Written and maintained by CASRAI Editorial Board
Last updated
Chief Information Security Officers (CISOs), Data Protection Officers (DPOs), and clinical research compliance teams evaluating ISO 27701—formally published as ISO/IEC 27701:2019 (Security techniques — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management — Requirements and guidelines)—use this international standard to establish, audit, and certify a formal Privacy Information Management System (PIMS). While ISO/IEC 27001 governs the confidentiality, integrity, and availability of information systems, ISO/IEC 27701 layers auditable privacy governance controls onto an existing Information Security Management System (ISMS) for organizations acting as Personally Identifiable Information (PII) Controllers, PII Processors, or both.
What Is ISO 27701 and How Is It Used in Clinical Research and Healthcare?
ISO/IEC 27701 is a sector-neutral, certifiable management system extension standard developed jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Because ISO 27701 is designed as an extension rather than a standalone management system in its 2019 architecture, an organization must hold—or simultaneously implement and audit—an accredited ISO/IEC 27001 ISMS certification as the foundational prerequisite for ISO 27701 PIMS certification.
In multi-regional clinical trials, genomics repositories, and healthcare SaaS ecosystems, organizations operate under overlapping privacy regimes—including the EU General Data Protection Regulation (GDPR), the U.S. HIPAA Privacy and Security Rules, the UK Data Protection Act, and state biometric/consumer privacy laws. Rather than maintaining disconnected compliance spreadsheets for each jurisdiction, clinical research sponsors, Contract Research Organizations (CROs), and Electronic Health Record (EHR) cloud vendors use an ISO 27701 PIMS to unify privacy operations inside a single Statement of Applicability (SoA).
Structural Architecture of ISO/IEC 27701: Clauses 5–8 and Normative Annexes A & B
ISO/IEC 27701:2019 is organized into four technical requirement/guidance clauses (Clauses 5 through 8), two normative control annexes (Annex A and Annex B), and four informative mapping annexes (Annexes C through F):
| ISO/IEC 27701 Section | Relationship to ISO 27001 / 27002 | Scope & Control Count | Core Technical & Privacy Governance Focus |
|---|---|---|---|
| Clause 5 PIMS-Specific Requirements Related to ISO/IEC 27001 |
Extends ISO/IEC 27001 Clauses 4–10. | Applies to all PIMS deployments (Controllers & Processors). | Expands every occurrence of “information security” in ISO 27001 to “information security and privacy,” requiring organizations to define their role as a PII Controller and/or PII Processor (Clause 5.2.1) and incorporate privacy risks into the ISMS risk assessment (Clause 5.4.1.2). |
| Clause 6 PIMS-Specific Guidance Related to ISO/IEC 27002 |
Extends ISO/IEC 27002 security control domains. | 33 augmented security controls across ISO 27002 domains. | Adds privacy-specific implementation rules to existing security controls—including mobile device ePHI/PII handling, cryptographic key management, access logs, data backup retention, and information security incident response notification timelines. |
| Clause 7 & Normative Annex A Guidance & Controls for PII Controllers |
Net-new normative privacy control set for Controllers. | 31 privacy controls across 4 Annex A domains. | Governs organizations that determine the purposes and means of processing PII (e.g., Pharmaceutical Trial Sponsors, Academic Medical Centers, HIPAA Covered Entities). |
| Clause 8 & Normative Annex B Guidance & Controls for PII Processors |
Net-new normative privacy control set for Processors. | 18 privacy controls across 4 Annex B domains. | Governs organizations that process PII strictly on behalf of and under documented instructions from a Controller (e.g., CROs, EDC/ePRO platforms, Cloud EHR vendors, HIPAA Business Associates). |
PII Controller (Annex A) vs. PII Processor (Annex B) Control Objectives Compared
