HITRUST enhances privacy controls of Common Security Framework

The Health Information Trust Alliance (HITRUST) has added additional privacy controls to its Common Security Framework (CSF).

HITRUST’s latest version (seven), set for release later this month, includes privacy controls that offer better alignment between healthcare organizations’ security and privacy programs and allows for an integrated approach for protecting health information under HIPAA, according to the organization.

“The new HITRUST CSF privacy domain facilitates an integrated approach to protect personal health information, aids in regulatory compliance, is consistent with healthcare industry trends and enhances the current HITRUST CSF,” said Angela Holzworth, senior information risk analyst, Highmark Health and HITRUST privacy working group chair, in a statement. 

The HITRUST CSF will incorporate both privacy and security controls, but organizations can choose to obtain certification for privacy, security or both. Also, it will incorporate the Minimum Acceptable Risk Standards for Exchanges (MARS-E), additional guidance for cybersecurity and enhancements to risk factors and assurance methodology.