What HITRUST reports contain, how to share them with customers, and how relying parties should read a vendor's HITRUST certification.
A guide to the parts of a HITRUST report and letter: scope and facilities, domain scores against thresholds, corrective action plans and gaps, the validated-only alternative, and the conditions under which a certification can be revoked.
How certified organizations share HITRUST results: the two letter versions, MyCSF Report Center access controls, the Results Distribution System for relying parties, report re-issuance limits, and when you may not claim certification.
What a relying party should check in a vendor's HITRUST certification: whether the scope covers the service it buys, carve-outs, assessment type and validity, validated-only results, suspension or revocation, and whether the assessor is authorized.
How health systems and other relying parties use HITRUST to manage vendor risk: Health3PT practices, digital delivery of results and CAP updates, harmonized coverage of other frameworks, and HITRUST's reported breach rates for certified environments.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.