Short answer: ISO/IEC 27001 specifies an information security management system (ISMS): how an organisation identifies its information risks, chooses controls, runs them and improves them, with an auditor certifying the result. Its companion ISO/IEC 27002 describes the controls themselves. ISO 27799 (health informatics: information security management in health using ISO/IEC 27002) takes those controls and says how to apply them to personal health information: minimum requirements, health-specific risks, and controls a hospital or health software supplier should treat as mandatory rather than optional. You certify against 27001; you use 27799 to decide what the certificate must cover when the data is health data. Hospitals and national programmes increasingly ask for the certificate plus proof that the health specifics were considered, or for a national scheme that embeds them.
ISO/IEC 27001:2022 in one paragraph
ISO/IEC 27001:2022 is the certifiable international standard for an information security management system. Clauses 4 to 10 set requirements for context, leadership, risk-based planning, support, operation, performance evaluation and improvement; Annex A lists 93 controls in four themes, selected and justified in a Statement of Applicability. Certification involves a two-stage audit, annual surveillance and recertification every three years.
The standard has ten clauses; clauses 4 to 10 are the requirements: context and scope, leadership, planning (risk assessment and treatment, objectives), support (resources, competence, documentation), operation, performance evaluation (monitoring, internal audit, management review) and improvement. Annex A lists 93 controls in four themes (organisational, people, physical, technological), reorganised in 2022 from the 114 controls of the 2013 edition, with new ones for threat intelligence, cloud services, ICT readiness for business continuity, data masking, data leakage prevention, monitoring, web filtering and secure coding. You do not have to implement every control; you have to justify, in a Statement of Applicability, which ones you apply and why the others are not relevant. Certification is a stage 1 and stage 2 audit, then annual surveillance and recertification every three years.
What ISO 27799 adds
ISO 27799 adds health-specific guidance to the ISO/IEC 27002 controls: for personal health information it makes several controls mandatory, including unique user identification, role- and care-relationship-based access control, audit logging of every access to health records, encryption on mobile devices and in transit, secure disposal, incident management and business continuity, and it describes threats specific to health organisations.
27799 (current edition 2016) walks through the 27002 controls and, for each, states what health organisations should do. It raises several from "should consider" to "shall": a documented information security policy specific to health information; unique user identification (no shared accounts in clinical systems); access control based on role and on the care relationship; audit logging of every access to personal health information, retained and reviewable; encryption of health information on mobile devices and in transit; secure disposal; incident management that includes privacy breaches; and business continuity because an unavailable record can harm a patient. It also explains health-specific threats: insider browsing of records of known people, mis-filing between patients, the weak point of research extracts, and the long retention periods that keep old data exposed.
The two together, and the neighbours
ISO/IEC 27001 and ISO 27799 work together: 27001 is the certifiable management system and 27799 the health-sector guidance on which controls to include. Neighbouring standards and schemes cover needs: ISO 27701 for privacy, ISO 27017 and 27018 for cloud, SOC 2 and HITRUST for US customers, HDS (France), C5 (Germany), the NHS DSPT (England) and ENS (Spain) for national procurement.
| Standard or scheme | Type | Use it for |
|---|---|---|
| ISO/IEC 27001:2022 | Certifiable ISMS requirements | The certificate hospitals and tenders ask for |
| ISO/IEC 27002:2022 | Control guidance | Implementing Annex A controls |
| ISO 27799:2016 | Health-sector guidance | Scoping and justifying controls for health data; evidence in due diligence |
| ISO/IEC 27701:2019 | Privacy extension to 27001/27002 | Showing GDPR-aligned privacy management as controller and processor |
| ISO/IEC 27017 and 27018 | Cloud security and cloud privacy guidance | Cloud providers and SaaS handling personal data |
| SOC 2 (AICPA) | US attestation report (Type I or II) on trust criteria | US customers and investors; not a certificate |
| HITRUST CSF | US healthcare framework and certification | US health systems and payers that require it |
| HDS (France) | Mandatory certification for hosting health data in France | Any provider hosting French health data; built on 27001 |
| C5 (Germany) | BSI cloud attestation | German public sector and hospital procurement |
| NHS DSPT (England) | Annual self-assessment toolkit | Any supplier to the NHS |
| ENS (Spain) | National security framework | Spanish public sector systems |
| IEC 81001-5-1 | Secure product lifecycle for health software | Medical device software cybersecurity, alongside IEC 62304 |
Most of these overlap heavily with 27001's control set; organisations map once and reuse the evidence. Several national schemes (HDS, C5, ENS) are built on 27001 and add sector or country requirements, which is why 27001 is the sensible first certificate for a health-tech company selling in Europe.
