ISO 27799 is an international standard for information security management in the healthcare industry. It provides guidelines for establishing, implementing, maintaining, and continually improving an information security management system (ISMS) specifically for healthcare organizations. The standard is based on the ISO 27001 standard, but includes additional requirements and controls that are specific to the healthcare industry.
ISO 27799 covers the protection of sensitive healthcare information, including personal health information (PHI), electronic health records (EHRs), and medical images. It includes requirements for risk assessment, incident management, business continuity management, and compliance with legal and regulatory requirements.
The standard includes controls for:
- Access control
- Network security
- Mobile device security
- Incident management
- Business continuity management
- Compliance with legal and regulatory requirements
ISO 27799 is intended to help healthcare organizations protect sensitive patient information and comply with relevant regulations and laws, such as the Health Insurance Portability and Accountability Act (HIPAA) and the General Data Protection Regulation (GDPR). Compliance with the standard can also help organizations to protect their reputation, demonstrate their commitment to information security and provide assurance to their patients, customers, and other stakeholders.
Like ISO 27001, the certification process for ISO 27799 includes an initial assessment and a surveillance audit to ensure that the organization continues to meet the requirements of the standard. Organizations can achieve certification to ISO 27799 by demonstrating that their ISMS meets the requirements of the standard and passing an assessment by an accredited certification body.
