As we move toward the end of 2026, we highlight key updates in the HITRUST program and reflect on the most impactful developments from the last quarter.
Exciting changes are on the way to optimize your experience as an assessed entity with the Crowe Secure Information Exchange portal. Learn more about how clients engage with the portal and the efficiencies clients are seeing in their third-party risk management efforts at the end of this update.
Assurance program updates
HITRUST CSF version 11.9 was released on Sept. 24, 2026. The release incorporates controls from NIST SP 800-53 Revision 5.2.0 and the OWASP Top 10 for Agentic Applications 2026. It also expands agentic AI requirements, updates AI security certification controls, and modernizes existing requirements, including support for passwordless authentication. Additionally, the release adds one encryption requirement to the e1 baseline, which brings the number of requirement statements to 44.
Organizations may create new e1 and i1 assessments using version 11.8 or 11.9 through Dec. 31, 2026. Assessments created under version 11.8 or earlier must be submitted by March 31, 2027. Starting in 2027, all e1 and i1 assessments must be created on version 11.9. Also starting in 2027, all r2 assessments must be created on version 11.4 or later. Existing r2 assessments using versions 11.0 through 11.3.2 must be submitted by March 31, 2027.
The HITRUST Report Center is now live. Any assessed entities that have recently performed a HITRUST assessment and had a draft report issued after Sept. 10, 2026, must share reports directly within the Report Center. Assessed entities that received a draft report before Sept. 10 may use the Report Center at their discretion.
This change is because organizations can now manage how reports are shared through MyCSF, which eliminates the need to share reports manually with readers. Assessed entities can manage user access and control which reports users can access.
Organizations with a HITRUST certification might still receive security questionnaires from customers, prospects, or vendors. HITRUST plans to launch MyCSF Questionnaire Responder, an AI-powered capability designed to streamline the response process. Assessed organizations will be able to upload a questionnaire to a completed validated assessment in MyCSF. The tool will populate responses based on the organization’s HITRUST assessment scores and supporting documentation while preserving the questionnaire’s original format and available answer choices.
The capability can reduce the manual effort required to complete security questionnaires after certification. Because responses draw from information reviewed by an assessor and validated through HITRUST’s quality assurance process, they also provide additional support for answers that might otherwise rely on self-attestation.
An early-access period is planned for Oct. 26 through Dec. 31. During this period, the capability will be available at no cost. Interested organizations can log into MyCSF, open up a completed assessment, and follow the prompts to gain access to the MyCSF Questionnaire Responder.
Rural healthcare providers face growing cybersecurity risks, including ransomware, data breaches, system outages, and care disruptions, but they often lack the funding, staff, and technical resources available to larger health systems. A MedCity News article highlights how the Centers for Medicare and Medicaid Services’ (CMS’) $50 billion Rural Health Transformation Program can help states address these gaps by investing in practical cyber readiness measures, including risk assessments, endpoint protection, staff training, monitoring, incident response planning, and shared cybersecurity services.
The article notes that meaningful progress will require more than funding alone. Rural hospitals need a clear, realistic path for strengthening cybersecurity, starting with an understanding of where their defenses stand today and which gaps pose the greatest risk. From there, recognized frameworks can help providers focus limited resources on practical improvements, build stronger cyber hygiene over time, and prepare for threats such as phishing, ransomware, credential misuse, and system disruption.
The Cyber Resiliency Center (CRC) at the Georgia Cyber Center at Augusta University is aligning its rural healthcare cybersecurity and resilience initiatives with CMS Rural Health Transformation Program goals. The effort is designed to help rural providers modernize care delivery while protecting patient data, maintaining access to care, and supporting innovation.
Through partnerships with CrowdStrike and HITRUST, the CRC is helping rural hospitals strengthen the secure digital infrastructure needed for telehealth, electronic health records, and resilient clinical systems. The program also supports participating hospitals in pursuing HITRUST certification, creating a consistent security baseline that can improve compliance, reduce duplicative assessments, and increase trust with payers and partners.
The initiative also integrates cybersecurity training into clinical and administrative roles, helps reduce system disruptions, and supports workforce resilience. By strengthening the digital infrastructure behind value-based care, remote monitoring, and coordinated care networks, the CRC is positioning cybersecurity as essential to patient safety, operational continuity, and sustainable rural healthcare transformation.
Crowe update
Crowe recently upgraded Crowe Secure Information Exchange, its evidence collection tool, with an application programming interface (API) that connects the portal to HITRUST’s MyCSF.
Since the API launched in May 2026, assessed entities have been able to manage more of the evidence collection process directly through the portal. The integration reduces time spent in MyCSF by allowing assessed entities to link evidence to requirement statements and communicate with their assessor team about evidence requests through the portal.
To learn more about this feature, please contact us.
Contact our authorized assessors
As a HITRUST Authorized External Assessor and a current HITRUST Authorized External Assessor Council member, we’re here to help keep you apprised of the most current changes. Our team also regularly provides insights and participates in discussions concerning the growth and evolution of HITRUST.
We look forward to hearing your questions and comments.