What to certify, and when
For a health-tech company selling in Europe, the usual order is to certify ISO/IEC 27001 first, scoped to the platform and the teams that run it, after implementing the health controls from ISO 27799 (per-record access logs, relationship-based access, encryption, no shared accounts, tested restores), then add ISO 27701, HDS, C5 or SOC 2 when a market demands them.
- Scope narrowly and honestly: the platform and the teams that run it, not the whole company's laptops, unless they touch the data. Hospitals read the scope statement.
- Do the health specifics even before certification: access logs per patient record, role- and relationship-based access, encryption everywhere, no shared accounts, tested restores. A hospital's security questionnaire asks for these; 27799 is the checklist.
- Certify 27001 first, add 27701 if you process as a controller and processor for many customers, add HDS or C5 when a market demands it, SOC 2 when US customers do.
- Keep the GDPR link visible: Article 32 asks for security appropriate to the risk, and a 27001 certificate with a 27799-informed scope is the most recognised way to show it. The DPIA's measures section and the ISMS risk treatment plan should be the same list. See DPIA for a health app.
- NIS2 (for entities in scope) and the proposed HIPAA Security Rule update both read like 27001 Annex A with mandatory multi-factor authentication and incident reporting; one ISMS answers all three. See NIS2 for hospitals and vendors.
In Anpheros
Anpheros runs its security programme along ISO 27001's structure with the health controls 27799 treats as mandatory: per-record access logs the person can read, access scoped by consent and time, encryption at rest and in transit, EU hosting, no shared accounts, tested backups, and an incident process with the GDPR 72-hour clock. The developer site documents the platform security and the audit found in the October 2026 security review.
This page explains regulation for product and engineering teams. It is not legal advice; the texts linked under Sources are the authority, and your data protection officer, notified body or counsel decides for your case. Last reviewed: October 2026.
Related pages
- NIS2 for hospitals and health-tech vendors
- DPIA for a health app
- HIPAA vs GDPR
- Who viewed my medical record?
- Health data regulation map
- Platform security (developer site)
Sources
- ISO/IEC 27001:2022
- ISO/IEC 27002:2022
- ISO 27799:2016, Health informatics: information security management in health using ISO/IEC 27002
- ISO/IEC 27701:2019
- ANS (France): HDS certification
- BSI (Germany): C5 criteria catalogue
- NHS England: Data Security and Protection Toolkit
Frequently asked questions
Can I get certified against ISO 27799?
No. 27799 is guidance; certification bodies certify ISO/IEC 27001. You can have the 27001 scope and Statement of Applicability reference 27799 so the certificate demonstrably covers health-specific controls.
Is SOC 2 equivalent to ISO 27001?
They overlap but differ in kind: SOC 2 is an auditor's report on controls over a period against trust criteria, common in the US; 27001 is a certified management system, common in Europe and internationally. Many health-tech companies hold both.
Do I need HDS to serve French clinics?
If you host health data for French care providers, yes: HDS certification is a legal requirement under the French public health code, and most French customers will not sign without it. It builds on 27001, so start there.
How long does ISO 27001 take?
For a focused scope with a committed team, six to twelve months from start to certificate, most of it spent making the controls real and gathering evidence. The audit itself is a few days.
Try it free in the sandbox
Your first FHIR call in 5 minutes. An HL7 FHIR R4 API with the patient's consent built in: try it in the sandbox, then connect your own app or clinic system.
Free · 30 synthetic patients · no card
Anpheros builds a medical record that the patient controls and can share with any clinic, on an HL7 FHIR R4 platform, based in the EU. These guides help you understand and organise your health; they do not replace your doctor.
About Anpheros →
AnpherosThe more you log, the clearer your record
Your health history in one place, under your control.
Free · Works in your browser · No card
