ISO 27799 implementation and requirements, so patient information stays protected wherever care happens.

What it is

What is ISO 27799 and what is it used for?

ISO 27799 is the international guidance on information security controls for health. Published by ISO through its health informatics committee, ISO/TC 215, it takes the general control catalogue in ISO/IEC 27002 and explains how each control should work where the information is a diagnosis, a scan, a prescription or a recorded consultation.

Its reach is wider than the electronic health record. The guidance covers ordinary ICT, health software and medical devices that run health software, and also the digital equipment behind environmental control, infection management, building operations and physical security on health premises. It applies to information in any form, including images, video and sound recordings, held on site or in the cloud, and to care given in hospitals, clinics, ambulances, mobile diagnostic units and remotely.

Health organisations use it to decide which safeguards a patient data environment needs, to show regulators and partners that those safeguards follow an international reference, and to give an ISO/IEC 27001 programme a control set that fits clinical reality.

Current edition. ISO 27799:2025, the third edition, was published on 18 December 2025. It is titled "Health informatics — Information security controls in health based on ISO/IEC 27002" and withdrew both ISO 27799:2016 and ISO/TS 14441:2013. Because it is guidance there is no certificate and no certification transition; organisations that aligned with the 2016 edition should review their control set against the new one.

Who it is for

Who needs ISO 27799?

Any organisation that creates, stores or shares personal health information can use ISO 27799, from a single clinic to a hospital group, a laboratory network, a telehealth platform or the supplier of a records system. Four situations usually bring health organisations to Sterling:

• A customer or health partner asks how you protect patient data. Hospital procurement teams and insurers want to see controls designed for health information, not a generic IT policy set.
• A tender asks for ISO/IEC 27001 with health-sector controls. Public and private health tenders increasingly expect a certified ISMS; ISO 27799 shapes the controls inside it.
• A regulator or national scheme points to it. In the Netherlands, for example, NEN 7510-2 combines ISO/IEC 27002 with ISO 27799. Check which reference your own regulator names.
• A group standardises security across its facilities. Hospitals, clinics and diagnostic centres acquired over time run different systems; one health control baseline gives the group a common language.

Requirements

What are the main ISO 27799 requirements?

Strictly, ISO 27799 sets out recommended controls and guidance rather than auditable requirements. It is built on ISO/IEC 27002:2022, so its controls sit in the same four themes, each read through the needs of health care. The requirements an auditor checks come from ISO/IEC 27001; the areas below are what a health control set built on ISO 27799 has to address.

• Organisational controls: policies, roles, supplier and cloud arrangements, incident handling and continuity, applied to clinical services and patient records.
• People controls: screening, confidentiality terms, awareness and responsibilities for clinicians, administrators, contractors and anyone else with access to health data.
• Physical controls: secure wards, records rooms, server rooms and equipment, including devices that move between departments, vehicles and patients' homes.
• Technological controls: access management, logging, backup, network and application security for health ICT, record systems and medical devices running health software.
• Health systems in scope: electronic health records, medical devices with health software, and the digital building, environmental and infection-management equipment on health premises.
• Information and settings in scope: text, images, video and sound recordings, on site or in the cloud, across hospital, ambulatory, mobile and remote care.

Putting it into practice

How do you implement ISO 27799 and prove it?

Implementing ISO 27799 ends in health controls that operate and records that show they do. Where a customer, tender or regulator wants independent proof, those controls run inside an ISO/IEC 27001 information security management system and that system is certified.

1. 01
   Map the health information and set the scope.Identify the services, sites, systems, devices and suppliers that create, hold or exchange patient information.
2. 02
   Gap assessment and risk assessment.Compare current safeguards with the ISO 27799 guidance, assess risks to confidentiality, integrity and availability of care, and choose the controls to apply.
3. 03
   Implement the controls with clinical and technical owners.Policies, access rules, device and supplier arrangements put into use, each with an owner and the records it produces.
4. 04
   Audit internally and review.Internal audit samples the controls on the wards and in the systems; management reviews incidents, risk treatment and findings and closes them with evidence.
5. 05
   Prove it, through ISO/IEC 27001 certification where needed.An accredited certification body carries out its Stage 1 readiness review and Stage 2 audit of the ISMS, decides on certification, then audits annually across a three-year cycle.

Check the route before you sign. A certificate issued "to ISO 27799" is not an accredited certificate, because the document contains guidance rather than certifiable requirements. For ISO/IEC 27001, the certification body works to ISO/IEC 17021-1 and ISO/IEC 27006-1; confirm its accreditation for information security with an accreditation body recognised under the Global ACI arrangement, and check the certificate scope names your health services.

Cost

How much does ISO 27799 implementation cost?

Cost follows the size of the health information estate, not the length of the standard. A clinic on one cloud records system is a very different programme from a hospital group with imaging, laboratory systems and hundreds of connected devices. Every Sterling proposal shows each component and states everything that is included.

Timeline

How long does ISO 27799 implementation take?

Pace depends on how many systems and suppliers hold patient data, how quickly clinical staff can be released for training, and how much technical change the risk assessment calls for. As an estimate, a health control set operating inside an ISMS typically takes four to eight months, including enough operating time to produce evidence before any certification audit.

Share any tender or regulator date at the start. We will tell you accurately what can be ready by then and which decisions need to be made early.

Your engagement

What your ISO 27799 engagement includes

Sterling does not certify, and there is no ISO 27799 certificate to issue; where proof is needed, an accredited certification body assesses your ISO/IEC 27001 system and makes the decision. Our work is to make the health controls real and the evidence ready, delivered through Sterling OS™.

• Design™: guided support

  Your team implements, with Sterling's methodology, templates, reviews and workshops at each stage.

• Drive™: managed delivery

  An alternative to Design™: our consultants carry the programme with your owners, from data mapping to internal audit.

• Health control set and Statement of Applicability

  Controls selected from ISO 27799 against your risks, with the reason for each choice recorded.

• Training for clinical and support staff

  Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Sustain™ after certification

  Internal audits, control reviews when systems or suppliers change and surveillance preparation.

• Automate™ with Effivity

  Risks, controls, incidents, audits and evidence run in Effivity, included with the engagement at no additional cost.

Certification decisions for ISO/IEC 27001 remain with the independent, accredited certification body.

Often combined with

Standards organisations pair with ISO 27799

• 21 CFR Part 11 / EU Annex 1121 CFR Part 11 and Annex 11 compliance for GxP systems: requirements, validation, audit trails and e-signatures, with evidence ready for FDA and EU inspectors.
• ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
• CAP accreditationCAP accreditation readiness for laboratories: checklist gap analysis, method records, self-inspection and peer inspection support.
• CIS ControlsCIS Controls implementation and requirements: the 18 Controls and 153 Safeguards of v8.1, Implementation Groups, assessment with no certificate, cost and time.
• CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.
• CSA STARCSA STAR certification consulting for cloud providers: CCM controls and evidence for a STAR Registry entry by self-assessment, certification or attestation.