The Timeline for HITRUST CSF v11

Famed poet Ralph Waldo Emerson said, “every sunset brings the promise of a new dawn.”

Although in the case of HITRUST CSF v11, it’s working a little bit in reverse—the updated framework has dawned already, as of January 18, 2023, and now it’s time to sunset the previous versions from their use in assessments and HITRUST certifications.

There are plenty of changes in v11 organizations engaged with HITRUST will need to familiarize themselves with, but it will also be important to confirm when the framework version you’re currently using—or may have planned on using—will be “sunsetted” for v11.

As HITRUST assessors ourselves, these timelines are significant for us to know as well, so in this article, we’ll provide an overview of the deadlines for the phasing out of alternate CSF versions as we understand them right now.

Emerson’s promised “new dawn” is here—read on to understand when these changes will take place so that you can better prepare for the transition to v11.

When Will Support for HITRUST CSF v9 End?

According to HAA 2021-005, HITRUST will soon sunset maintenance support for library versions v9.1 through v9.4. Here’s what we know now about the details:

• CSF Versioning Policy will no longer be provided for these versions.
  • However, HITRUST will continue to address any questions related to these library versions via support tickets until they are removed from HITRUST’s proprietary tool (MyCSF) on March 31, 2026.
• All assessments using v9.1 – v9.4 will remain in MyCSF, allowing organizations to reference them as needed.

We can break down how all this concerns the different HITRUST assessments with more specific dates.

HITRUST i1 Assessment v11 Important Dates

i1 assessments appear to be making the hard transition first:

HITRUST r2 Assessment v11 Important Dates

That being said, there’s a little more time to squeeze out regarding r2 assessments:

 With all this being said about v9.1-9.4, we understand that versions 9.5 and 9.6 will continue to be available for use in r2 assessments for the time being, with no similar sunset timeline on the horizon.

As the r2 is the flagship standard for HITRUST, if your organization is one of those that was planning to have one of those assessments performed against the CSF v9.1 – 9.4, now you know that the object needs to be created before the end of September 2023 if you’re to stay on that course successfully.

Should you get that done, you’ll also need to retain that object and not upgrade to a more current version so as to ensure you can still apply for HITRUST certification under v9.1 – 9.4. But again, you’ll need to work with your HITRUST Assessor to get your package submitted by the end of December 2024.

Transitioning to HITRUST CSF v11

A new dawn for HITRUST has arrived, and with it comes the sunset of previous versions of its CSF.

With proper planning, you still have time to make sure the version you intend to submit for certification remains the version that you actually do submit for certification. As you get orientated in your transition, please also take care in changing your assessment object, as once your assessment object is changed to a newer version at any time, it cannot be changed back. As such, we caution you to be sure when changing that you’re sure you’re switching to the correct version you need.

Even before this new version, HITRUST CSF was a complex framework—as you reshape your approach now with these key deadlines in mind, make sure to also read our other content on this compliance option so that you can further simplify your experience:

• HITRUST: The Effect of TEFCA
• How to Prepare Your Service Providers for HITRUST Certification
• How to Scope Your HITRUST Assessment: 5 Components to Consider