When preparing the ISO 27701 Statement of Applicability (SoA), an organization must declare whether its certification scope covers Annex A (PII Controller), Annex B (PII Processor), or both. Both annexes are structured across the same four functional privacy pillars, but assign distinct legal and technical duties:
| Privacy Control Pillar | Annex A: PII Controller Controls (31 Controls) | Annex B: PII Processor Controls (18 Controls) | Clinical Research & Healthcare Application |
|---|---|---|---|
| 1. Conditions for Collection & Processing (A.7.2 / B.8.2) |
Identify and document specific purposes, establish lawful basis, obtain and record verifiable consent (A.7.2.3), and conduct a Privacy Impact Assessment (PIA / DPIA, A.7.2.5) before new processing. | Ensure customer agreement defines scope (B.8.2.1), process PII strictly per Controller’s documented instructions (B.8.2.2), never use PII for marketing/secondary model training without explicit consent (B.8.2.3), and notify Controller if an instruction infringes law (B.8.2.4). | Sponsor (Controller): Executes GDPR Art. 35 DPIA and IRB informed consent. EDC / AI Scribe Vendor (Processor): Prohibits secondary foundation model training on clinical trial or patient data outside BAA/DPA instructions. |
| 2. Obligations to PII Principals (Data Subjects) (A.7.3 / B.8.3) |
Provide transparent privacy notices (A.7.3.2), mechanisms to modify/withdraw consent (A.7.3.4), object to processing (A.7.3.5), access/correct/erase PII (A.7.3.6), and support data portability (A.7.3.9). | Provide technical interfaces and contractual assistance so the PII Controller can fulfill PII principal access, correction, and erasure requests (B.8.3.1). | Hospital (Controller): Manages HIPAA Right of Access (45 CFR § 164.524) and GDPR subject access requests. EHR Vendor (Processor): Exposes FHIR APIs and audit trails to extract or amend patient records. |
| 3. Privacy by Design & Privacy by Default (A.7.4 / B.8.4) |
Limit collection to minimum necessary (A.7.4.1), limit processing (A.7.4.2), ensure accuracy, define strict retention schedules (A.7.4.4), de-identify/delete at end of processing (A.7.4.5), and restrict temporary files (A.7.4.6). | Restrict creation of temporary files during processing (B.8.4.1), provide secure return, transfer, or cryptographic erasure/disposal of PII at contract termination (B.8.4.2), and enforce transmission controls (B.8.4.3). | Pseudonymization in Trials: Replacing direct patient identifiers with subject study IDs at the clinical site before ingestion into the central EDC database; ephemeral audio purging after AI note sign-off. |
| 4. PII Sharing, Transfer & Disclosure (A.7.5 / B.8.5) |
Identify and document basis for cross-border transfers outside the jurisdiction (A.7.5.1), specify target countries (A.7.5.2), and record all third-party disclosures (A.7.5.3). | Document all countries/international organizations where PII may be stored or transferred (B.8.5.1), record legally binding subpoena/law-enforcement disclosures (B.8.5.3), and obtain written Controller authorization before engaging any sub-processor (B.8.5.6–B.8.5.8). | Cross-Border Trials: Documenting EU Standard Contractual Clauses (SCCs) for EU-to-US trial data transfers and maintaining an auditable sub-processor register for cloud hosting. |
What Standards or Regulatory Requirements Govern ISO 27701? (GDPR & HIPAA Alignment)
ISO/IEC 27701 bridges technical security frameworks (ISO 27001, SOC 2 Type 2, and HITRUST CSF) and statutory data protection laws:
- Direct EU GDPR Crosswalk (Informative Annex D): Annex D of ISO/IEC 27701:2019 maps every Clause 5–8 requirement and Annex A/B control directly to articles of Regulation (EU) 2016/679 (GDPR)—including Principles of Processing (Article 5), Lawfulness and Consent (Articles 6–7), Data Subject Rights (Articles 12–22), Data Protection by Design and Default (Article 25), Processor Contracts and Sub-processors (Article 28), Records of Processing Activities / ROPA (Article 30, mapped to A.7.2.8 and B.8.2.6), Data Protection Impact Assessments (Article 35, mapped to A.7.2.5), and International Transfers (Articles 44–49, mapped to A.7.5 and B.8.5).
