HITRUST Common Security Framework

The HITRUST Common Security Framework (HITRUST CSF®) is a certifiable framework developed by the Health Information Trust Alliance (HITRUST®) in collaboration with privacy, information security, and risk management leaders from public and private sectors. HITRUST is a privately held company, located in the United States.

The HITRUST CSF is the foundation of all HITRUST programs and tools. It aims to address the multitude of security, privacy, and regulatory challenges facing organizations. The HITRUST CSF provides organizations with a comprehensive, flexible, and efficient approach to regulatory compliance and risk management. It is both risk and compliance-based and offers an industry-wide approach for managing third-party vendors, including management of business associates and other data processors.

The HITRUST CSF rationalizes relevant regulations and standards into a single overarching information risk management framework with structure, clarity, functionality, and cross-references to authoritative sources. It allows organizations to tailor information protection control baselines based on the organization type, size, systems, and regulatory requirements. Through the risk-based approach, HITRUST CSF also offers multiple levels of implementation requirements determined by specific risk thresholds.

The HITRUST CSF is based on state, federal, and international standards including:

• International Organization for Standardization (ISO)

• National Institute of Standards and Technology (NIST)

• Payment Card Industry Security Standards Council (PCI SSC)

• General Data Protection Regulation (Regulation (EU) 2016/279) (GDPR)

• California Consumer Privacy Act of 2018 (CCPA)

• Health Insurance Portability and Accountability Act 1996 (HIPAA)

By normalizing the requirements under these standards, the HITRUST CSF provides clarity and consistency for the compliance and review of best practices, reducing the burden organizations needing to harmonize these requirements individually. HITRUST continues to update the HITRUST CSF when new regulations and security risks are introduced. Revisions are made, at minimum, an annual basis.

HITRUST CSF license holders can build and maintain their programs with OneTrust. The required risk management can be handled by the IT & Security Risk Management module with a robust and configurable risk and control library that includes agile workflow functionality. Vendor risk can be handled within Third-Party Risk Management which includes intelligent workflow automation to streamline vendor onboarding and evaluation. Go a step further and leverage the shared vendor risk assessments and aggregated research on thousands of vendors in the Cyber Risk Exchange.

At times, planning your program and addressing your risk requires a little research. DataGuidance® Research allows teams to search news on guidance, laws, regulations, decisions, and case law to find relevant content for each function as well as create customized email alerts and newsletters so you and your team can stay up to date on breaking developments in your areas of interest. The Training module can save you time by ensuring you equip your staff with knowledge to ensure consistent practices that meet your program requirements.

Finally, if things do go wrong, the Incident Management module has context-aware automated workflows to rapidly respond to incidents and enhance breach notification decision-making. With a database of 300+ breach laws and notification guidance built-in, your company will respond sooner and with more confidence.