ISO 27017 for healthcare: prove who protects patient data in the cloud

Health data now lives in cloud services: the practice management system, the appointment portal, the archive for imaging, the platform for video consultations. When a clinic or a group of practices buys such a service, its purchasing department sends a supplier questionnaire. One block of that questionnaire is about cloud security, and it is rarely answered well with a general statement.

ISO 27017 gives a concrete answer. It is a code of practice for cloud services and it deals with the question buyers actually care about: who does what. Who separates one customer's data from another's, who may log in as administrator, what happens to the data when the contract ends.

Whether a tender lists the standard as a requirement depends on the buyer. Some name it, others accept it as proof in the questionnaire. In both cases a certificate with a number and a QR code saves the back and forth of explaining your setup in free text.

• About ISO 27017

The standard does not care whether the data is a diagnosis or an invoice. It looks at the cloud service around it. These are typical healthcare cases where its controls apply.

Patient record system as SaaS

Several practices share one platform. The vendor must show how each practice's records are kept apart and who at the vendor can see them.

Imaging archive in the cloud

Large image files are stored and retrieved by external specialists. Access rights, administrator access and deletion after the retention period must be defined.

Telemedicine platform

Video sessions and chat run on virtual servers. Virtualisation security and incident handling decide how a failure affects live consultations.

Laboratory result portal

Results are published to referring doctors and patients. The provider and the laboratory must agree who monitors logins and who reports an incident.

Backup and hosting of practice data

A managed service provider runs servers for a clinic. The contract should state who patches, who restores and how data is returned if the clinic changes provider.

The six main requirements of ISO 27017 translate into everyday decisions. The table shows what each one looks like for a company that handles health data in the cloud.

Most of the work is writing down what you already do. A few hours with the person who manages IT and the person who signs provider contracts are usually enough to gather the answers.

1. 01

   List your cloud services

   Note every service that stores or processes patient data, from the record system to the e-mail archive.

2. 02

   Write the responsibility split

   For each service, record what the provider does and what your team does. Use the provider's contract and security documents.

3. 03

   Check administrator access

   Know who holds privileged accounts, how they sign in and where their actions are logged.

4. 04

   Clarify data return and deletion

   Find the contract clause that covers the end of the relationship and confirm that it names format and deletion.

5. 05

   Name incident contacts

   Put the provider's reporting channel and your internal responsible person in one document that staff can find.

The self-assessment for this standard has 34 yes/no questions. Twelve of them are mandatory requirements of the standard and must all be answered yes. Among the other 22 you need at least 15 yes answers. No on-site audit takes place. G6 Agency AG issues the certificate under licence from SICE, and SICE reviews every assessment before it is issued.

After you pass and pay, the PDF arrives within 4 hours. Its certificate number and QR code lead to a public verification page, so a hospital's purchasing department can check it without contacting you. You do not need an account to buy.

The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years. The yearly subscription renews automatically and can be cancelled at any time to the end of the current year in your customer account. After cancellation the certificate ends with the paid year. Swiss and Liechtenstein customers pay 8.1% VAT, which is included in the prices. If you certify two standards, the discount is 20%, for three or more it is 30%, also on the yearly fee.

• Start the free self-assessment
• See pricing
• ISO 27017 certificate

ISO 27017 extends ISO 27001 and ISO 27002 with controls for cloud services. A vendor that wants to show a full information security management system will look at ISO 27001 as well. A company that mainly needs to answer the cloud block of a questionnaire can start with ISO 27017.

Some buyers want a certificate from the classic route with an on-site audit by a certification body. Others accept an online assessment. Ask the buyer which they expect before you decide. The guides below compare both routes.

• ISO 27001
• Compare certification routes
• Certification without an on-site audit