HITRUST CSF v9.5 Released with HIPAA Breach Notification Updates
HITRUST released CSF v9.5 in September 2021, updating Control Category 11.0 (Information Security Incident Management) to strengthen HIPAA breach notification alignment. Control 11(a) added a requirement that breach notifications to affected individuals use plain language, and Control 11(c) defined incident discovery as the first day the security event is or would have been known to the organization through reasonable due diligence. v9.5.0 was also the first release under HITRUST's v[Major].[Minor].[Errata] versioning policy.
Key Analytics
Impact Analysis
At release, healthcare organizations and business associates under HITRUST certification needed to align incident response and breach notification procedures with the updated Control Category 11.0 requirements. The version has since been retired: per HITRUST advisory HAA 2023-013, new v9.5-v9.6 assessments were disabled June 30, 2024, report submissions closed April 30, 2025, and the libraries were removed from MyCSF on July 31, 2026. Current certifications run on CSF v11.
Recommended Actions
- Confirm no assessment work remains on CSF v9.5 or v9.6; both versions are fully decommissioned
- Migrate HITRUST certification scope to CSF v11 for current e1, i1, and r2 assessments
- Verify breach notification templates still meet the plain-language content requirement introduced in v9.5
Always verify requirements with official regulatory sources.
Estimated Remediation Effort
Indicative effort to address this development, broken down by your organization's current compliance posture. Select the posture that best matches where you are today.
A partial program exists: some policies and controls are in place, but coverage, evidence, and ownership have gaps.
- ›Scope migration of current e1, i1, and r2 work to CSF v11
- ›Plain-language review of existing breach notification templates
- ›Retirement check across open v9.5 and v9.6 assessment artifacts
The Cost of Waiting
Readiness work is dramatically cheaper before a deadline than after one. The ranges below come from the same estimate: the difference is only how prepared you are when the work starts.
Roughly 25 to 55 hours avoided by preparing early
Effort ranges are indicative planning estimates, not quotes. Actual effort depends on organizational scope, environment complexity, and evidence maturity. Talk to us for a scoped assessment.