If most of the evaluative elements associated with a requirement statement do not apply to an assessed entity’s control environment, the requirement statement can be marked "N/A".
HITRUST does not permit marking a requirement statement “Not Applicable” simply because most of the evaluative elements don’t apply. Requirement statements are mandatory unless a legitimate scoping or regulatory justification supports exclusion. For example, a control related to cardholder data could be marked N/A only if the organization does not process credit cards. However, if even one evaluative element applies, the requirement must be scored, and the non-applicable elements may be documented as part of evidence. HITRUST QA reviews all N/A designations, requiring organizations to justify exclusions in the Subscriber Comments field. Improperly marking requirements as N/A may result in assessment rejection or mandatory CAPs.
[References: HITRUST Assurance Program – “Rules for N/A Designations”; CCSFP Practitioner Guide – “Proper Use of N/A in Assessments.”, ]
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit