HITRUST AI Security Assessment and Certification Specification

Output filtering

HITRUST CSF requirement statement [?] (07.10eAISecSystem.1)

Unless specifically required, the AI system
(1) actively filters or otherwise prevents sensitive data (e.g., personal phone numbers) contained within 
generative AI model outputs from being shown to end users of the AI system.

Evaluative elements in this requirement statement [?]
1. Unless specifically required, the AI system actively filters or otherwise prevents sensitive data (e.g., personal phone numbers) 
contained within generative AI model outputs from being shown to end users of the AI system.


Illustrative procedures for use during assessments [?]

  • Policy: Examine policies related to each evaluative element within the requirement statement. Validate the existence of a written or undocumented policy as defined in the HITRUST scoring rubric.

  • Procedure: Examine evidence that written or undocumented procedures exist as defined in the HITRUST scoring rubric. Determine if the procedures and address the operational aspects of how to perform each evaluative element within the requirement statement.

  • Implemented: Examine evidence that all evaluative elements within the requirement statement have been implemented as defined in the HITRUST scoring rubric, using a sample based test where possible for each evaluative element. Example test(s):
    • For example, obtain and examine evidence to confirm sensitive data in generative AI model outputs were actively filtered or otherwise prevented from being included in user-facing outputs.

  • Measured: Examine measurements that formally evaluate and communicate the operation and/or performance of each evaluative element within the requirement statement. Determine the percentage of evaluative elements addressed by the organization’s operational and/or independent measure(s) or metric(s) as defined in the HITRUST scoring rubric. Determine if the measurements include independent and/or operational measure(s) or metric(s) as defined in the HITRUST scoring rubric. Example test(s):
    • For example, measures indicate the percentage of generative AI model-produced sensitive data in the information system’s user-facing output. Reviews, tests, or audits are completed by the organization to measure the effectiveness of the implemented controls and to confirm sensitive data in the AI model output is actively censored.

  • Managed: Examine evidence that a written or undocumented risk treatment process exists, as defined in the HITRUST scoring rubric. Determine the frequency that the risk treatment process was applied to issues identified for each evaluative element within the requirement statement.

Placement of this requirement in the HITRUST CSF [?]

  • Assessment domain: 19 Data Protection & Privacy
  • Control category: 13.0 Privacy Practices
  • Control reference: 13.k Use and Disclosure

Specific to which parts of the overall AI system? [?]
  • AI application layer:
    • Application AI safety and security systems
  • AI platform layer
    • Model safety and security systems


Discussed in which authoritative AI security sources? [?]

Discussed in which commercial AI security sources? [?]
Control functions against which AI security threats? [?]
Additional information
  • Q: When will this requirement included in an assessment? [?]
    • This requirement is only included when the assessment’s in-scope AI system leverages a generative AI model.
    • The Security for AI systems regulatory factor must also be present in the assessment.

  • Q: Will this requirement be externally inheritable? [?] [?]
    • Yes, partially. This responsibility may be shared between an AI platform provider (if used) and the AI application provider.