Share This Post
At the start of the year, HITRUST released an updated methodology for scoring requirements. This will ensure that organizations focus on maintaining a robust program with implemented controls for enhancing security posture and adherence to HITRUST.
Hence, if you’re on the path to HITRUST or new to it, the following will be applicable to you:
- HITRUST will now place a greater influence on implementation of controls
- It can potentially increase the number of Corrective Action Plans (CAPs) due to gaps in implementation.
- The increase in CAP’s in implementation would correspond with a decrease in the number of CAPs attributed to gaps in policies and procedures as well as an increase in the scores for managed & measured if implemented well.
- A greater emphasis will be placed on procedure in comparison to policy.
- HITRUST wants to ensure that SOPs are well documented, but more importantly, followed with workflows and ownership.
- Assessors and enterprises will now be able to objectively score each control using the Control Maturity Rubric.
- Managed now holds greater importance in comparison to measured.
The key takeaways are as follows:
1) Change in weightage
2) Updated HITRUST Control Maturity Rubric
4) Will the new scoring metrics impact already certified organizations?
Not yet, but it will play a role in re-certification. The metrics associated with the original assessment will be applicable for the interim assessment.
Due to the updated assessment guidelines, companies up for re-certification will be required to implement their CAPs associated with implementation. In turn, this will aid in increasing your implementation score, and, consequently, increase your scores for measured and managed.