HAA 2019-009: Updated Scoring Rubric

Policy/Program Change Details 
HITRUST’s scoring rubric, which assists organizations and their assessors in assessment scoring level determinations, has been overhauled. Key changes include: 

• Definitions for assessment terminology, assessment examples and guidance on important concepts have been added. 
• Scoring lookup tables have been created for each of the five levels of HITRUST’s PRISMA maturity model (Policy, Procedure, Implemented, Measured, and Managed). 
• Replacement of qualitative terms such as none, some, and all with quantitative ranges. 

• Removal of ambiguous terms such as “management action” and “ad hoc”. 

Rationale 
The rubric’s has been enhanced to bring improved usability, added clarity, and better harmonization with the assessment guidance provided in HITRUST’s Risk Analysis Guide. 

Timetable for Implementation 
The updated scoring rubric will be made available for download here on or before September 20, 2019. 

Observance of the new rubric will be mandatory for assessment objects submitted and accepted on or after December 31, 2019. All validated assessments that are in progress and intend to observe the old scoring rubric must be accepted by HITRUST prior to December 31, 2019. Interim assessments performed after December 31, 2019, will observe the rubric in effect at time of performance of the validated assessment. 

The term “Accepted” means successful check-in of an object. Submission of a validated assessment within MyCSF is the first step towards acceptance. After submission, the Assurance team performs certain quality checks; should any of these checks fail, the submission is reverted to the Assessor for remediation. Average acceptance time of a submission to HITRUST is one to three business days. 

Since only validated assessments accepted prior to December 31, 2019, will be QA’d by HITRUST in observance of the previous scoring rubric, it is strongly recommended that Assessors work with their customers to ensure submissions in MyCSF are made with enough time to allow for HITRUST acceptance.