ISO 27018 for healthcare: certify your cloud service online

A clinic, a medical practice group or a care provider that buys cloud software sends a supplier questionnaire to the vendor first. One line asks for evidence that personal data is protected in the cloud. ISO 27018 is a recognised answer to that line.

The reason is the split of roles. The healthcare organisation decides why patient data is processed. Your company, as the cloud provider, processes it on instruction. The customer stays accountable towards patients and supervisory authorities, so it has to show that it chose a processor with defined controls. A certificate on the vendor side makes that choice easier to document.

Tenders work the same way. A tender document may list the certificate as a requirement or as an evaluation criterion, and a bidder without it can be sorted out at the first check. If the PDF is ready before the tender arrives, you do not lose days finding it.

• ISO 27018 in detail

Cloud services for the sector handle some of the most sensitive personal data there is: appointment bookings, lab results, referral letters, video consultations. ISO 27018 builds on the ISO 27001 controls and adds privacy rules for processors. Six requirements carry most of the weight, shown here with an example from healthcare.

Transparency about data processing

A patient portal vendor tells each clinic customer which data it processes, where, and for which service. Nothing happens behind the contract.

Purpose limitation

Appointment data is used to run the booking service. It is not reused for product analytics or marketing unless the clinic instructs it in writing.

Deletion and return of PII

When a practice ends its contract, it receives its records in an agreed format. The provider then deletes the remaining copies, backups included, on a defined schedule.

Sub-processors

A telemedicine provider runs video on third-party infrastructure. The clinic knows who that party is, and the provider binds it to the same privacy terms.

Data protection impact assessments

Before launching a symptom checker that stores free-text input, the provider assesses the risk to patients and records the measures it takes.

Notification of data breaches

A misconfigured storage folder exposes lab reports. The provider informs the clinic without delay, so the clinic can meet its own duties.

Most of the work is writing down what your team already does and closing the gaps. For a company that offers cloud software to clinics, the steps look like this.

1. 01

   Map where health data sits

   List every system that stores or passes on patient data: production database, backups, support tickets, log files, test environments.

2. 02

   Fix the purposes

   Describe per service what the data may be used for. Put the same wording into your customer contract and your internal rules.

3. 03

   Define a deletion routine

   Decide how long data stays after contract end, how customers export it and how deletion is confirmed to them.

4. 04

   Keep a sub-processor register

   Record each hosting, support or email provider that touches customer data, with its location and the contract that binds it.

5. 05

   Prepare the breach procedure

   Name who decides, who calls the customer and which information the customer receives. Run the procedure once as a drill.

6. 06

   Assess new features

   Add a short impact check to your release process for anything that collects new categories of health data.

The standard is meant for companies that process personal data in the cloud on behalf of others. In healthcare that includes vendors of practice management software, patient portals, telemedicine platforms, lab and imaging platforms, appointment booking tools, and HR or payroll software sold to hospitals. A clinic that only uses such services is a customer, not a candidate for the certificate.

If your customers also ask about information security in general, ISO 27001 is the usual second certificate. Zertify gives a discount when you certify several standards.

• ISO 27001
• ISO for small and medium businesses

You start the self-assessment without an account. It has 32 yes/no questions. Eleven of them are mandatory requirements of the standard and must all be answered yes. Among the other 21 questions you need at least 14 yes answers. After passing and payment, the certificate follows within 4 hours.

G6 Agency AG issues the certificate under licence from SICE, and SICE reviews every assessment before issue. Each certificate carries a number and a QR code on the PDF. A buyer scans the code or enters the number on the public verification page and sees that the certificate is genuine.

The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years. Billing is an automatic yearly subscription that you can cancel at any time in the customer account, effective at the end of the current year. The certificate then ends with the paid year. For 2 standards you get 20% off, for 3 or more 30%, also on the yearly fee. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein.

• Start the free self-assessment
• See pricing
• Standard page ISO 27018

Both routes lead to a certificate for the same standard. They differ in how the evidence is collected and how the result is confirmed.

• Compare the certification routes
• Certification without an on-site audit
• Cost of certification