HITRUST policy templates: policy, procedure, and implementation
Key Takeaways
- What does an r2 assessment evaluate besides a policy file?
- How does HITRUST say the controls are chosen?
- Does a template certify the organization?
What does an r2 assessment evaluate besides a policy file?
Policy, procedure, and implementation. HITRUST's public r2 page says the r2 assessment "evaluates policy, procedure, and implementation across a broader set of controls," and that it is fully risk-based and customizable. The same answer says r2 offers a higher level of assurance than the e1 and i1 assessments named there (HITRUST r2).
A template that describes controls the organization does not run is not that evaluation. This page does not certify anyone.
How does HITRUST say the controls are chosen?
By the organization's risk profile, systems, regulatory requirements, technology, business operations, and assessment scope (HITRUST r2). The page says to tailor control selection to those factors, and that controls are selected so the assessment focuses on what is relevant to that risk.
It also says the HITRUST CSF maps to many sources, including HIPAA and NIST, and that the public page names "60+" sources. This revision did not download the r2 data sheet or the CSF catalog. Those files are not restated here as a domain list.
Does a template certify the organization?
No. The page says the r2 certification is valid for two years (HITRUST r2), that an interim assessment is required after one year, and that a full assessment is required at the end of the two years to maintain status. A policy file is not that assessment. Related hosting scope, which is not a certification, is on managed hosting.
References
- HITRUST Alliance. HITRUST r2 assessment page. Evaluates policy, procedure, and implementation. Tailors controls to risk, systems, and regulatory requirements. Certification valid for two years, with an interim assessment after one year. https://hitrustalliance.net/assessments-and-certifications/r2
- Related page: managed hosting. Not a HITRUST certification.
The public r2 page read for this revision did not include a control-domain catalog. A 99.62 percent figure on that marketing page is HITRUST's own sentence. It was not remeasured here and is not used as a result.