New HITRUST Reservation System for Scheduling Quality Assurance of Validated Assessments

Blog Post by Brandon Weidemann, ITRM Senior Associate at Meditology Services

On April 15th 2021, HITRUST® announced a new reservation system for scheduling quality assurance for validated assessments. For all validated assessments submitted on or before June 30th 2021, HITRUST will continue to process on a first come, first served basis. Any assessments that will be submitted on or after July 1st 2021, will require Assessed Entities to schedule the start of quality assurance (QA) procedures within the HITRUST MyCSF® platform.

The reservation system has been introduced by HITRUST to eliminate the uncertainty around HITRUST QA timelines, allow assessed entities to schedule resources appropriately to respond to QA feedback, and to allow QA to start closer to the submission date.

The reservations for QA can be made in MyCSF any time prior to submission up to one year in advance. All assessed entities will be required to have purchased their Validated Assessment Report Credit prior to making a reservation.

HITRUST has made the reservations available via QA blocks. The QA blocks are one-week periods where HITRUST will begin their QA procedures on the assessment. Each QA block has a limited set of reservations available so HITRUST advises to make the reservation as possible. Within MyCSF, the assessed entity will be able to view the QA blocks that are available to reserve. HITRUST will be offering expedited reservations for QA blocks that may be displayed as not available. These expedited reservations also include priority processing of the assessment by HITRUST.

At the time of making the reservation, the assessed entity will also have to enter the submission date of the assessment to HITRUST in MyCSF. Failure to submit the assessment by the reservation date will result in the cancellation of the reservation, and will require the assessed entity to make a new reservation. Prior to completing the reservation, Assessed Entities will need to acknowledge the cancellation policy. The cancellation policy defines the final date that an assessed entity can modify or cancel the reservation without incurring a fee.

Once the Validated Assessment has been submitted to HITRUST, the assessed entity will receive confirmation from HITRUST that the assessment has been accepted if there were no feedback via the automated QA checks. If the assessment was returned by HITRUST, Meditology will work with all assessed entities to remediate and resubmit the assessment. It is important to note that the assessment must be resubmitted and accepted by HITRUST prior to the start of the QA block, or the reservation will be cancelled.

Based on this information, Meditology will be working closely with all assessed entities to ensure that a “make reservation” date is incorporated into the project plan. HITRUST has recommended that assessments are submitted in advance of their submission date as defined in the reservation to allow for any remediation and resubmission. Therefore, Meditology will be reviewing all project plans to provide the assessed entity the date they should submit as their submission date within MyCSF. HITRUST has recommended that assessments are submitted in advance of their submission date as defined in the reservation to allow for any remediation and resubmission.

Most Recent Posts
A Cybersecurity Professional's Guide to HIPAA-Compliant Online Tracking Read More
SOC 2 + HIPAA Examination Read More
Rise of Responsible AI Read More