An r2 certification lasts two years, but only if you pass the interim assessment at roughly the halfway point. Many teams treat the interim as a formality. It is lighter than the full assessment, but it is a real test, and the controls it examines have been running unobserved for a year.
The interim exists for a simple reason. A two-year certification is a long time for a buyer to rely on a single point of testing. The interim gives HITRUST, and your customers, evidence that the controls certified in year one are still operating in year two.
This article covers what the interim includes, when it happens, and how to make sure your first year leaves you ready for it.
What the interim is
The interim is a validated assessment, performed by an authorized external assessor and reviewed by HITRUST, at around the one-year mark of an r2 certification. It is narrower than the original r2. The assessor does not retest every requirement statement. Instead, the interim looks at three things:
A selection of requirement statements, chosen under HITRUST's methodology, which the assessor tests to confirm they are still operating as they were at certification.
Progress on corrective action plans raised in the original assessment.
Significant changes to your organization, scope or environment since certification.
The results are recorded in MyCSF and go through HITRUST's quality assurance, as the original assessment did. HITRUST's methodology sets how requirement statements are selected and what happens if results have declined, and those rules change between versions. Confirm them with your assessor at the start of planning.
The e1 and i1 have no interim. They are one-year certifications, so the next step after them is a fresh assessment.
When it happens
HITRUST sets a window around the first anniversary of the certification in which the interim must be completed and submitted. Missing that window puts the certification at risk. The exact window, and what happens if you miss it, are set by HITRUST's current rules: check them in MyCSF the week your certification is issued and put the dates in your calendar.
Work backwards from the window:
Three to four months before: confirm your assessor, agree dates, and ask which requirement statements they expect to test.
Two months before: run an internal check of the controls likely to be tested, and update your CAP status.
One month before: assemble evidence and confirm control owners are available.
This is a planning shape, not a rule. Adjust it to your assessor's lead times.
What the assessor tests
Selected requirement statements
The assessor tests the selected requirement statements in the same way as in the original assessment: inspecting records, configurations and documents and interviewing control owners. The question is whether the control still performs at the level that was scored.
That is the part teams underestimate. Your original score was earned with evidence from before certification. The interim needs evidence from the year since. A quarterly access review that ran three times in four quarters, or a vulnerability scan schedule that quietly lapsed when a tool was replaced, will show up.
Corrective action plans
If your original assessment produced corrective action plans, the assessor reviews where each one stands. A CAP that is on schedule, with evidence of work done, is fine. A CAP that has not moved since certification is a problem you will have to explain.
Keep CAP status current in MyCSF throughout the year rather than updating it in a rush before the interim.
Significant changes
Organizations change in a year. New products launch, systems are migrated, acquisitions close and teams are reorganized. The interim asks whether any of that has changed the scope or the control environment in a way that affects the certification.
Typical changes worth raising with your assessor early:
A new production environment, cloud account or region.
A replaced core system, such as a new identity provider or ticketing tool.
An acquisition, or a new product line that handles in-scope data.
A change in a major service provider, especially one you inherit from.
Keeping year one on track
The interim goes well when the first year is run as an operating year, not a recovery year.
Keep recurring controls on schedule. Access reviews, vulnerability scans, backup tests, training and policy reviews all generate dated records. A missed occurrence is far easier to deal with when it is caught in the month it happens. Our article on what to do when a control fails mid-period covers how to document a failure honestly and recover from it.
Keep documentation alive. In an r2, policy and procedure are scored levels. If a procedure describes a tool you replaced in month four, it no longer describes how the requirement is met. Update the document when the process changes, not when the assessor asks. Our article on r2 maturity scoring explains why documentation weighs on the result.
Keep measured and managed evidence flowing. If you scored at the measured or managed levels, the metrics and reviews that earned those scores need to continue. A metrics review that stopped after certification is a decline the interim can see.
Watch your inherited requirements. If you inherit requirement statements from a cloud provider, confirm their HITRUST assessment is still valid through your interim. Our article on inheritance from cloud providers covers what to check.
Common interim problems
Ownership drift. The person who owned a control at certification has moved roles, and nobody picked it up. Review control ownership every quarter.
Tool changes without evidence continuity. A new scanner or ticketing system went live, and the historical records from the old one were not retained. Export before you decommission.
CAP dates that slipped silently. A revised date with a reason is manageable. A date that passed with no update looks like neglect.
Scope creep nobody recorded. An engineering team added an in-scope system without telling compliance. The assessor finds it before you do.
What to tell customers in year two
Healthcare buyers who rely on your r2 often ask, partway through year two, whether the certification is still current. Have a short, accurate answer ready: the certification date, the expiry date, and the status of the interim assessment.
Do not describe the interim as complete until HITRUST has accepted it. If fieldwork is done and QA is pending, say that. If a buyer's contract requires notice of changes to your certification status, check the wording and meet it. A buyer who learns about a problem from you, early, is in a very different position from one who learns about it at renewal.
After the interim
Once the interim is accepted, the certification continues to the end of its two-year term. At that point you need a new r2 to recertify. Treat the interim as a rehearsal for that assessment. The gaps it surfaces are the ones you will face again, with the full set of requirement statements in play.
If you are planning the full cycle from the start, our guide to preparing for a validated assessment covers the steps that come before the first certification, and the HITRUST framework page summarizes the assessment types.
How TrustLynce helps
TrustLynce runs continuous monitoring of your controls through the certification period and routes failures to their owners, so a lapsed control surfaces in the month it lapses. Evidence collection keeps dated records from your systems, so the year-two evidence exists when the interim asks for it.