Communication issued March 16, 2020

Over the past week, the global spread of COVID-19 has become a pandemic, spurring travel restrictions, quarantine measures, and cancellations of major events. HITRUST joins the many other institutions that are rescheduling events to protect the health and safety of attendees as well as support the broader public effort to slow the spread of the virus.

We understand the importance of business continuity and have always operated our core functions with that in mind. Customers and partners can rest assured that while we all navigate together through this uncharted territory, HITRUST has implemented plans to enable business functions to operate as usual, including sales, support, assurance, compliance, and Academy. We are also updating impacted policies and programs to accommodate circumstances created as a result of COVID-19:

HITRUST recently issued an Assurance Advisory temporarily waiving the requirement that in-person/on-site validation procedures be performed at the assessed entity’s facilities relating to a HITRUST CSF Validation. Additionally, HITRUST acknowledges that the ability to consistently adhere to timing-related HITRUST CSF Assurance Program requirements may be impacted by the ongoing spread of COVID-19.

While we have waived the External Assessor’s on-site fieldwork requirement, we are not universally waiving HITRUST CSF Assurance Program timing requirements, as doing so goes against the overall integrity of the HITRUST CSF Assurance Program and the Rely-Ability of HITRUST CSF Assessment Reports. However, HITRUST may issue discretionary, limited modifications to these timing requirements to impacted organizations. Please see HITRUST CSF Assurance Advisories HAA 2020-001 and HAA 2020-002 for further information.

For those organizations that may be delayed in obtaining a HITRUST CSF Validated Assessment or Certification, or whose HITRUST CSF Certification will expire over these exigent circumstances introduced by COVID-19, we encourage you to engage with your internal stakeholders and external partners to discuss the situation and ask for an extension.

Effective immediately, HITRUST Academy will hold all training sessions virtually through September 2020. Regarding our scheduled training events beyond September, we will continue to monitor the situation and update you on our Academy decisions as they occur.

In addition, HITRUST COLLABORATE 2020, our in-person conference that was initially scheduled for May, will no longer take place at that time. We are evaluating our options for an optimal conference experience in the future.

For those of you who have registered for or had otherwise intended to participate in HITRUST COLLABORATE 2020, please expect an email from HITRUST within the next ten business days with details. For individuals who are registered for a HITRUST Academy on-site course, we intend to hold courses on the same training weeks, although the virtual classes will be spread over more days that week. In addition, we will be adding more classes to the Academy schedule to allow others to participate in virtual classes. We intend to publish an updated schedule with further instructions within the next three business days.

As circumstances continue to change, HITRUST is prepared to alter our procedures and planning. Our goal is, and will continue to be, to provide uninterrupted services and a safe environment for all of our employees, customers, and the communities in which we live.