Humana ISA Requires HITRUST AI Certification

The requirement in §2.23.1.3

HUM ISA 2025 v1.0 requires a vendor that provides IA to Humana, or uses IA components provided from third parties, to hold a non-inherited HITRUST AI Certification.

§2.23.1.3

If Vendor provides IA Services, products, or components to Humana, or uses such components provided from third parties, Vendor shall obtain and maintain a non-inherited HITRUST AI Certification and provide documentation, including full reports, to Customer upon request.

How the clause surfaced

The requirement surfaced in our review of a client's ISA. The agreement was HUM ISA 2025 v1.0. The client's own outside counsel's redline did not flag the AI requirement.

What counts as IA

§1.1 defines "Intelligent Automation" or "IA". The opening sentence is the scope:

§1.1

"Intelligent Automation" or "IA" means any technology, service, product, or component thereof that with little or no direct human interaction executes tasks, workflows, or decision logic.

The words "little or no direct human interaction executes tasks, workflows, or decision logic" are broad. They cover a technology, a service, a product, or a component of any of those. A component is enough. With little or no direct human interaction, the technology executes tasks, workflows, or decision logic.

The definition then says what IA includes, and it says the inclusion is without limitation:

§1.1

IA includes without limitation: "Artificial or Augmented Intelligence" or "AI" means any technology, service, or product (or component thereof) of Vendor's product (i) that is an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments, (ii) that uses or is enabled by artificial intelligence, machine learning, and/or predictive analytics, (iii) that makes decisions based on rules or statistics learned from example data, or (iv) that otherwise performs functions normally associated with human intelligence, such as reasoning, learning, and self-improvement. This includes, but is not limited to, techniques such as prediction, classification, clustering, neural networks, natural language processing, Generative Artificial Intelligence (as defined below), and other augmented or artificial intelligence techniques.

"Artificial or Augmented Intelligence" or "AI" is written there as four alternatives, (i) through (iv). The same sentence names techniques: prediction, classification, clustering, neural networks, natural language processing, Generative Artificial Intelligence, and other augmented or artificial intelligence techniques. Those are the techniques the text lists, and the sentence says the list is not limited to them.

A tool the vendor did not build is still in scope when the agreement's own words reach it. §2.23.1.3 reaches a vendor that "uses such components provided from third parties". §2.1.7 reaches a vendor that "licenses a tool from another party that uses IA". AI used through a third-party tool counts.

Disclosure and due diligence

§2.1.7 is the disclosure, and the due diligence that comes with it:

§2.1.7

Vendor shall disclose all current uses and notify Customer of new uses of IA in current or future versions of its systems or licenses a tool from another party that uses IA to deliver the Services, products and deliverables described in the Schedules and SOWs under the Agreement. Vendor shall declare all the components and notify Customer in writing in advance ... Vendor shall engage in Customer's requisite vendor due diligence and risk assessment activities, including inquiries with respect to the IA model, IA training, and IA development documentation which may be satisfied by the provision of third-party audit reports by qualified auditing entities.

The vendor discloses all current uses of IA and notifies the customer of new uses, in current or future versions of its systems. The same sentence covers a vendor that licenses a tool from another party that uses IA to deliver the services, products, and deliverables described in the schedules and SOWs. The vendor declares all the components and notifies the customer in writing in advance. The vendor also engages in the customer's vendor due diligence and risk assessment, including inquiries on the IA model, IA training, and IA development documentation. Those inquiries may be satisfied by third-party audit reports from qualified auditing entities.

Alongside the base certification

The HITRUST AI Certification sits alongside the base certification. §2.23 is that base duty:

§2.23

Vendor shall obtain and maintain a non-inherited and independent certification and provide documentation of such certification to Customer, including full reports, upon Customer's request or at least annually. ... To the extent that Vendor has not achieved independent certification as of the Effective Date of this ISA, the following shall apply:

§2.23.1.1 names the certifications:

§2.23.1.1

... no later than twelve (12) months from the Effective Date of this ISA: HITRUST CSF r2 Certification; SOC 2 Type 2 Report; ISO/IEC 27001:2022 Certification.

