The Schellman Blog

On May 7, 2026, HITRUST announced the release of CSF version 11.8.0. The HITRUST Common Security Framework (CSF) has become a cornerstone compliance standard for organizations across healthcare, financial services, and other regulated industries. By consolidating requirements from multiple frameworks like HIPAA, HITECH, and ISO 27001, HITRUST CSF provides a unified, risk-based approach to security and compliance that many organizations have built their entire control environments around.

Being HIPAA-compliant means that a healthcare provider has adequate measures in place to protect patient data. In recent years, there has been an alarming growth in the number of data breaches targeting the healthcare industry, and more breaches have meant more (and more serious) consequences for the affected provider.

Though HITRUST released v11 of the HITRUST CSF back in January 2023, as of April 16, 2024, HITRUST released CSF v11.3. Standard practice is for HITRUST to update their CSF annually—at a minimum—and this v11.3 is a relatively minor revision with two main differences:

American journalist Sydney J. Harris once said that “the two words 'information' and 'communication' are often used interchangeably, but they signify quite different things. Information is giving out; communication is getting through.”

If you don’t already play, a basic game of darts starts you with a sum of points. The idea is to hit spots on the board worth more points that you’ll subtract from your starting total, with the bullseye being worth the biggest deduction. The player who reaches zero first wins.