How do you share HITRUST results with customers without oversharing?
When a customer or contract asks for proof of HITRUST certification, the certified organization answers with a certification letter, not the full report. HITRUST issues two letter versions for every certification: one that carries the scope of the assessment and one that carries only the letter. The certification report itself stays with the organization and is shared selectively, so each relying party receives only what its risk review needs. Your organization owns its certification, but only HITRUST, through the independent assessor process, issues the report and letter. Nobody else, including your consultant or readiness partner, can produce or reissue them. What you send depends on four things: the assessment type, the scope, who the relying parties are and whether they need scope detail or only confirmation of status. A customer buying a narrow service may need the scoped letter so it can confirm that the facilities and systems supporting that service are covered. A customer who only needs to know that a certification is current may be satisfied with the letter alone. Before you send anything, check the scope against the service being bought, because a letter that omits the relevant facilities can create a false impression of coverage. Ask the customer which scope they need in writing, and record what you shared. Within your own organization, use the Report Center in MyCSF to control who can access reports, and assign access by role rather than by individual request. For larger relying-party populations, confirm with HITRUST whether the Results Distribution System fits your sharing process, since it delivers HITRUST-signed results electronically and can integrate with GRC and vendor risk platforms. Confirm the details of each option directly with HITRUST before you commit to a process.
Which letter version goes to which relying party?
Some relying parties need to know exactly what was assessed before they rely on your certification. A customer buying a hosted service that processes its data will usually ask which systems, facilities, platforms and locations sit inside the assessed scope, and whether any services were carved out. For that audience, the version of the letter that includes the assessment scope is the one that answers the question. Send it when the contract or the customer's third-party risk review requires scope-level detail, and send it only to the people who will evaluate that detail.
- Scope and facilities: The scope version identifies the systems, facilities and business units covered by the assessment.
- Carve-outs: Any excluded services or inherited controls appear here, which is often the first thing a reviewer checks.
- Assessment type: The scope version shows which HITRUST assessment the certification rests on, so the reader can confirm the level matches the contract.
- Named recipients: Limit distribution to the contract owner, security reviewer or risk team that needs to evaluate scope.
- Contract alignment: Compare the scope against the services and locations the customer actually buys before sending anything.
Before you send the scope version, confirm the current handling rules in the HITRUST Assessment Handbook, since they govern how certification materials are distributed.
Many relying parties only need to confirm that a certification is in force. An internal procurement team tracking vendor status, or a customer whose policy asks for proof of certification and nothing more, does not need your system inventory or carve-out analysis. For these recipients, the letter-only version confirms the certification without exposing the assessed environment. It is the default for general-purpose confirmation requests unless the contract says otherwise.
- Confirmation only: The letter-only version states the certification and its validity without the detailed scope.
- Limited exposure: It keeps system names, facility locations and carve-outs out of circulation.
- Routine requests: Use it for procurement questionnaires, renewal confirmations and vendor onboarding checks that ask only for status.
- Tracking expiry: Record the validity dates so each confirmation you send matches the certification in force.
- Escalation path: If the recipient later asks for scope, send the scope version under the same controls rather than sending it on request from an unknown contact.
Before sending a letter-only copy, confirm the recipient's request matches what the letter states, since a confirmation that does not match the contract can create its own dispute.
The scope version is the more sensitive of the two documents, so it deserves a check before it leaves your organization. Scope language in the certification can differ from the service description in a customer contract, particularly when the contract covers a product line, region or subsidiary that was not named in the assessment. Sending a scope version that does not match the contracted service invites questions you may not be able to answer, and it can also expose systems that the customer has no need to know about.
- Service match: Confirm that every service the customer buys appears in the scope, not only the product name.
- Gaps in coverage: Identify any contracted service that is missing or carved out, and decide how you will explain it.
- Exposure review: Remove nothing from the document itself, but check whether the detail goes beyond what the contract needs.
- Version and date: Confirm the scope version is the current certification and not a superseded one.
- Approval record: Keep a record of who approved sending the scope version and to whom.
Before sending, check the scope against the contract and confirm the current handling rules in the Assessment Handbook.
