ISO 20000-1 · Healthcare
ISO 20000-1 for healthcare: certificate for IT service providers
Hospitals, clinics and group practices want to know that their IT suppliers run services under defined processes. ISO 20000-1 is the certifiable standard for that. With Zertify you answer 36 yes/no questions online and receive the certificate within 4 hours after passing and payment.
01: Demand
Why do healthcare customers ask for ISO 20000-1?
A clinic cannot register patients when the appointment system is down. Purchasing departments in hospitals, care groups and practice networks know this. Their supplier questionnaires and tenders therefore ask about incident handling, change control and agreed availability. ISO 20000-1 answers many of these questions with one document.
The standard describes a service management system. It does not test your software and it does not replace security controls. It shows that you run IT services in a defined, repeatable way: who takes a fault report, how quickly someone responds, who approves a change before it goes live, what happens when the same fault returns. The certificate carries a number and a QR code, so a purchasing department can check it on the verification page without writing to you.
The standard is relevant for vendors of practice and hospital software, SaaS providers for patient portals or scheduling, managed service providers that look after clinic networks, and internal IT departments of hospitals and care organisations. Laboratory and imaging IT teams that serve several sites also fit.
02: Requirements
Which healthcare IT risks does the standard address?
Every requirement in the standard targets a failure that healthcare IT teams know well. The table links the key requirements to the situation they prevent.
| Requirement | Risk in healthcare IT | What it looks like in practice |
|---|---|---|
| Service catalogue | Ward and reception staff do not know what IT supports or whom to call | A catalogue lists the booking module, the imaging link and the mailbox service, each with owner and support hours |
| Service level agreements | IT and the clinic expect different availability | Response and resolution times by priority, so a failed login at the reception desk ranks above a report layout request |
| Incident management | Faults reported by phone, email and in the corridor get lost | One ticket queue with priorities and an escalation path |
| Problem management | The same interface to the laboratory fails every month | A problem record with root cause and a named owner for the fix |
| Change and release management | A Monday morning update stops the appointment system | A change calendar, approval before release, a rollback plan and release windows outside clinic hours |
| Capacity and availability management | Registration peaks overload a system that was sized for the average day | Monitoring, planned capacity and announced maintenance windows |
03: Terms
Key terms of ISO 20000-1 with examples from healthcare IT
The vocabulary of the standard is short. These five terms appear in almost every customer audit.
- Service
- What you deliver to the customer, for example hosting of a patient scheduling application for twelve practices, including support.
- Service level agreement
- The written agreement on what the customer can expect. Example: a fault that blocks patient registration is answered within 30 minutes during opening hours.
- Incident
- An unplanned interruption or loss of quality. Example: the discharge letter template no longer opens for one department.
- Problem
- The underlying cause of one or more incidents. Example: a faulty certificate renewal that has locked users out three times.
- Change
- Any modification to a service. Example: moving the scheduling database to a new server over a weekend, with approval and a rollback plan.
04: Practice
How does a healthcare IT provider meet the key requirements?
Most providers already do much of this informally. Certification asks you to write it down and to show that you follow it. A small team can get there in five steps.
List the services
Name each service, its customer group, its owner and its support hours. A one-page catalogue is enough to start.
Agree service levels
Put response and resolution targets into the contract or an annex, by priority. Use the same priority scale for every customer.
Route all faults into one queue
Calls, emails and messages from clinic staff become tickets. Without a ticket, there is no record to show an auditor.
Review repeated faults
Once a month, look at the tickets that came back. Open a problem record for each cause and assign an owner.
Control changes
Keep a change calendar. Each change has an approver, a test and a way back. Releases avoid the busy morning hours of your customers.
The requirements for operation sit in clause 8 of the standard. Clause 9 asks you to measure and review, clause 10 to improve. A quarterly review of ticket volumes, missed targets and open problems covers both.
05: Zertify
How to get ISO 20000-1 certified with Zertify
You start with the online self-assessment. It has 36 yes/no questions. Thirteen are mandatory requirements of the standard and must all be answered yes. Among the other 23 questions you need at least 16 yes answers. No account is needed to buy once you have passed.
The certificate is issued by G6 Agency AG under licence from SICE, the Swiss Institute of Certification and Education. SICE reviews every assessment before the certificate is issued. There is no on-site audit. Each certificate can be checked publicly by number and QR code, and a short online re-audit confirms it every year.
The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years. The yearly fee renews automatically and you can cancel it in your customer account at any time to the end of the current year. If you cancel, the certificate ends with the paid year. Swiss customers and customers in Liechtenstein pay prices including 8.1% VAT. Combining standards reduces the price by 20% for two and 30% for three or more, also on the yearly fee.
06: Scope
What does the certificate cover, and what does it not?
ISO 20000-1 certifies how you manage IT services. It says nothing about how you protect patient data. If your customers ask for that as well, ISO 27001 is the matching standard, and many providers hold both.
Some tenders describe the route to the certificate, for example by naming an on-site audit by a certification body. Read the wording before you apply. The guides below compare the classic route with the online route and show what each involves.
07: FAQ
Questions about ISO 20000-1 in healthcare
08: Guide
Related pages
Check your IT services against ISO 20000-1
Answer the 36 questions and see whether your service management meets the standard.
Free and without registration.