ISO 22301 for healthcare: proof that your service keeps running

In healthcare, an interruption is not an inconvenience. A patient record system that is down at the start of a shift, a laboratory that cannot deliver results or a delivery of consumables that does not arrive affects people directly. Buyers know this, and they want to see that their suppliers have thought about it before it happens.

That is why the question appears in supplier questionnaires, in tender documents and in customer audits. A hospital group wants to know how long your software can be unavailable. A health insurer wants to know what happens to claims processing if your data centre fails. The questions differ, the answer they hope for is the same: a documented, tested continuity system.

ISO 22301 is the international standard for exactly this. A certificate with a number and a QR code lets the purchasing department tick the box and move on to the next supplier.

• ISO 22301 at a glance

ISO 22301 does not prescribe specific medical measures. It asks you to find the activities that cannot stop, and to plan for the events that could stop them. In healthcare these events are fairly concrete.

Patient record outage

The practice or clinic system is unavailable. Staff need a paper fallback and a defined point in time to which data can be restored.

Cold chain failure

A refrigeration unit for vaccines, samples or medicines fails overnight. The plan names who is alerted, where stock is moved and how it is documented.

Power loss

A building loses mains power. Critical rooms, devices and IT need a backup supply that has actually been tested.

Staff shortage

A wave of illness removes a large part of a team. The plan defines minimum staffing per activity and who can step in.

Supplier shortage

A single supplier of consumables, reagents or devices cannot deliver. Alternative sources and safety stock are agreed in advance.

Analyser or device failure

A key laboratory or diagnostic device breaks down. The plan covers repair contracts, loan devices or a partner laboratory.

The standard follows the usual management system structure: context, leadership, planning, support, operation, performance evaluation and improvement. The core of the operational work sits in clause 8. The table shows the main requirements next to a typical healthcare example.

The following sequence is an illustration, not a client case. It shows the order in which a small laboratory with its own IT and a courier service for samples might proceed.

1. 01

   List the activities

   Sample intake, analysis, result reporting, invoicing. For each one, write down who depends on it and how quickly.

2. 02

   Set the limits

   Result reporting for urgent samples may be down for two hours, invoicing for three days. These are the recovery time objectives.

3. 03

   Check what could break them

   Analyser failure, courier outage, loss of the lab information system. Rate each by likelihood and effect.

4. 04

   Decide on measures

   A service contract with a loan device, a second courier, a daily backup with a tested restore.

5. 05

   Write short plans

   One page per scenario: trigger, first steps, responsible person, deputy, who informs customers.

6. 06

   Test and record

   Restore a backup, call the deputy list, note what failed. The record is the evidence an auditor or buyer wants to see.

You start with the online self-assessment for ISO 22301. It has 34 yes/no questions. Thirteen of them are must-meet questions and all must be answered yes. They cover the core of the assessment, not every requirement of the standard. Of the other 21 questions, at least 14 must be answered yes. SICE reviews every assessment before the certificate is issued.

Once you have passed and paid, the certificate is issued by Zertify under licence from SICE within 4 hours. It is a PDF with a certificate number and a QR code. Anyone can check it on the public verification page, including a purchasing department that has only the PDF.

The price is CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit. The certificate is valid for 3 years, confirmed each year by the short re-audit. The yearly subscription renews automatically and can be cancelled at any time in your customer account, effective at the end of the current year. If you cancel, the certificate ends with the paid year. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein. You do not need an account to buy.

If you also hold or plan ISO 27001 for your IT systems, a multi-standard discount applies: 20% for two standards, 30% for three or more, also on the yearly fee.

• Start the free self-assessment
• See pricing
• How it works

The Zertify certificate rests on a self-assessment reviewed by SICE. There is no auditor visiting your premises. For many supplier questionnaires and framework agreements this is enough, because the buyer wants a verifiable certificate and a documented system.

Some tenders or customers name a specific route in their documents, for example an on-site audit by a certification body. Read the requirement before you decide. If it is silent on the route, you can ask the buyer directly. The guide on certification routes sets the two side by side.

Whichever route you choose, the certificate only has value if the system behind it exists. A continuity plan nobody has read or tested will not hold up when a customer asks to see the last exercise.

• Compare the certification routes
• Certification without an on-site audit
• ISO for small and medium businesses