HITRUST r2 Interim Assessment Readiness
Prepare scope-change analysis, sampled control evidence, CAP progress, and External Assessor coordination for the r2 one-year interim assessment.
HITRUST r2 certification uses a two-year certification period with an interim assessment around the one-year anniversary. HITRUST’s current handbook states that the interim assessment must be completed and submitted in the 90-day window leading to that anniversary to retain certification.
Interim-readiness priorities
- Determine whether business, technology, hosting, policy, process, or scope changes are significant.
- Confirm whether a security event affected the certified environment.
- Prepare current evidence for the sampled requirement statements.
- Demonstrate sufficient progress on corrective action plans and test whether the control environment has degraded.
- Coordinate the entity, MyCSF records, and appropriately authorized External Assessor.
Current program changes matter
HITRUST’s 2026 handbook update permits an e1 or i1 assessment in lieu of an interim assessment in defined circumstances. Applicability must be confirmed against the current handbook and with HITRUST or the External Assessor rather than assumed.
Only HITRUST determines whether certification is retained, and validation activities assigned to an External Assessor must be performed by an authorized organization. Review the current HITRUST Assessment Handbook.