The distribution rules for the two letter versions come from the HITRUST Assessment Handbook, and they are the authority your internal procedure should follow. A short internal standard that names the two versions, the default recipient for each and the approval step will prevent most mistakes. Review the Handbook each time a new version is published, because the rules on distribution and reissuance can change.
- Source of truth: Use the Handbook, not secondhand summaries, as the reference for what each letter contains.
- Written procedure: Document who may request each version, who approves it and how it is delivered.
- Version tracking: Note which Handbook version your procedure was written against.
- Recipient log: Record each recipient, the version sent and the date, so you can answer a later audit question.
- Periodic review: Revisit the procedure when your certification is renewed or your scope changes.
Before relying on this procedure, confirm current handling rules in the HITRUST Assessment Handbook with your assessor or HITRUST directly.
How MyCSF Report Center access controls keep results contained
The certified organization controls who can see its HITRUST reports, and it does that inside MyCSF. MyCSF is HITRUST's SaaS platform for managing assessments, and its Report Center is where administrators decide which users can open or receive assessment reports. Before the first report is issued, the organization should decide who holds an administrator role in its MyCSF account, how many people hold it, and who approves any change. Named administrators, rather than a shared login, make it possible to trace every grant and removal back to a person. Confirm with HITRUST which administrator roles exist in your MyCSF tenant and what each one can do, since the exact role names and permissions should come from the platform itself, not from this page.
Least privilege is the practical test. Compliance staff who prepare evidence and respond to assessor requests usually need working access to the assessment, while sales and account teams usually need only the letter that answers a customer's question. Give each group the narrowest access that lets it do its job, and keep the decision in a written access procedure that names the owner of each role, the approval step and the reason for each grant. DeployOpen can help define that internal access process and the documentation that supports it, including how requests are logged and who signs off, but the organization administers its own MyCSF account and remains responsible for every grant it makes.
Access rights go stale quickly, so set a review cadence and run it. Pick an interval that fits your change rate, usually quarterly for administrators and at least as often for anyone with report access, and compare the MyCSF user list against current employment and contract status. Remove access when people change roles or leave, and record each review with the date, the reviewer and the changes made. Assessors and customers' third-party risk teams tend to ask for this trail, so keep it with the assessment file. Before you rely on any of these steps, check the Report Center documentation in HITRUST MyCSF against the version your account uses.
How the Results Distribution System delivers results to relying parties
The Results Distribution System replaces PDF and email hand-offs with a controlled, HITRUST-signed delivery path, so each relying party receives the results it is authorized to see and the certified entity keeps a traceable record of who received what.
Confirm the certification and the relying party
The certified entity confirms that its HITRUST result is current, that the assessment type and scope match what the relying party needs, and that the recipient has a legitimate reason to receive it. Your compliance or GRC lead usually owns this check, with input from the account or contract owner who knows which customer asked for the report. The output is a short internal record naming the relying party, the assessment and the scope to be shared. Confirm with HITRUST how the entity and its relying parties are set up on the platform, since onboarding steps and any fees are not covered here.
Grant the relying party access
The certified entity grants the relying party access to its results through the Results Distribution System rather than attaching a file to an email. Access is set up from the entity's side, so the entity decides which organization can see which result. The output is an access grant that the relying party can see on its own account, tied to the specific certification. Confirm with HITRUST what the invitation process looks like and whether the relying party needs its own account before access takes effect.
Deliver HITRUST-signed results through the platform
HITRUST delivers the signed assessment results to the relying party through the API-enabled platform. Because the results come from HITRUST rather than from the entity, the relying party receives a version that carries HITRUST's signature and does not depend on a copy that someone forwarded. The output is a delivered result that the relying party can open and review inside the platform. Check that the copy you deliver matches the scope you agreed to share, because the platform delivers what the grant covers.
Route results into the relying party's risk tools
The relying party connects the Results Distribution System to its GRC or vendor risk platform, such as ServiceNow, so that the result arrives as a record in its existing vendor assessment workflow. This step depends on the relying party's own integration work, which it plans and funds. The output is a vendor record in the relying party's risk platform that links to the HITRUST result, so analysts review the certification where they already track findings. Confirm with HITRUST which integrations are supported today and who configures them.
