HITRUST is a privately held company located in
Frisco,
Texas
Texas (, ; Spanish language, Spanish: ''Texas'', ''Tejas'') is a state in the South Central United States, South Central region of the United States. At 268,596 square miles (695,662 km2), and with more than 29.1 million residents in 2 ...
,
United States
The United States of America (U.S.A. or USA), commonly known as the United States (U.S. or US) or America, is a country primarily located in North America. It consists of 50 states, a federal district, five major unincorporated territorie ...
that, in collaboration with healthcare, technology and information security organizations, established the HITRUST CSF. The company claims CSF is a comprehensive, prescriptive, and certifiable framework, that can be used by all organizations that create, access, store or exchange sensitive and/or regulated data.
HITRUST originally served as an acronym for "Health Information Trust Alliance", but the company has since rebranded as simply HITRUST. HITRUST includes a for-profit division (HITRUST Services Corp) and a not-for-profit division (HITRUST Alliance).
The HITRUST CSF
The HITRUST CSF (created to stand for "Common Security Framework", since rebranded as simply the HITRUST CSF) is a prescriptive set of controls that meet the requirements of multiple regulations and standards.
The framework provides a way to comply with standards such as
ISO/IEC 27000-series and
HIPAA
The Health Insurance Portability and Accountability Act of 1996 (HIPAA or the Kennedy– Kassebaum Act) is a United States Act of Congress enacted by the 104th United States Congress and signed into law by President Bill Clinton on August 21, 19 ...
.
Since the HITRUST CSF incorporates various security, privacy, and other regulatory requirements from existing frameworks and standards, some organizations utilize this framework to demonstrate their security and compliance in a consistent and streamlined manner. Organizations can complete a self-assessment using the HITRUST framework, or they can engage with a HITRUST assessor for an external, third-party engagement.
HITRUST CSF has garnered criticism for being "cumbersome, expensive, arbitrary, unnecessarily complex", and using "outdated data".
Current version of CSF is v11, released in January 2023.
Executive Council
HITRUST is led by a management team and governed by an Executive Council made up of leaders from across a variety of industry. These leaders represent the governance of the organization, but other founders also comprise the leadership to ensure the framework meets the short- and long-term needs of the entire industry.
Executive Council members represent the following organizations:
*
Elevance Health, Inc.
*
Express Scripts, Inc.
*
Health Care Service Corporation
*
Highmark
*
Humana Inc.
*
IMS Health
IMS Health was an American company that provided information, services and technology for the healthcare industry. IMS stood for Intercontinental Medical Statistics. It was the largest vendor of U.S. physician prescribing data. IMS Health was fou ...
*
Kaiser Permanente
Kaiser Permanente (; KP), commonly known simply as Kaiser, is an American integrated managed care consortium, based in Oakland, California, United States, founded in 1945 by industrialist Henry J. Kaiser and physician Sidney Garfield. Kaiser P ...
*
McKesson Corporation
McKesson Corporation is an American company distributing pharmaceuticals and providing health information technology, medical supplies, and care management tools. The company delivers a third of all pharmaceuticals used in North America and emplo ...
*
UnitedHealth Group
References
{{reflist
https://privaxi.com/how-to-get-hitrust-certified/ How To Get HITRUST Certified?]
Hitrust Assessment
HITRUST Alliance Official website
Health information technology companies