ISO 27001 for healthcare: certify your information security online

A clinic outsources its patient administration. A laboratory sends results to referring doctors. A software vendor hosts appointment data for forty practices. Each of them turns up in somebody's supplier questionnaire, and the purchasing department wants one document that answers the security section before it reads the rest.

ISO 27001 is that document. It is recognised across sectors, so you stop filling in a different questionnaire for every contact. Tenders may list it as a requirement or award points for it.

A customer audit can still happen. The certificate gives the auditor a starting point: a risk assessment, a list of controls and a record of how incidents were handled.

• About ISO 27001:2022

The risk assessment sits at the core of the standard. It decides which Annex A controls you implement and why. In healthcare, the same few risks come up again and again.

Patient records

Health data is among the most sensitive data a company holds. The risk assessment records who may read, change or export it, and which controls restrict that access.

Medical devices on the network

Imaging systems and lab analysers often run software that cannot be patched on schedule. The standard asks you to list them as assets and decide how to separate or monitor them.

Cloud and software providers

Practice software, telemedicine tools and hosted storage mean that part of your security sits with a supplier. You assess that supplier and define what you require of it.

Locums and temporary staff

Agency nurses and locum doctors need access on the first morning. The risk is that the access still exists after their last shift.

Ransomware and downtime

A practice without its system cannot see appointments or medication lists. Backups, restore tests and incident management reduce that risk.

Reports sent by email

Referral letters and lab results travel by email or messenger every day. Controls on encryption and recipient checks apply here.

The standard follows the high level structure: context, leadership, planning, support, operation, performance evaluation and improvement. In practice it comes down to six requirements. The table shows what each looks like in a group practice or a small clinic.

Most organisations in this sector already do part of the work. The task is to write it down and close the gaps.

1. 01

   Map your patient data

   Note where it is stored, who can reach it and where it leaves the organisation: email, billing providers, laboratories, cloud tools.

2. 02

   Name one person responsible

   This can be the practice manager or the head of IT. The role needs time and the authority of management.

3. 03

   Review your suppliers

   List every provider that touches patient data and check what you have agreed with each of them.

4. 04

   Write the policy and the Statement of Applicability

   Keep both short. They must describe what you actually do.

5. 05

   Brief your staff

   Run one session on passwords, phishing and incident reporting, and keep the attendance list.

• ISO for small and medium businesses

You complete an online self-assessment with 48 yes/no questions. Thirteen of them are mandatory requirements of the standard and must all be answered yes. Of the other 35, at least 24 must be yes. You need no account to buy.

SICE reviews every assessment. After you pass and pay, the certificate arrives within 4 hours. It is issued by G6 Agency AG under licence from SICE, and it carries a number and a QR code. Your customer opens the public verification page and checks it without contacting you.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years. Billing is an automatic yearly subscription, and you can cancel it in your customer account to the end of the current year. If you cancel, the certificate ends with the paid year. Swiss and Liechtenstein customers pay 8.1% VAT, which is included in the prices. Combining several standards earns a discount of 20% for two and 30% for three or more.

• Start the free self-assessment
• See pricing
• How it works

The Zertify certificate rests on a self-assessment, with no on-site audit. A short online re-audit confirms it every year. For a practice, a therapy centre, a medical software vendor or a service provider to clinics, this is often what a supplier questionnaire asks for: proof that a documented system exists and can be checked.

The classic route means an on-site audit by a certification body. Read the tender or contract text before you decide. If it names a specific audit format, follow that wording. If it only asks for an ISO 27001 certificate, check what the buyer expects with a short message to their purchasing department.

• Compare the certification routes
• Certification without an on-site audit
• What certification costs