Health organisations run ISO/IEC 27001 programmes built for offices, yet their riskiest assets are electronic health records, infusion pumps, imaging modalities and the building systems that keep wards running. ISO 27799 is the health sector guidance that interprets the ISO/IEC 27002 control set for that environment. The third edition, ISO 27799:2025, was published by ISO in December 2025 and replaced the 2016 edition, which ISO now lists as withdrawn. This guide explains what the standard covers, how it sits inside an ISMS, where identity and machine credentials matter in clinical settings, how to implement and evidence it, and how it maps to HIPAA, NIST CSF 2.0 and ISO 27001. It is for ISMS managers, CISOs and auditors at hospitals, clinics, digital health providers and anyone else that holds personal health information.
Key takeaways
- It is guidance, not a certification scheme: you certify an ISMS against ISO/IEC 27001 and use ISO 27799 to choose and implement controls for health information, in the same way 27017 works for cloud.
- The current edition is ISO 27799:2025: edition 3, 72 pages, published December 2025 by ISO/TC 215 and built on ISO/IEC 27002:2022; ISO 27799:2016 is withdrawn.
- Scope is broader than IT: the 2025 abstract covers EHRs, medical devices with health software or firmware, and building management, infection control, environmental and physical security systems on healthcare premises.
- Any size, any setting: it applies to any organisation that provides care or holds personal health information, on premises or in the cloud, from hospitals and ambulances to residential and virtual care.
- Clinical access is the hard part: shared workstations, emergency access, device service accounts and integration engine credentials are where health ISMS programmes most often fall short.
What it is and who it applies to
ISO 27799:2025, "Health informatics: Information security controls in health based on ISO/IEC 27002", is published by ISO/TC 215 Health informatics (not by JTC 1/SC 27, which owns the 27000 family). It is the third edition: the first appeared in 2008 and the second, ISO 27799:2016 "Information security management in health using ISO/IEC 27002", aligned to the 2013 versions of 27001 and 27002. The 2016 abstract excluded anonymisation and pseudonymisation methods, network quality of service and data quality, and those topics remain better served by other standards. It extends the generic control set described in the ISO 27002 Controls Guide with health-specific implementation guidance.
Scope from the ISO abstract (2025 edition)
| Scope dimension | What ISO lists | Practical examples |
|---|---|---|
| Systems | Generic IT, EHRs, medical devices containing health software or firmware, other digital equipment on premises | EHR and PACS servers, infusion pumps, patient monitors, building management, nurse call, access control and CCTV |
| Information | All forms, however captured, stored or transferred | Clinical notes, DICOM images, dictation audio, telehealth video, paper records scanned into the EHR |
| Organisations | Any size that provides care or holds personal health information, on premises or cloud | Hospitals, GP and dental practices, laboratories, insurers, health apps, cloud EHR providers |
| Settings | Hospitals, clinics, ambulances, mobile imaging and diagnostic units, residential care, remote and virtual care | Home monitoring kits, mobile scanners, community nursing laptops |
It is not a law. In the United States the binding rule is the HIPAA Security Rule, covered in the HIPAA Security Rule Guide; ISO 27799 is useful there as a control catalogue and for organisations that also operate internationally. Elsewhere, regulators and health systems often accept an ISO 27001 certificate whose Statement of Applicability (SoA) references 27799 as evidence of good practice; the Healthcare Cyber Regulation Map shows the binding rules by jurisdiction.
ISO 27799 compared with the HIPAA Security Rule
| Aspect | ISO 27799:2025 | HIPAA Security Rule |
|---|---|---|
| Nature | Voluntary international guidance | US federal regulation enforced by HHS Office for Civil Rights |
| Who | Any organisation providing care or holding personal health information, worldwide | US covered entities and business associates handling electronic protected health information |
| Form | Control guidance aligned to the 93 ISO/IEC 27002:2022 controls | Administrative, physical and technical safeguards, with required and addressable implementation specifications |
| Assurance | Through ISO/IEC 27001 certification, with 27799 cited in the SoA | No certification; compliance shown through documented risk analysis and safeguards |
| Information | All forms, including paper, audio and video | Electronic protected health information only (paper sits under the Privacy Rule) |
Many US providers use both: HIPAA defines what must be done, and ISO 27799 supplies a richer control catalogue and an internationally recognised way to evidence it, which matters to multinational research partners and cloud suppliers.