For a vendor not yet certified, §2.23.1.1 lists HITRUST CSF r2, a SOC 2 Type 2 report and ISO/IEC 27001:2022, twelve months from the Effective Date.

The HITRUST AI Certification is required under the agreement, with a 12-month window after signing for vendors not yet certified. The agreement counts the twelve months from its Effective Date. §2.23.1.3 sits under §2.23's provision for a vendor that "has not achieved independent certification as of the Effective Date of this ISA," the same provision that gives the base certifications twelve months. We read that window as applying to the AI certification too; §2.23.1.3 does not state its own deadline. §2.23.1.3 states the certification and the duty to provide documentation, including full reports, upon request.

Three other clauses that bite

§2.1.6, liquidated damages

§2.1.6

Vendor agrees if any plan to remedy extends beyond five (5) business days to resolve, that it will incur liquidated damages in the amount of 1% per day of the total contract value until the vendor has remedied the non-compliance.

Once a remedy plan runs past five business days, the liquidated damages are 1% per day of total contract value until the non-compliance is remedied. Customer decides non-compliance "in their sole discretion" and "may agree to waive the liquidated damages".

§2.22.5, forty-eight hours

§2.22.5

Vendor shall report each Security Incident or Security Breach, regardless of direct effect on Customer Confidential Information or Customer Information Systems, in an appropriate and timely manner but no later than 48 hours of discovery of the incident or breach. ... the shortest notification timeline shall apply.

Each Security Incident or Security Breach is reported no later than 48 hours of discovery, regardless of direct effect on Customer Confidential Information or Customer Information Systems. The clause also provides that "the shortest notification timeline shall apply."

§2.20.1, five minutes

§2.20.1

... Customer ... can fully isolate and disable all logical and physical connections within five (5) minutes after issuance of a disconnect command by Customer, without causing data loss or corruption. Vendor shall document the disconnect procedure, test it no less than semi-annually, and provide Customer with written test results ... within ten (10) business days after each such test.

The vendor must make it possible for the customer to fully isolate and disable all logical and physical connections within five minutes after the customer issues a disconnect command, without data loss or corruption. The vendor documents the procedure, tests it no less than semi-annually, and provides written test results within ten business days after each test.

What to do now

Inventory every IA use, including third-party tools. Use the §1.1 test: little or no direct human interaction executes tasks, workflows, or decision logic. A tool licensed from another party belongs on that inventory when it uses IA. Use the techniques §1.1 lists as a checklist, remembering the list is not limited to them.

Map the inventory to the §2.1.7 disclosure. Current uses, notice of new uses in current or future versions, a declaration of the components with written notice in advance, and the due diligence inquiries on the IA model, IA training, and IA development documentation.

Plan the HITRUST AI Certification alongside the base certification. The AI certification is required under the agreement, with a 12-month window after signing for vendors not yet certified. The basis is above; §2.23.1.3 sets no deadline of its own.

Rehearse the disconnect in §2.20.1: the documented procedure, a test no less than semi-annually, and written results within ten business days. Rehearse the report in §2.22.5: no later than 48 hours of discovery, regardless of direct effect on Customer Confidential Information or Customer Information Systems.

Read §2.1.6 before the first finding. A remedy plan that runs past five business days accrues 1% per day of total contract value. Customer decides non-compliance "in their sole discretion" and "may agree to waive the liquidated damages".

The parent company is the assessor

Jacobian Engineering, TrustEdge's parent, is a HITRUST Authorized External Assessor. That credential qualifies Jacobian to assess another organization. It is not a HITRUST certification of TrustEdge, and it is not a HIPAA, SOC 2, FedRAMP, ISO, or EU AI Act certification. Those are not available to borrow. The credential is not a HITRUST AI Certification, and it is not a basis for issuing one.

Start with a pre-assessment

The way in is an AI Governance Pre-Assessment. It is small and concrete. It covers what AI you actually have, what already sits inside your certification boundary, what your customer contracts and security questionnaires already commit you to, a gap list against ISO/IEC 42001 and the NIST AI RMF, and a scoping recommendation for red-teaming. You leave with a document you can take to a board.

If that is the conversation you want, contact us.