Integrated programme
ISO/IEC 27001 and HIPAA together: a certified security system around the US health data law: video
A film on building an ISO/IEC 27001 information security management system around the HIPAA Security Rule, for healthcare BPOs, billing companies and health technology providers.
Key takeaways
- HIPAA is a US law; no government body certifies HIPAA compliance.
- ISO/IEC 27001 gets most of the way, but HIPAA has its own specific requirements.
- One documented risk process serves the HIPAA risk analysis and ISO/IEC 27001.
- Business associate agreements and breach procedures are added to the system.
- HIPAA can apply outside the US to business associates of US covered entities.
A certifiable standard and a US law
Healthcare BPOs, medical billing and coding companies, health technology providers and US healthcare organisations must protect electronic protected health information under HIPAA, and are often asked for ISO/IEC 27001 too. The two are different in kind. ISO/IEC 27001 is a management system standard that an accredited body certifies. HIPAA is a US law: no government body certifies compliance, and any badge claiming otherwise is private, not a legal status.
ISO/IEC 27001 does not make an organisation HIPAA compliant on its own, but it gets most of the way. This short film walks through how one control set addresses both the HIPAA Security Rule safeguards and the ISO/IEC 27001 management system.
Healthcare BPOs, medical billing and coding companies and health technology providers are the organisations most often asked for both.
Required HIPAA specifications are implemented as written, while addressable ones are assessed for fit and, where not adopted, documented with an equivalent alternative.
One risk analysis, one control set, the HIPAA specifics added
The HIPAA risk analysis and the ISO/IEC 27001 risk assessment become one documented process. HIPAA's administrative, physical and technical safeguards are then met through the ISO/IEC 27001 controls, mapped one to the other, so the same policies and records serve both. HIPAA's own requirements, such as business associate agreements and breach notification, are mapped and added to the system, with vendor reviews and breach procedures in place.
The result is proof for two audiences: a certificate for the management system from an accredited certification body, and documented HIPAA compliance for US clients, shown through the risk analysis, safeguards, policies, training and agreements. HIPAA reaches organisations outside the United States when they act as business associates handling protected health information for US covered entities, which is why the combination is common in offshore healthcare services.
Sterling builds the system and the evidence under Sterling OS™, led by one consultant and held in Effivity for one agreed fee. It does not certify ISO/IEC 27001, and nobody certifies HIPAA compliance.
ISO/IEC 27001 at a glance
- Purpose
- Information security management: protecting the confidentiality, integrity and availability of information through assessed risks and chosen controls
- Relevant to
- Any organisation holding client, personal or business-critical information, from technology and BPO to financial services, healthcare and public-sector suppliers
- Edition
- ISO/IEC 27001:2022 with Amendment 1:2024; 2013-edition certificates lapsed on 31 October 2025
- Certification
- Assessed and decided by an independent certification body accredited to ISO/IEC 17021-1 and ISO/IEC 27006-1
- Sterling's role
- Consulting with your team, Effivity, training, vulnerability assessment, internal audit and certification readiness, then Sustain™
- Cost and timing
- Total investment for an ISO/IEC 27001 ISMS depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 4 to 8 months
ISO/IEC 27001: questions people ask
Is ISO/IEC 27001 only for IT companies?
No. It applies to any organisation that holds information worth protecting, which is every organisation with clients, employees or a bank account. IT firms, BPOs and financial services feel the demand first because their clients ask; law firms, healthcare providers and public bodies certify for the same reasons.
What is the difference between ISO/IEC 27001 and SOC 2?
ISO/IEC 27001 is an international management system standard; an accredited certification body audits it and issues a certificate with a defined scope. SOC 2 is an attestation report on a service organisation's controls against the AICPA Trust Services Criteria, issued by a CPA firm and expected mainly by US clients. They overlap heavily in the controls examined, so one evidence base can serve both, but neither replaces the other; ask your clients which they accept.
How many controls does ISO/IEC 27001 have, and do we need all of them?
Annex A of the 2022 edition lists 93 reference controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological. You are not required to implement every one. You must select controls from your risk treatment, compare the selection with Annex A so nothing necessary is missed, and record in the Statement of Applicability which controls apply, why, and whether they are implemented, with a justification for any you exclude.
Do we need a penetration test to get certified?