Record the delivery and limit extra copies
Each delivery through the platform leaves a traceable record of who received the results and when, which replaces the scattered attachments that accumulate in inboxes and shared drives. The certified entity should tell its teams to point new requests to the platform rather than resending files. The output is a reduced copy trail that your team can show to an auditor or customer. Remove any older PDFs from circulation once the platform copy is in place, and keep the certification letter and report version history that your own records require.
Track changes and access over time
When a certification is renewed, when an interim assessment is completed or when the scope changes, the entity updates the access and results that relying parties see, and removes access for organizations that no longer need it. Account owners and the compliance lead review the list of relying parties on a schedule their own policy sets. The output is a current access list that matches the active certification and the contracts that depend on it. Confirm with HITRUST how results are updated for relying parties after a renewal or a change in status.
When HITRUST will re-issue a final report, and when it will not
HITRUST re-issues a final report only by approved exception, and the window is short. Each card below covers one condition or limit that determines whether a request will succeed, so plan before the customer asks.
Exception-only re-issuance
HITRUST does not re-issue final reports on request. A re-issue happens only when HITRUST approves an exception, so a missing copy in your contract file is not, by itself, grounds for a new report. Ask whether your situation fits an exception before you tell a customer that a copy is coming. Treat re-issuance as a discretionary decision that HITRUST controls.
Six-month window from issue
Any re-issue request must fall within six months of the date the final report was issued. After that point, the request is generally not available, even when the underlying assessment was sound. Record the issue date when you receive the report, and calendar the window's end so a customer request does not arrive after it closes.
Possible cost for re-issue
Where HITRUST approves a re-issue, it may charge for it. Ask HITRUST or your assessor for the fee before you commit to a timeline, and build it into the cost of responding to a customer request. Compare that cost against the effort of a new validated assessment, which is a much larger undertaking, and use the lower-cost path when it fits the exception.
Name change alone may not qualify
A change to your company name does not automatically justify a new report. HITRUST assesses whether the legal entity, scope and facts underlying the report still hold. If you have changed your name, confirm with HITRUST whether a re-issue is possible, and prepare a short explanation of what changed and what did not, including the scope, facilities and systems covered.
Keep the original letter and scope
Your original certification report, plus the letter with scope and the letter without scope, are the documents you will need if a customer or regulator questions a claim. Store them in a controlled repository with the issue date, certificate validity dates and scope statement. A re-issue is unlikely to replace a lost original, so the file you keep today is the record you rely on later.
Re-issue changes no scores or evidence
A re-issued report reproduces the original result. It does not change domain scores, add new evidence or correct findings from the assessment. If a customer expects an updated score or wants a control reconsidered, a re-issue will not provide it, and you will need a new validated assessment or an approved route through HITRUST. Set that expectation early in the conversation.
Why the 30-day draft review matters before results go out
After the assessor's work passes HITRUST's quality assurance, the certified entity receives draft reports and has 30 days to review them. This is the last point at which the organization can correct the record, and the window closes faster than most teams expect. At this stage the scope, the factors and the scores cannot be changed, and HITRUST does not accept new evidence. Any gap you find in the draft must be handled through the process HITRUST defines, not by adding documents to the file. Drafts you do not act on within the 30 days are approved automatically, so a silent inbox is a decision in itself.
Because of that, the sharing plan should exist before the draft arrives. Decide who in legal, compliance, security and account management reviews the draft, who signs off on scope and facility wording, and who confirms that the scope matches the services customers actually buy. Confirm with your assessor which items are open for review and how to raise a factual error. Also decide in advance which of the two letter versions goes to which audience, since the scoped letter and the letter without scope serve different relying parties. Check the review calendar against the assessor's and HITRUST's dates so the 30 days are not lost to a holiday or a single approver.
DeployOpen can prepare the evidence binders, control owner walkthroughs and internal review checklists that your team uses during this window, and it can help you trace each question back to the supporting artifacts. It does not edit, reissue or alter HITRUST-issued reports, and it does not decide on the assessor's behalf what the draft says. Ask your assessor and HITRUST to confirm the review timetable in writing for your engagement.
When you may not claim HITRUST certification
A HITRUST certification is conditional. It can be suspended or revoked, and it expires on a fixed schedule. Each card below describes one condition that ends the right to say an organization is certified, and what a sharing team should check before it sends a letter or lets a customer inherit results.
Suspension after a score drop
If an event shows that domain scores fell below the certification thresholds, HITRUST may suspend or revoke the certification. The trigger is the scores themselves, not the passage of time, so a change in the environment can end a certification before its validity period runs out. Before sharing results, confirm with HITRUST that no open event affects the certified scope.
No inheritance or certification claims while suspended
A suspended entity may not allow inheritance of its results and may not say it is certified. Customers who rely on an inherited control, and sales material that repeats the claim, both have to stop until the status is restored. Check every outbound channel, including questionnaires, trust pages and contract language, for the word certified during a suspension.
Wait after revocation
After a revocation, the entity may start a new validated assessment 90 days after remediation. That wait is a minimum before a new assessment can begin, not a period of certified status. Plan customer communications and renewal dates around this gap, and do not promise a recertification date to a customer before the assessor has scheduled the work.
Expired validity periods
An e1 or i1 certification lasts one year, and an r2 certification lasts two years with an interim assessment due in the 90 days before the first anniversary. A letter that is past its validity date no longer supports a claim, even if nothing has changed in the environment. Track each letter's expiry date in your contract register and set reminders well before the interim window opens.
Describing an e1 or i1 as stronger
An e1 or i1 certification covers a smaller requirement baseline than an r2, and it should be described as the level it is. Calling an e1 or i1 equivalent to an r2, or implying that it covers the full CSF, overstates the result. Name the assessment type in every letter reference and check that the scope and the assessment type match what the customer asked to see.
Who owns each sharing decision
Sharing a HITRUST result touches four parties, and each owns a different decision. The certified organization decides who receives what, the implementation partner prepares the procedures and evidence behind those decisions, and the independent assessor and HITRUST issue the signed documents. Knowing where each role stops keeps a sharing process defensible.
Certified organization decides recipients
The certified organization decides which relying party receives the full report with scope and which receives only the letter. It also controls who holds MyCSF access and who can view reports in the Report Center. Before sharing, confirm that each recipient's contract or request needs the scope it is getting, and record who approved each release. Access granted to a staff member who has left, or to a broader group than the contract requires, is a common gap to check.
Implementation partner prepares procedures
An implementation partner can help write the internal sharing procedure, define which letter goes to which audience, and assemble an evidence pack that explains the scope, the facilities covered and the carve-outs. It can also prepare the team that answers relying party questions. The partner does not issue reports, change scores or decide what a letter says. Ask for the procedure in writing and confirm who in your organization signs off on it.
Assessor and HITRUST issue documents
Only an authorized external assessor performs the validated assessment, and HITRUST performs quality assurance before issuing the report and letter. Neither the organization nor its consultant can alter the signed output. During the draft review window, the organization may check scope and factual accuracy, but it cannot change scores or add new evidence. Confirm that the assessor is on HITRUST's authorized list before you rely on any issued document.
Relying party reviews against contract
The relying party decides whether the received certification fits its own requirements. It should compare the report scope with the service it buys, confirm the certification is current, and check whether any inheritance or carve-out limits its risk coverage. The relying party should request results through the channel the organization has approved, rather than relying on copies forwarded by third parties. Record the review against the contract so that the decision can be audited later.
Questions customers ask about sharing HITRUST results
Can we send our full HITRUST report to every customer?
No. A certified entity normally sends only what each relying party needs. HITRUST issues the certification report together with two copies of the certification letter: one letter that includes the assessment scope, and one letter that carries only the certification statement. The scoped letter goes to parties who need to confirm what was assessed, and the plain letter suffices for parties who only need to confirm that a certification exists. The full report is shared selectively, under your own confidentiality terms, with customers who have a documented need for it. Before you share anything, confirm the scope covers the service the customer buys, and confirm the certification is still in force, since a suspended certification cannot be presented as current.
How long does it take to get a final HITRUST report re-issued?
HITRUST re-issues final reports only by approved exception, and only within six months of the original issue date. A re-issuance may carry a cost, so confirm the fee with HITRUST before you request one. A change of company name on its own does not necessarily qualify, so ask HITRUST whether your situation is eligible before you plan around it. Because the outcome depends on an exception decision, do not assume a turnaround time. Build the request into your customer timelines early, and keep copies of issued reports in your own controlled repository in case a customer needs one after the six-month window closes.
Can our sales team send the HITRUST letter to prospects?
Yes, but only the plain letter, and only under a process your compliance team controls. The letter that includes the scope is more sensitive because it describes what was assessed, and it should go to parties with a documented reason to see it. Sales staff should not forward reports, edit letters, or describe the certification in terms broader than the letter states. Set up a request path where sales raises the need, compliance checks the requester and the scope, and the approved document is sent from a controlled location. Access to the MyCSF Report Center should be limited to named administrators, not sales staff.
What must we check before a customer receives HITRUST results?
Check four things before release. First, confirm the scope covers the service the customer is buying, since a certification covers only the environments and services in its scope. Second, confirm the assessment type and validity dates, so you do not present an expired or superseded certification. Third, confirm the certification has not been suspended or revoked, because while suspended you may not allow inheritance or claim certification. Fourth, confirm the letter version matches the recipient: scoped for parties who need scope, plain for parties who only need confirmation. Record who approved each release. If a customer will receive results through HITRUST's Results Distribution System, confirm that access and recipient details are set correctly in the platform.
Can we share HITRUST results with customers ourselves, without outside help?
Yes. Sharing results is an administrative task that your own team can run once the certification exists, and it does not require an implementation partner. What you need is a named owner, a documented release procedure, administrator-only access to the MyCSF Report Center, and a clear rule for which letter goes to which requester. The harder work sits upstream: getting the scope right, keeping the certification current, and handling re-issuance requests. Outside help is usually considered when a team lacks capacity for that workload, or when the certification will be shared through several channels at once. DeployOpen does not issue reports or certifications, so any certification itself comes from an authorized HITRUST External Assessor and HITRUST.
What does outside help for sharing HITRUST results cost?
DeployOpen does not publish a price list. A quote follows from a written scope that names the systems involved, the sharing channels to set up, the access model for the Report Center, and any integration with your GRC or vendor risk platforms. Costs that sit outside any partner fee include HITRUST's own charges, such as any re-issuance fee and any RDS access charges, which you must confirm directly with HITRUST. Fixed-scope work is agreed in writing before it starts, and ongoing support or upgrades can be arranged as a separate retainer. Ask any provider to state which costs are one-time setup and which recur.
How DeployOpen prepares sharing controls and evidence
DeployOpen starts by agreeing in writing which HITRUST outputs the organization will share, with whom, and through which channel. That scoping step covers the certification report, the letter with scope and the letter without scope, and whether relying parties will receive results through the Results Distribution System or through a controlled download from MyCSF. DeployOpen then documents the MyCSF Report Center access procedure: who the administrators are, how user accounts are requested and removed, which roles may view or download reports, and how access reviews are recorded. The organization decides these roles and owns the resulting access list. DeployOpen does not issue reports, letters or certificates, does not guarantee any assessment result, and does not act as the certified entity or the independent assessor. Those roles stay with the organization and its Authorized HITRUST External Assessor.
The evidence pack is the core deliverable. It typically holds the access procedure, a register of issued documents with their versions and recipients, a mapping of each relying party's request to the letter version it is entitled to receive, and records of who approved each release. DeployOpen also prepares an internal review checklist that a second person runs before any document leaves the organization. The checklist asks whether the scope in the outgoing package matches the service the recipient buys, whether the letter version is correct, whether the report is inside the period the entity controls, and whether any suspension or revocation event affects what may be said about certification. Confirm with your assessor which draft review steps and deadlines apply to your own timeline before you finalize the checklist.
DeployOpen hands over written procedures the organization can run without outside help: the sharing procedure, the access review routine, the release checklist and a short guide for account managers who answer vendor questionnaires. Ask for a written scope that names each procedure, each deliverable and each role, and confirm that your legal and compliance teams approve the wording of any statement about certification before it goes to customers. Plan for re-issuance requests, which are limited, and for the periodic review of who still holds access, which recurs for as long as the certification is relied on.
