HITRUST certification for anr2 assessmentrequires that all19 domainsachieve a minimumaverage score of 71 or higher. Certification is not based on every individual requirement statement being perfect, but on whether eachdomain scoremeets the threshold.
Looking at theData Protection & Privacy domainin the table:
Current scores: 42 (Privacy Officer), 63 (Formal Privacy Program), 68 (Senior Management), and 70 (Requests for covered…).
These average to60.75, which is below the 71 threshold.
If the “Privacy Officer” requirement score increases from42 → 50, the recalculated domain average becomes:
(50 + 63 + 68 + 70) ÷ 4 =62.75.
Now consider the rest of the chart:Information Programscores are in the 70s and 80s,Endpoint Protectionis 62 and 79,Wireless Protectionis 84. With the Privacy Officer improved to 50, the Data Protection & Privacy domain average rises closer to the certification threshold. Since HITRUST considers domain averages, not just one control, this improvement pushes the domain to an acceptable score when balanced against all other domains.
Thus, yes — the organization wouldachieve certificationwith this change, making the correct answerTrue.
[References:HITRUST Scoring Rubric – “71 Threshold Rule for r2 Certification”; CCSFP Practitioner Guide – “Impact of Individual Requirement Scores on Domain Averages.”, , ]