Structure and key requirements
Edition 3 is built on ISO/IEC 27002:2022, which arranges 93 controls into four themes: organisational (5.1 to 5.37), people (6.1 to 6.8), physical (7.1 to 7.14) and technological (8.1 to 8.34). For each control the health guidance confirms, extends or adds to the generic text. ISO's public abstract does not list the health-specific additions control by control, and NHI Mgmt Group has not reproduced the paid text, so obtain the standard before you write your SoA. The table shows where clinical environments typically change how a 27002 control is implemented.
| ISO/IEC 27002:2022 control | Why health differs | Practical implementation |
|---|---|---|
| 5.9 Inventory of information and assets | Medical devices and building systems sit outside IT asset tools | One inventory covering devices, firmware versions, network location and clinical owner |
| 5.15 to 5.18 Access control, identity, authentication, access rights | Shared clinical workstations, rotating staff, locums and students | Role based access tied to rota and HR feeds, fast user switching or tap and go badges, prompt leaver removal |
| 5.19 to 5.23 Suppliers and cloud | Device makers, EHR vendors and clearing houses hold data or remote access | Security clauses, remote support via controlled paths, cloud shared responsibility documented |
| 5.29, 5.30 Continuity and ICT readiness | Loss of systems affects patient safety, not just revenue | Tested clinical downtime procedures and recovery priorities agreed with clinical leads |
| 5.34 Privacy and protection of PII | Health data is special category data in many jurisdictions | Link the ISMS to the privacy programme; see the ISO/IEC 27701 Privacy Information Management Guide |
| 7.7 Clear desk and clear screen | Screens in public clinical areas, shared carts | Short lock timers with badge re-entry so clinicians do not defeat them |
| 8.8 Technical vulnerabilities | Regulated devices cannot be patched without the manufacturer | Manufacturer disclosure statements, compensating segmentation, risk acceptance signed by clinical owner |
| 8.15, 8.16 Logging and monitoring | Patients and regulators expect to know who viewed a record | Record access audit trails, inappropriate access ("snooping") reviews, VIP record monitoring |
| 8.22 Segregation of networks | Flat hospital networks expose devices | Clinical device zones; see the Hospital Clinical Network Segmentation Guide |
Identity and NHI requirements
Clinical environments contain a dense web of non-human identities: HL7 and FHIR integration engine accounts, PACS and modality service accounts, device management platforms, laboratory interfaces, claims and clearing house API keys, and the vendor support accounts behind all of them. Applying 27002 controls 5.16 Identity management, 5.17 Authentication information, 8.2 Privileged access rights and 8.5 Secure authentication means:
- Emergency access: clinicians need records when the normal path fails. Design break-glass access with named accounts, a stated reason, automatic alerting and retrospective review rather than shared emergency passwords. See the Break-Glass Account Guide.
- Remote access without MFA: the Change Healthcare breach began with a remote access login that had no MFA. Every remote path into clinical or claims systems should require phishing resistant MFA, including vendor support portals.
- Integration engine credentials: one interface account often reads and writes across EHR, laboratory and billing systems. Give each interface its own credential, scope it to the message types it needs, store it in a vault and alert on interactive logons.
- Medical device accounts: many devices ship with fixed maintenance passwords. Record them in the inventory, vault what can be vaulted, restrict network reach where they cannot be changed, and track manufacturer fixes.
- Certificates and API keys: FHIR APIs, e-prescribing and health information exchange rely on certificates and OAuth clients. Inventory them with owners and expiry dates; the Healthcare Identity Security Guide covers patterns.
Implementation steps
- Buy the 2025 edition: obtain ISO 27799:2025 and ISO/IEC 27002:2022, and retire references to the 2016 edition in policies and the SoA.
- Set ISMS scope around care delivery: include clinical systems, medical devices, building systems on premises, remote and virtual care services and cloud processors, and mark interfaces to out-of-scope systems.
- Build one asset inventory: combine IT assets, biomedical engineering device lists and facilities systems, with a clinical owner for each.
- Run a risk assessment with patient safety criteria: rate impact on care delivery and patient harm alongside confidentiality, and involve clinical safety officers. The ISO/IEC 27005 Information Security Risk Guide covers method.
- Rebuild the SoA: use the 2022 control structure and record, for each control, the 27799 guidance applied or the justified exclusion. See the ISO 27001 Statement of Applicability Template.
- Fix access first: MFA on all remote access, leaver processing within a day, break-glass design, vaulting of interface and device credentials.
- Pilot clinically: test new controls (lock timers, badge login, network filtering) on one ward or department with clinical sign-off, measure workflow impact, keep a rollback plan and expand in rings.
- Certify and maintain: have an accredited body audit against ISO/IEC 27001, then run surveillance audits and annual access reviews.
