The HITRUST Common Security Framework is the de facto information-security standard for US healthcare. A CSF version-11 r2 assessment requires evidence on three hundred and ten controls. Each control wants a responsible owner, a test result, an attestation date, and supporting evidence at a specific point in time.
The math of a HITRUST assessment is brutal. Three hundred and ten controls. Twelve weeks. Three to four full-time equivalents. External assessor fees that start at fifty thousand dollars and climb. The catch is that eighty percent of the cost is evidence reconciliation — pulling evidence from fifteen different tools and presenting it to the assessor in the framework's expected format.
This is pure waste. The evidence exists. The control owners did the work. The tests ran. The problem is that nobody can answer "show me every control as of the assessment cutoff" in less than a sprint.
What the assessor actually needs
For each of the 310 controls, three facts:
- The control owner at the time.
- The test result and the date it ran.
- The evidence — the artifact that demonstrates the control fired.
If those facts live in your GRC platform, SharePoint, the EHR audit log, the IAM tool, the SIEM, the change-management system, and Confluence respectively, the answer is "eight weeks." If they live in one graph, the answer is "eight minutes."
The one-query reconstruction
MATCH (c:Control) AT RECORDED '2026-04-30T23:59:00Z'
WHERE c.framework = 'HITRUST-CSF-v11'
OPTIONAL MATCH (c)-[:OWNED_BY]->(o:Owner) AT RECORDED '2026-04-30T23:59:00Z'
OPTIONAL MATCH (c)-[:LAST_TESTED]->(t:Test) AT RECORDED '2026-04-30T23:59:00Z'
OPTIONAL MATCH (c)-[:HAS_EVIDENCE]->(e:Evidence) AT RECORDED '2026-04-30T23:59:00Z'
RETURN c.id, o.name, t.result, t.ts, collect(e)Each MATCH clause reads the GRC graph as it was recorded at the assessment cutoff: each control in the framework, its owner, its last test result, and its supporting evidence.
The evidence-integrity check
The assessor's harder question is whether any control evidence was modified after the assessment cutoff. GET /graphs/{name}/audit/verify re-hashes the graph’s write history and returns clean or the first broken record. The check covers the whole graph and has no date window. The history log is not signed or anchored outside the server, so the check does not detect a rewrite of the whole log, or removal of the most recent records, by someone with write access to the server. A later, legitimate change to a test result appears as a new version with its own recorded time, which db.propertyHistory lists.
HITRUST scoring counts evidence quality, so being able to show when each piece of evidence was recorded, together with the result of the history check, is useful to the assessor.
Refused PHI access
Field-level ACLs can restrict PHI fields to specific roles and to callers whose JWT carries an allowed purpose. db.aclEvents returns the Cypher reads that field ACLs or purpose rules denied, and the searches and node creates they refused, with the principal, label, property, action and reason. Allowed reads are not logged, so the log shows enforcement, not a full access history. A complete record of allowed PHI reads has to come from the systems that serve those reads.
The HIPAA + HITRUST + state-privacy triple
While the assessment is in flight, a patient files a state genetic-privacy deletion request. HIPAA requires audit-log retention, HITRUST requires control-test evidence, and the state privacy law requires deletion. Crypto-shred (per-subject encryption keys and key destruction) is in development. Contact us before relying on it for erasure requests.
The numbers
The figures in this post and in the walkthrough are illustrative.