- HIPAA Privacy & Security Rule Alignment: While ISO 27701 uses the global terminology of PII Controller and PII Processor rather than U.S. statutory terms, a HIPAA Covered Entity maps directly to a PII Controller (Annex A), and a HIPAA Business Associate maps directly to a PII Processor (Annex B). Annex A/B controls operationalize the HIPAA Privacy Rule’s Minimum Necessary standard (45 CFR § 164.502(b) ↔ A.7.4.1/A.7.4.2), Accounting of Disclosures (45 CFR § 164.528 ↔ A.7.5.3), and Business Associate sub-contractor chaining and termination return/destruction rules (45 CFR § 164.504(e)(2)(ii)(I)–(J) ↔ B.8.4.2 & B.8.5.7).
- Related ISO Privacy Standards (Annexes C, E, and F): Annex C maps to the ISO/IEC 29100 privacy framework; Annex E maps to ISO/IEC 27018 (code of practice for protection of PII in public clouds acting as PII processors) and ISO/IEC 29151 (code of practice for PII protection).
How Does ISO 27701 Integrate with EHR and Health Informatics Workflows?
In enterprise health informatics, implementing an ISO 27701 PIMS translates directly into four engineering artefacts:
- Automated Records of Processing Activities (ROPA — A.7.2.8 / B.8.2.6): Maintaining a live data-flow inventory mapping every HL7 v2 interface, FHIR R4 API endpoint, EDC data extract, and cloud S3/database bucket by data category, legal basis, retention period, and geographic hosting region.
- Granular Consent & Provenance Metadata (A.7.2.3 / A.7.3.4): Representing patient and trial participant consent directives in EHR and research pipelines using HL7 FHIR `Consent` and `Provenance` resources so automated data-export jobs honor consent withdrawals and secondary-use exclusions.
- Ephemeral Scratch & Temporary File Purging (A.7.4.6 / B.8.4.1): Enforcing automated lifecycle rules that purge temporary ETL staging tables, unencrypted CSV exports, and ambient audio buffers immediately after clinical processing completes.
- Sub-Processor Change Notification Workflows (B.8.5.7): Establishing contractual and automated notification gates before any cloud sub-processor (such as a managed LLM inference API or cloud analytics warehouse) is added to an EHR or clinical trial data pipeline.
Frequently Asked Questions
What is ISO 27701 and how is it used in clinical research and healthcare?
ISO/IEC 27701:2019 is an international standard that specifies requirements and guidance for establishing, maintaining, and continually improving a Privacy Information Management System (PIMS) as an extension to an ISO/IEC 27001 Information Security Management System (ISMS). In clinical research and healthcare, trial sponsors, hospitals, CROs, and health IT vendors use ISO 27701 to certify privacy controls across PII Controller (Annex A) and PII Processor (Annex B) roles, operationalizing both EU GDPR and HIPAA Privacy Rule obligations.
What standards or regulatory requirements govern ISO 27701?
ISO/IEC 27701 is built directly on top of ISO/IEC 27001 (ISMS requirements) and ISO/IEC 27002 (information security controls) and requires an active ISO 27001 certification. Its informative annexes map directly to EU GDPR Articles 5 through 49 (Annex D), the ISO/IEC 29100 privacy framework (Annex C), and ISO/IEC 27018 public cloud processor privacy controls (Annex E).
How does ISO 27701 integrate with EHR and health informatics workflows?
In health informatics workflows, ISO 27701 governs how systems document Records of Processing Activities (ROPA), enforce Privacy by Design and minimum-necessary data collection, track patient and research participant consent lifecycle states (A.7.2.3), purge temporary ETL and audio staging files (A.7.4.6 / B.8.4.1), and audit downstream cloud sub-processors under Business Associate and Data Processing Agreements (B.8.5.7).
