The Timeline for HITRUST CSF v11
Famed poet Ralph Waldo Emerson said, “every sunset brings the promise of a new dawn.”
Although in the case of HITRUST CSF v11, it’s working a little bit in reverse—the updated framework has dawned already, as of January 18, 2023, and now it’s time to sunset the previous versions from their use in assessments and HITRUST certifications.
There are plenty of changes in v11 organizations engaged with HITRUST will need to familiarize themselves with, but it will also be important to confirm when the framework version you’re currently using—or may have planned on using—will be “sunsetted” for v11.
As HITRUST assessors ourselves, these timelines are significant for us to know as well, so in this article, we’ll provide an overview of the deadlines for the phasing out of alternate CSF versions as we understand them right now.
Emerson’s promised “new dawn” is here—read on to understand when these changes will take place so that you can better prepare for the transition to v11.
When Will Support for HITRUST CSF v9 End?
According to HAA 2021-005, HITRUST will soon sunset maintenance support for library versions v9.1 through v9.4. Here’s what we know now about the details:
- CSF Versioning Policy will no longer be provided for these versions.
- However, HITRUST will continue to address any questions related to these library versions via support tickets until they are removed from HITRUST’s proprietary tool (MyCSF) on March 31, 2026.
- All assessments using v9.1 – v9.4 will remain in MyCSF, allowing organizations to reference them as needed.
We can break down how all this concerns the different HITRUST assessments with more specific dates.
HITRUST i1 Assessment v11 Important Dates
i1 assessments appear to be making the hard transition first:
March 31, 2023
What Will Happen: HITRUST will disable your ability to create new v9.6.2 i1 assessment objects.
What It Means: All new i1 assessment objects created on or after March 30, 2023, must be created using HITRUST CSF v9.6.3 or later.
June 30, 2023
What Will Happen: HITRUST will disable your ability to submit v9.6.2 and earlier assessment objects.
What It Means: The QA Reservation system will not allow the selection of a submission date after June 30, 2023, for i1 assessments using v9.6.2 or earlier, so organizations will need to submit ahead of that date.
HITRUST r2 Assessment v11 Important Dates
That being said, there’s a little more time to squeeze out regarding r2 assessments:
September 30, 2023
What Will Happen: HITRUST will disable your ability to create new assessment objects using library versions v9.1 through v9.4.
What It Means: All new r2 assessment objects created on or after September 30, 2023, must be created using HITRUST CSF v9.5.x or later.
December 31, 2024
What Will Happen: HITRUST will disable your ability to submit v9.1 through v9.4 r2 assessment objects to them for report processing.
What It Means: The QA Reservation system will not allow the selection of a submission date after December 31, 2024, for assessments using v9.1 through v9.4.
Any unsubmitted assessments using these versions will be marked with a MyCSF banner indicating that they cannot be submitted to HITRUST for processing, so organizations planning on achieving HITRUST certification will need to submit your assessment ahead of that date.
With all this being said about v9.1-9.4, we understand that versions 9.5 and 9.6 will continue to be available for use in r2 assessments for the time being, with no similar sunset timeline on the horizon.
As the r2 is the flagship standard for HITRUST, if your organization is one of those that was planning to have one of those assessments performed against the CSF v9.1 – 9.4, now you know that the object needs to be created before the end of September 2023 if you’re to stay on that course successfully.
Should you get that done, you’ll also need to retain that object and not upgrade to a more current version so as to ensure you can still apply for HITRUST certification under v9.1 – 9.4. But again, you’ll need to work with your HITRUST Assessor to get your package submitted by the end of December 2024.
Transitioning to HITRUST CSF v11
A new dawn for HITRUST has arrived, and with it comes the sunset of previous versions of its CSF.
With proper planning, you still have time to make sure the version you intend to submit for certification remains the version that you actually do submit for certification. As you get orientated in your transition, please also take care in changing your assessment object, as once your assessment object is changed to a newer version at any time, it cannot be changed back. As such, we caution you to be sure when changing that you’re sure you’re switching to the correct version you need.
Even before this new version, HITRUST CSF was a complex framework—as you reshape your approach now with these key deadlines in mind, make sure to also read our other content on this compliance option so that you can further simplify your experience:
- HITRUST: The Effect of TEFCA
- How to Prepare Your Service Providers for HITRUST Certification
- How to Scope Your HITRUST Assessment: 5 Components to Consider
About Andrew Sullivan
Andrew Sullivan is a Senior Associate with Schellman. Prior to joining Schellman in 2019, Andrew worked as a Senior Associate at a Big 4 audit firm specializing in SOX audits from an IT perspective. As a Senior Associate with Schellman, Andrew Sullivan is focused primarily on SOC 1 and SOC 2 audits for organizations and across various industries.