The Validated Report Agreement (VRA) is an agreement that must be signed by both the Assessed Entity and HITRUST prior to submission of the assessment to HITRUST. The VRA for all HITRUST validated assessment types is completed via MyCSF using an electronic signature workflow.
The VRA webform can be completed by the Assessed Entity during the following phases of the assessment workflow: Answering Assessment, Performing Validation, Inputting CAPs and Signing Representation Letter, and Reviewing CAPs.
13.3.1 The Assessed Entity must complete the VRA webform by entering the name, job title, and email address of the individual who will sign the VRA as well as the address of the organization.
13.3.2 A designated individual at the Assessed Entity must electronically sign the VRA. The signer of the VRA is not required to have a MyCSF account.
13.3.3 HITRUST must sign the VRA prior to submission of the assessment to HITRUST. After being signed by the Assessed Entity, the VRA is automatically routed to HITRUST for signature.
The Assessed Entity and External Assessor should allow up to one business day for the VRA to be signed by HITRUST. The Assessed Entity may contact its HITRUST Customer Success Manager or HITRUST Support (support@hitrustalliance.net) with any questions related to signing of the VRA. Once signed by both parties, the VRA will automatically be loaded into MyCSF and emailed to the individual who signed it.