Small practice or hospital group
A GP or dental practice rarely needs certification; it can use 27799 as a checklist with focus on supplier contracts, MFA, backups and record access logging, as set out in the Cyber Security for Dental and GP Practices Guide. A hospital group needs a dedicated medical device security function, a central identity platform linked to rostering, and a formal link between the ISMS, clinical safety and biomedical engineering.
Evidence and assessment
| Evidence | What an auditor checks | Metric to track |
|---|---|---|
| Scope statement and combined asset inventory | Medical devices and building systems included, owners named | Percentage of networked medical devices in the inventory with owner and firmware version |
| Risk assessment | Patient safety and care continuity criteria used | Open high risks past target date |
| SoA in the 2022 structure with 27799 guidance | Every control addressed, exclusions justified | Open SoA gaps |
| Record access audit and snooping reviews | Logs retained, reviews performed, outcomes acted on | Inappropriate access alerts reviewed within 5 working days |
| Joiner, mover, leaver records | Timely removal for staff, locums and contractors | Median hours from leaving to account disablement |
| Break-glass and remote access logs | Every emergency use reviewed, MFA on remote paths | Percentage of break-glass events reviewed; remote paths without MFA (target zero) |
Mapping to other frameworks
| Topic | ISO/IEC 27001:2022 Annex A | NIST CSF 2.0 | HIPAA Security Rule (45 CFR Part 164) |
|---|---|---|---|
| Risk analysis | Clauses 6.1.2, 8.2 | ID.RA | 164.308(a)(1)(ii)(A) risk analysis |
| Asset inventory | A.5.9 | ID.AM-01 | Supports risk analysis |
| Identities and credentials | A.5.16, A.5.17, A.8.5 | PR.AA-01 | 164.312(a)(2)(i) unique user identification; 164.312(d) authentication |
| Access rights and emergency access | A.5.15, A.5.18, A.8.2 | PR.AA-05 | 164.308(a)(4) access management; 164.312(a)(2)(ii) emergency access procedure |
| Logging and monitoring | A.8.15, A.8.16 | DE.CM-01 | 164.312(b) audit controls |
| Suppliers | A.5.19 to A.5.22 | GV.SC-05, GV.SC-07 | 164.308(b) business associate contracts |
| Physical security | A.7.1 to A.7.4 | PR.AA-06 | 164.310 physical safeguards |
| Data protection at rest | A.8.24 | PR.DS-01 | 164.312(a)(2)(iv) encryption and decryption |
For medical device makers, the device lifecycle standards matter more than 27799: see the IEC 81001-5-1 Health Software Security Lifecycle Guide and the FDA Medical Device Cybersecurity Guide.
Common pitfalls
- Citing the withdrawn edition: SoAs and policies that still reference ISO 27799:2016 and the 2013 control numbers look stale to auditors.
- Leaving devices and facilities out of scope: the 2025 abstract explicitly brings medical devices and building systems in, and attackers use them as pivots.
- Controls clinicians bypass: two minute screen locks without badge re-entry lead to propped open sessions and shared logins.
- Shared emergency passwords: a break-glass password on a sticky note gives no accountability; use named emergency access with review.
- Remote access without MFA: as the Change Healthcare case showed, one unprotected remote login can halt claims processing across a national health system.
- Logging without review: record access logs nobody reads do not detect snooping or misuse.
- Treating the cloud EHR as the vendor's problem: the 2025 scope covers health information held in the cloud, so the SoA must show which controls the provider operates, which you operate, and how you verify the provider's side through contracts, attestations and access reviews of vendor support accounts.
Practitioner checklist
- Obtain ISO 27799:2025 and remove references to the 2016 edition.
- Scope the ISMS to include medical devices, building systems and virtual care.
- Merge IT, biomedical and facilities inventories with clinical owners.
- Add patient safety and care continuity to risk criteria.
- Rebuild the SoA in the 2022 structure with 27799 guidance noted per control.
- Enforce phishing resistant MFA on every remote and vendor access path.
- Implement named break-glass access with alerting and review.
- Vault integration engine, device and API credentials with named owners.
- Review record access logs for inappropriate access every month.
- Test clinical downtime and recovery procedures at least once a year.
Standards and references
- ISO: ISO 27799:2025 Health informatics, Information security controls in health based on ISO/IEC 27002
- ISO: ISO 27799:2016 (withdrawn)
- ISO: ISO/IEC 27002:2022 Information security controls
- ISO: ISO/IEC 27001 Information security management systems
- eCFR: 45 CFR Part 164 Subpart C, Security Standards for the Protection of Electronic Protected Health Information
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: HIPAA Security Rule Guide · Healthcare Identity Security Guide · Medical Device Security Guide · ISO 27001 Certification Guide. This guide summarises ISO 27799 as listed by ISO at 8 November 2026 and is not legal advice.