Policy/Program Change Details 

Summary 
On July 1, 2021, HITRUST will enable a Reservation System within the HITRUST MyCSF platform, requiring Assessed Entities to schedule the start of quality assurance (QA) procedures for HITRUST CSF Validated Assessments. The Reservation System is designed to: 

• Eliminate the uncertainty around when HITRUST’s QA procedures will begin, 
• Allow Assessed Entities and their HITRUST Authorized External Assessor Organizations to schedule resources to respond to HITRUST’s QA feedback, and 
• Provide the opportunity for QA to occur closer to the submission date. 

Key Considerations 
Making a Reservation 

• All Assessed Entities will be required to make a reservation prior to submission of their HITRUST CSF Validated Assessment. The reservation can be made any time prior to submission; however, HITRUST encourages Assessed Entities to make their reservations as early as possible. The Reservation System will allow reservations up to one year in advance. 
• A Validated Assessment Report Credit is required to make a reservation. If you do not have a Validated Assessment Report Credit, you will receive a prompt to contact your Customer Success Manager in order to purchase a Validated Assessment Report Credit. 
• The submission date of the assessment to HITRUST must be entered into MyCSF as part of the reservation process. Assessed Entities should work carefully with their HITRUST Authorized External Assessor Organizations to plan their submission date as this is the deadline to submit the assessment to HITRUST. Failure to submit the assessment by the submission date will result in cancellation of the reservation, and a new reservation will need to be made. 
• Reservation slots occur within QA Blocks. QA Blocks are one-week periods where HITRUST will begin QA procedures. Each QA Block contains a set number of reservations that are possible, with MyCSF displaying the QA Blocks that are available to reserve. 
• By the end of the QA Block, HITRUST will have begun QA procedures on the assessment. For assessments in the normal QA workflow, organizations should typically expect to hear from HITRUST within seven to ten business after the end of the QA Block. Failure to hear from HITRUST during the week of your scheduled QA Block does not indicate that QA has not started. 
• Prior to booking a reservation, Assessed Entities will need to acknowledge the Cancellation Policy. The Cancellation Policy outlines the date by which the Assessed Entity can make a modification or cancel the reservation without incurring a fee. 

Expedited Reservations 
HITRUST also offers expedited reservations. Expedited reservations offer access to QA Blocks that may otherwise be at capacity and includes priority processing of the assessment. Available expedited reservations will be shown within certain QA Blocks. To purchase an expedited reservation, the Assessed Entity will need to contact their Customer Success Manager. 

Starting your Reservation 
After submitting a Validated Assessment to HITRUST, the Assessed Entity will typically receive confirmation that your assessment was accepted by HITRUST. If the assessment was returned by HITRUST, the Assessed Entity and HITRUST Authorized External Assessor Organization should work together to remediate the assessment and resubmit. If the assessment is not resubmitted and accepted by HITRUST prior to the start of the QA Block, the reservation will be canceled. In order to ensure acceptance of an assessment prior to the start of the QA Block, HITRUST reminds Assessed Entities and External Assessors that they can submit in advance of the ‘Submission Date’ defined in their reservation. 

Implementation and Timeline 
For any Validated Assessments submitted to HITRUST for processing on or before June 30, 2021, HITRUST will continue to process assessments on a first-come, first-served basis with a priority for Assessed Entities that purchased expedited processing. 

On July 1, 2021, the reservation system will be enabled for all HITRUST CSF Validated Assessments that have not previously been submitted to HITRUST. A reservation will be required to be made prior to submission to HITRUST. 

Additional Information 
A walk-through of the process within MyCSF can be found here, along with anticipated questions and responses.