must create their Validated Assessment object prior to the version 9 release.
To determine whether to certify against the current version 8 or the upcoming version 9, consider:
While the specific control requirement impact to an organization won’t be known until the July release, HITRUST has communicated the types of changes to be incorporated:
In addition, as with the last major update from version 7 to version 8, additional control requirements within the HITRUST CSF are expected to now become required for organizations seeking certification. The number of controls required for certification is expected to increase from the current 66 to approximately 75.
For assistance with understanding how the version 9 update may impact your organization’s HITRUST assessment scope or certification timelines, please contact our HITRUST specialists.