The organization should first determine the business drivers for attempting certification which should include identifying key stakeholders, defining scope, and selecting an Authorized External Assessor Organization. The assessed entity will need to determine if they are going to pursue a HITRUST Implemented, 1-Year (i1) Validated Assessment or a HITRUST Risk-Based, 2-Year (r2) Validated Assessment. For either an i1 or an r2, HITRUST recommends a Readiness Assessment be performed to prepare organizations for the Validated Assessment.

Organizations can involve Authorized Internal and External Assessor Organizations as part of the Readiness Assessment. Based upon the results of the Readiness Assessment the organization should develop a remediation plan and work with their Authorized External Assessor Organization to define timing of the Validated Assessment.

Prior to beginning the Validated Assessment, the organization will need to purchase a Validated Assessment object from HITRUST if they are not a MyCSF subscriber. The organization will need to complete the Validated Assessment using the MyCSF tool and then the Authorized External Assessor Organization will be required to perform the validation/audit work. Once the Authorized External Assessor Organization’s work is complete, they submit the assessment to HITRUST for review. HITRUST will perform quality assurance procedures, create a report and, depending on the scores in the report, will issue a Letter of Certification.