ISO 27701 for healthcare: prove how you handle patient data

A clinic outsources its appointment booking. A laboratory sends results to doctors through a portal. A payroll provider serves a group of care homes. In each case health data moves to another company, and the sender stays responsible for it. Before signing, the purchasing department or the data protection officer wants evidence.

Health data counts as sensitive personal data under the revFADP and as a special category under the GDPR. Supplier questionnaires in this sector therefore ask the same things: who is controller, who is processor, where is the processing record, how fast do you answer a patient's access request, what happens after a breach. A certificate against ISO 27701 answers these questions with one document that the buyer can verify.

Tenders and partner onboarding follow the same pattern. If you attach the certificate with its number and QR code, the buyer checks it on the verification page and moves on. Some buyers expect an on-site audit by a certification body, others accept an online route. Ask your customer which one applies before you decide.

• Compare the certification routes

The standard describes a privacy information management system. It does not prescribe medical procedures. It asks how you handle personal data in each process, who is responsible and how you can show it afterwards.

The questionnaire uses the vocabulary of the standard. These are the terms you will meet most often.

Controller

The practice, clinic or laboratory that decides why and how patient data is processed.

Processor

The IT provider that hosts the patient record system, or the billing service that invoices on behalf of a practice. It acts on instructions.

Data subject

The patient, but also an employee, an applicant or a relative named in a file.

Record of processing activities

A list of processes such as appointment booking, lab results and billing, each with purpose, data categories, recipients and retention period.

Personal data breach

A discharge letter sent to the wrong address, a stolen laptop with patient files, or a staff member opening a file without a reason.

Privacy by design and by default

A new patient portal that asks only for the fields it needs and has data sharing switched off until the patient turns it on.

The six requirements below are the core of the assessment. For a healthcare organisation they translate into the following work.

1. 01

   Determine your role

   A group practice is controller for its patient files. The company that hosts those files is processor. A laboratory can be both, depending on the service. Write the role down per service.

2. 02

   Assess and treat privacy risks

   Go through each process and ask what could harm the patient: disclosure, loss, wrong correction. Record the measure next to each risk, for example encrypted result delivery.

3. 03

   Maintain the processing record

   One table, one row per process. Reception, laboratory, billing, recruitment and the patient app each get an entry with an owner who keeps it current.

4. 04

   Fulfil data subject rights on time

   Name one person who receives access and deletion requests, define where the data sits in each system, and set an internal deadline shorter than the legal one.

5. 05

   Build in privacy by design and by default

   Before a new system goes live, check which data it collects, who can see it and when it is deleted. Keep the check as a short form in the project folder.

6. 06

   Detect and notify breaches

   Give staff a single address for reporting incidents. Define who decides whether a breach must be notified and keep a log of every case, including the minor ones.

The 2025 edition is a stand-alone management system standard. A small practice or a health IT start-up can certify against it without holding an ISO 27001 certificate. The 2019 edition worked differently: it extended an existing ISO 27001 system and required one.

If you already run an ISO 27001 system, the privacy requirements fit into the structure you know: context, leadership, planning, support, operation, performance evaluation and improvement. If you do not, you only need to describe the privacy processes listed above. Buyers who also want proof of information security can ask for ISO 27001 separately.

• ISO 27001 certificate

The self-assessment has 42 yes/no questions. 15 of them are must-meet questions of the assessment and must all be answered yes. Of the other 27, at least 18 need a yes. SICE reviews every assessment, and Zertify issues the certificate under licence from SICE usually within 4 hours after you have passed and paid. No account is needed to buy.

There is no on-site audit. The certificate rests on your online self-assessment and is confirmed every year by a short online re-audit. Every certificate can be verified publicly by its number or by the QR code on the PDF, which is what a hospital's purchasing department will check.

The price is CHF 799 in the first year, then CHF 529 per year including the yearly online re-audit. The certificate is valid for 3 years. The subscription renews automatically and can be cancelled at any time in your customer account, effective at the end of the paid year. If you certify against two standards the discount is 20%, from three standards 30%, also on the yearly fee. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein.

• ISO 27701 standard page
• Pricing
• Start the free self-assessment