During an interim assessment for r2 certifications, only a subset of Requirement Statements is retested. This sample is not determined manually by assessors or clients but is systematically generated by MyCSF. The tool ensures randomness and fairness while including mandatory items such as:

Requirement Statements with open gaps from the prior validated assessment.

Requirement Statements with active Corrective Action Plans (CAPs).

A random selection of additional requirements to confirm continued control performance.

This approach balances efficiency and assurance. It ensures that areas of previously identified weakness are re-examined while still sampling across the broader control set. By automating sample selection, HITRUST prevents bias and ensures consistency across interim reviews.

Testing of HITRUST CSF requirements follows structured assurance procedures. It includes:

Interviewing personnel to validate understanding and confirm processes.

Sampling populations to ensure controls operate consistently.

Examining documentation such as policies, logs, and records.

Testing the technical implementation to verify system configurations and operational effectiveness.

“Remediating deficient controls” is not part of the testing process itself; it comes afterward as part of remediation.

Extract Reference (HITRUST CSF Assurance Program, CCSFP Training Guide):

Testing involves interviews, examination of documentation, inspection of technical implementations, and sampling populations to assess control design and operating effectiveness.

When performing HITRUST scoping, organizations must include regulatory factors relevant to their operational and geographic context. Since this entity operates in Massachusetts and Nevada, two state-specific privacy and security laws apply:

Massachusetts Data Protection Act (201 CMR 17.00): Requires businesses handling personal data of Massachusetts residents to maintain a written information security program (WISP), including encryption and monitoring controls.

Nevada Security of Personal Information Law (NRS 603A): Mandates encryption for personal information stored or transmitted electronically and requires reasonable security measures.

The CMS Minimum Security Requirements (High) (B) would apply only if the entity processes Medicare/Medicaid-related data. The Texas Health and Safety Code (D) applies only to Texas-based covered entities. Subject to De-ID Requirements (E) is a general data-handling condition, not a state-specific regulatory factor.

Therefore, only Massachusetts Data Protection Act and Nevada Security of Personal Information Requirements apply in this scenario.

When relying on third-party reports (such as SOC 2 reports) to satisfy HITRUST requirements, only reports with sufficient detail can be used. HITRUST requires:

A clear description of scope (A) to confirm applicability to the assessed environment.

A list of procedures performed (C) so assessors can evaluate whether testing covered relevant controls.

Conclusions reached for each test (E) to provide assurance about the effectiveness of tested controls.

While an executive summary may be helpful for context, it lacks sufficient detail to serve as valid reliance evidence. Similarly, “completed remediation” of exceptions (B) is not required; rather, the report must document exceptions transparently. Assessors remain responsible for verifying that reliance reports are current, relevant, and issued by qualified independent auditors.

The Interim Assessment (required at the 1-year mark during a 2-year r2 Certification period) ensures continued compliance. It does not retest all Requirement Statements from the initial assessment. Instead, it involves:

Testing all CAPs from the original validated assessment.

Confirming no significant changes occurred in the in-scope environment.

Testing a random sampling of Requirement Statements, as chosen by the MyCSF tool, to confirm continued adherence.

Completing assessor assertions to verify compliance status.

Extract Reference (CCSFP Study Guide, Interim Assessment Requirements [0046]):

Interim Assessments focus on testing CAPs, environmental change confirmation, assessor assertions, and a sample of Requirement Statements; full retesting of all controls is not required.

Fully Compliant = 100

Mostly Compliant = 75

Partially Compliant = 50

Somewhat Compliant = 25

Non-Compliant = 0

HITRUST assigns specific numeric values to compliance categories within the scoring rubric to standardize assessments. These categories translate qualitative assessments into quantitative scores:

Fully Compliant (100): All criteria met with complete and verified evidence.

Mostly Compliant (75): Most criteria met; minor gaps exist.

Partially Compliant (50): Roughly half of the evaluative elements are met.

Somewhat Compliant (25): Only a small fraction of the evaluative elements are satisfied.

Non-Compliant (0): No evidence of compliance.

These values are applied at the Requirement Statement level and then averaged upward into Control Reference and Domain scores. This quantification ensures consistency and supports certification thresholds such as the domain-level requirement of 71 for r2 certification.

HITRUST’s risk-based approach includes incorporating regulatory factors relevant to an organization’s geographic and operational footprint:

Texas Health and Safety Code → Applicable since the hospital operates in Texas.

Massachusetts Data Protection Act → Applicable since the hospital operates in Massachusetts.

PCI-DSS → Required because the hospital processes credit card data.

Singapore Personal Data Act → Not applicable (hospital does not operate in Singapore).

Nevada Security of Personal Information Requirements → Not applicable (no presence in Nevada).

Extract Reference (HITRUST CSF Scoping & Tailoring Guidance [0013]):

Regulatory factors are selected based on where the organization operates and the type of data processed. For organizations in Texas and Massachusetts handling credit card data, applicable factors include Texas Health and Safety Code, Massachusetts Data Protection Act, and PCI-DSS.