ISO 27799: Health Informatics Security Management Guide

ISO 27799 provides sector-specific guidance for implementing ISO 27001 in healthcare organizations. It interprets the general information security management requirements of ISO 27001 within the context of health informatics, addressing the unique challenges of protecting personal health information, securing clinical systems, and maintaining the availability of health services.

What ISO 27799 Covers

ISO 27799 does not replace ISO 27001 — it extends it with healthcare-specific guidance. The standard covers health information security governance, risk management specific to health data, access control for clinical systems, patient consent and authorization management, health information exchange security, mobile health and telehealth security, and the unique challenges of medical device environments.

The standard provides specific guidance on health data classification, addressing the spectrum from anonymized research data to highly sensitive psychiatric or HIV-related records. It also addresses the tension between data availability for clinical care and data protection for patient privacy — a challenge unique to healthcare where excessive security controls can endanger patients.

Who Should Implement ISO 27799

ISO 27799 is relevant to hospitals, clinics, health systems, health information exchanges, telehealth providers, health tech companies, clinical research organizations, and any organization managing personal health information. It is particularly valuable for organizations already pursuing ISO 27001 certification that need to ensure their ISMS adequately addresses healthcare-specific risks.

Implementation Approach

Implement ISO 27799 as an extension of your ISO 27001 ISMS. During the risk assessment phase, apply healthcare-specific threat scenarios and risk criteria from ISO 27799. Extend your Statement of Applicability to include health-specific control considerations. Address clinical system access control, health data classification, patient consent management, and medical device security within your ISMS. Train staff on health-specific information security policies.

Cost Considerations

When implemented alongside ISO 27001, incremental costs for ISO 27799 alignment range from $25,000 to $50,000 for health-specific risk assessment, policy development, and control implementation. Standalone implementation without existing ISO 27001 infrastructure costs $75,000 to $150,000. While there is no separate ISO 27799 certification, demonstrating alignment strengthens your ISO 27001 certification in the healthcare context and helps satisfy HIPAA and GDPR health data requirements.