The Management Representation Letter (Rep Letter) for HITRUST r2, i1, and e1 validated assessments is completed via MyCSF using an electronic signature workflow.
13.8.1 The HITRUST r2, i1, or e1 validated assessment report date is determined by the date on the Rep Letter.
13.8.2 The Rep Letter webform in MyCSF is completed by the Assessed Entity during the Performing Validation phase after the External Assessor team’s fieldwork period has ended and the External Assessor Timesheet has been completed or during the Inputting CAPs and Signing Rep Letter phase of the assessment workflow. All testing performed by the External Assessor must be complete before the Assessed Entity may sign the Rep Letter.
13.8.3 The Assessed Entity completes the Rep Letter webform by:
i. Setting the Rep Letter date.
ii. Entering the name, job title, and email address of the individual who will sign the Rep Letter.
iii. Uploading the organization’s logo.
13.8.4 The date on the Rep Letter must meet the following requirements:
- The date must be on or within two weeks following the end date of the External Assessor’s fieldwork period on the External Assessor Time Sheet (unless the Assessed Entity completed a bridge assessment).
- The date may not be after the date the assessment was submitted to HITRUST for processing.
- If the Assessed Entity completed a bridge assessment (see Chapter 15.8 Bridge Assessments), the date must be the bridge certificate date, which is the expiration date of the prior certification.
13.8.5 A request to electronically sign the Rep Letter is automatically sent to the designated management representative for signature via email. The signer of the Rep Letter may be any designated individual from the Assessed Entity’s organization and is not required to have a MyCSF account.
13.8.6 Once signed, the Rep Letter will automatically be loaded into MyCSF and emailed to the individual who signed it.