HAA 2019-005: Changes Related to Interim Reviews

Policy/Program Change Details 
This bulletin is to inform HITRUST CSF Certified Organizations and HITRUST Assessor Organizations about changes to the interim review. 

The Interim Review has been replaced with an Interim Assessment. The Interim Assessment differs from what has been known as the Interim Review by requiring: 

• Full testing of selected control requirements (INCREASED TESTING REQUIREMENT); 
• Rescoring of the tested control requirements (NEW); 
• Full QA of testing by HITRUST (INCREASED LEVEL OF EFFORT); and 
• For assess-only reports, full verification that recreated assessment matches assessment used for issuing of the previous full report (NEW). 

As a reminder and consistent with HITRUST Assurance Advisory 2017-01 issued in August of 2017, Interim Assessments will be performed with the HITRUST MyCSF. There will be an Interim Assessment processing fee of $2,900. The processing fee will be waived for organizations that have an active subscription to the HITRUST MyCSF. 

Rationale 
This change is to ensure the consistency and quality of work performed during an Interim Assessment and increase the rigor and oversight by HITRUST; resulting in an increase in assurance level provided by the Interim Assessment and support for maintaining the HITRUST CSF Certification for the additional year. 

Timetable for Implementation 
Effective for all validated assessments submitted on or after April 1, 2019. 

For any additional questions, please contact our Support team or a HITRUST Customer Success Manager.