The standard requires you to manage technical vulnerabilities and assess risks; it does not prescribe a particular test. A vulnerability assessment is included in a Sterling ISMS engagement, and its findings feed the treatment plan. Whether a deeper penetration test is warranted depends on your risks, your clients' contracts and your regulator.
Does Sterling issue the ISO/IEC 27001 certificate?
No. Sterling consults, trains and prepares. An independent certification body accredited to ISO/IEC 17021-1 and ISO/IEC 27006-1 audits the ISMS in two stages and decides. A provider offering consulting and the certificate on one invoice is selling paper.
Keep exploring
Related to this video
The complete guide
Everything on ISO/IEC 27001
Start with the ISO/IEC 27001 page · HIPAA, or go straight to the guide you need.
On the ISO/IEC 27001 page
- What are the main ISO/IEC 27001 requirements?
- How do you get ISO/IEC 27001 certified?
- How much does ISO/IEC 27001 certification cost?
- How long does ISO/IEC 27001 certification take?
- Who needs ISO/IEC 27001 certification?
- How ISO/IEC 27001 protects information and wins client trust
- Frequently asked questions about ISO/IEC 27001
Guides
- ISO 27001 2013 certificate expired? What to do now the transition has closed
- ISO/IEC 27001 Annex A
- ISO/IEC 27001 audit questions
- ISO/IEC 27001 benefits
- ISO 27001 case study
- ISO/IEC 27001 certification process, step by step
- ISO/IEC 27001 checklist
- Choosing an ISO/IEC 27001 certification body
- ISO/IEC 27001 common mistakes
- ISO/IEC 27001 certification cost
- Decision guide
- ISO/IEC 27001 documentation
- Effivity for ISO/IEC 27001
- ISO/IEC 27001 gap analysis
- ISO/IEC 27001 implementation plan
- Integrating ISO/IEC 27001 with ISO/IEC 27701 and ISO 22301
- ISO/IEC 27001 internal audit
- ISO/IEC 27001 management review
- ISO/IEC 27001 nonconformities
- ISO/IEC 27001 requirements explained
- ISO/IEC 27001 risk assessment and treatment, step by step
- ISO/IEC 27001 scope
- ISO/IEC 27001 for small businesses and start-ups
- ISO/IEC 27001 Stage 1 and Stage 2 audits
- The ISO/IEC 27001 Statement of Applicability
- Supplier security review
- ISO/IEC 27001 surveillance and recertification
- ISO/IEC 27001 timeline
- ISO/IEC 27001 training
- How to verify an ISO/IEC 27001 certificate, and how to spot a fake or a misleading one
- ISO/IEC 27001 vs SOC 2
By country
By industry
- ISO/IEC 27001 for banking, fintech and financial services
- ISO/IEC 27001 for BPO and shared services
- ISO/IEC 27001 for government suppliers and public bodies
- ISO/IEC 27001 for healthcare and health-data processors
- ISO/IEC 27001 for professional and legal services
- ISO/IEC 27001 for software, SaaS and technology
- ISO/IEC 27001 for telecommunications and data centres
Often combined with ISO/IEC 27001
More videos: Integrated programmes
- ISO/IEC 27001, PCI DSS and HIPAA together: card data and health data under one control setIntegrated programme · 3 min 14 s
- ISO/IEC 27001, SOC 2 and HIPAA together: what US healthcare clients ask a provider to showIntegrated programme · 3 min 14 s
- ISO/IEC 27001, PCI DSS, SOC 2 and HIPAA together: four frameworks, one control setIntegrated programme · 3 min 14 s
- PCI DSS and HIPAA together: patient payments and health data, protected as oneIntegrated programme · 3 min 14 s
- PCI DSS, SOC 2 and HIPAA together: what US healthcare and payments clients ask forIntegrated programme · 3 min 14 s
- SOC 1 and SOC 2 together: two reports, one control environmentIntegrated programme · 3 min 5 s
- ISO 9001, ISO 14001 and ISO 45001 together: one QHSE systemIntegrated programme · 3 min 14 s
- ISO 9001 and ISO 45001 together: quality and safety in one systemIntegrated programme · 3 min 14 s
- ISO 9001 and ISO/IEC 27001 together: quality and information security in one systemIntegrated programme · 3 min 14 s
Talk to a consultant
Plan your ISO/IEC 27001 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice