The Health Information Trust Alliance (HITRUST) has announced a program that significantly alters how the health care industry assesses security and reports compliance for HIPAA, HITECH, state and other third-party requirements.

The HITRUST CSF Assurance Program addresses the challenges with the historically proprietary process by providing health care organizations and their business associates with a common approach to manage security assessments that creates efficiencies and contains costs associated with multiple and varied assurance requirements.

The program leverages the HITRUST Common Security Framework (CSF), a comprehensive security framework that incorporates the existing security requirements of health care organizations, including federal, state, third party (e.g., PCI and COBIT) and other government agencies (e.g., NIST, FTC and CMS). With the broad adoption of the CSF, HITRUST is now able to provide health care organizations and their business associates with a streamlined compliance process and the guidance and tools that ensure a consistent and incremental approach to assessing and reporting compliance to multiple constituents.

"The current method of measuring and reporting compliance is fraught with rampant inconsistencies and tremendous waste of time and resources, all of which work against the goals of health care reform from both an efficiency and information protection perspective," said Daniel Nutkis, chief executive officer of HITRUST. "The confirmation of the need for a new approach is evident in the fact that so many health care organizations are already requiring or encouraging their business associates to participate in the CSF Assurance Program. In addition, we are seeing many business associates proactively take part in the program prior to a request being made."

Utilization of the CSF Assurance Program allows organizations to perform a single assessment against the requirements of the CSF and report the results to various constituents, reducing the time, costs and complexities of today's compliance efforts. For organizations that have already adopted the CSF, the program allows them to receive immediate and incremental value through common reporting tools and processes.

"As a leader in health care reform and innovation, the Health Information Partnership for Tennessee (HIP TN) is working with HITRUST to adopt the CSF as part of its health information exchange initiatives," said Bob Gordon, chairman of the board for HIP TN. "A single, comprehensive assessment approach would ensure we aren't adding complexity and cost to the health care system, while at the same time enabling the protection of health information. The CSF and the CSF Assurance Program should provide the needed mechanisms to ensure trust in the health care organizations that connect to the state's health information exchanges."