Written and maintained by CASRAI Editorial Board
Last updated
ISO 27799:2016 (Health informatics — Information security management in health using ISO/IEC 27002) is the international standard developed by ISO Technical Committee ISO/TC 215 (Health Informatics) that specifies healthcare-specific guidelines for implementing, operating, and auditing an Information Security Management System (ISMS) to protect personal health information (PHI). While ISO 27001 for research data security and ISO/IEC 27002 define industry-agnostic security controls, ISO 27799 adapts those controls to the unique clinical risk profile of hospitals, electronic health record (EHR) platforms, diagnostic laboratories, and clinical trial networks—where a loss of system availability or data integrity can directly endanger patient life.
What Is ISO 27799 and How Is It Used in Clinical Research and Healthcare?
First published in 2008 and revised as ISO 27799:2016 to align with the 14 security control domains of ISO/IEC 27002, the standard applies to all personal health information regardless of format (electronic, paper, voice, or diagnostic imaging) or environment (acute care hospitals, ambulatory clinics, cloud health data enclaves, or decentralized clinical trials). Unlike general corporate IT security—where confidentiality is often prioritized above immediate uptime—ISO 27799 establishes three foundational axioms for health informatics risk management:
- Clinical Availability Is a Patient Safety Imperative: If an intensive care EHR, allergy checking module, or computerized provider order entry (CPOE) system becomes unavailable during an emergency—or if overly rigid access controls block a covering clinician from viewing a deteriorating patient’s chart—patient morbidity and mortality can result. Therefore, ISO 27799 requires health ISMS designs to balance confidentiality with guaranteed clinical availability and audited emergency access (‘break-the-glass’) procedures.
- Clinical Data Integrity Prevents Medical Error: Unauthorized or accidental alteration of blood type records, medication dosages, pathology results, or clinical decision support knowledge bases compromises clinical decision-making; integrity controls (cryptographic checksums, versioned entries, and digital signatures) carry equal weight to confidentiality.
- Shared Care Boundary Complexity: Healthcare delivery and multi-site clinical research inherently cross institutional boundaries (referrals, regional Health Information Exchanges, contract research organizations, and cloud analytics), requiring standardized security governance across all participating entities.
The 9 Health Information Asset Categories and CIA Risk Profiles in ISO 27799
ISO 27799:2016 classifies healthcare information assets into nine distinct categories, each assigned a tailored Confidentiality, Integrity, and Availability (CIA) protection profile during risk assessment:
| Health Information Asset Category | Confidentiality Requirement | Integrity Requirement | Availability Requirement & ISO 27799 Rationale |
|---|---|---|---|
| 1. Personal Health Information (EHR Charts & Clinical Notes) | High | High | High (Real-Time): Clinicians require immediate 24/7 access during point-of-care encounters and emergencies. |
| 2. Diagnostic Medical Images & Physiological Telemetry | High | Very High | High: Lossy alteration or misattribution of DICOM studies or ECG waveforms can cause misdiagnosis. |
| 3. Clinical Decision Support (CDS) & Drug Knowledge Bases | Low to Medium | Critical | High: Corrupted drug-interaction tables or dosing rules systematically propagate clinical errors across all patients. |
| 4. Pseudonymized & De-Identified Clinical Research Datasets | Medium to High (Re-identification prevention) | High | Low to Medium: Analytical batch queries in research enclaves tolerate scheduled maintenance windows without threatening acute care. |
| 5. EHR Audit Trail & Security Log Data | High (Exposes patient access patterns & staff behavior) | Very High (Immutable) | Nuanced (Hours, Not Seconds): As ISO 27799 explicitly notes, audit logs do not require sub-second clinical uptime; archiving logs with a retrieval window of several hours is acceptable provided integrity is inviolable. |
(Additional asset categories in ISO 27799 include administrative/billing records, system configuration data, cryptographic keys/identity credentials, and public health surveillance feeds.)
How Does ISO 27799 Integrate With EHR and Health Informatics Workflows?
1. EHR Audit Trail Governance (Pairing ISO 27799 with ISO 27789)
In EHR engineering and cryptography vs. cybersecurity architecture, ISO 27799 works in tandem with ISO 27789 (Health informatics — Audit trails for electronic health records). Every creation, read, update, print, export, or emergency break-the-glass override touching PHI must generate a contemporaneous audit record capturing the unique clinician identifier, role, patient identifier, action type, workstation/network origin, and synchronized Network Time Protocol (NTP) timestamp. Because audit trails reveal both sensitive patient-provider relationships and internal security investigations, ISO 27799 requires separating clinical system administrator privileges from audit log administrator privileges so no superuser can erase evidence of their own snooping.
2. Healthcare-Specific Threat Modeling and Control Hardening
Beyond standard ISO/IEC 27002 clauses, ISO 27799 mandates additional healthcare-specific implementation controls across key operational vectors:
- Identity and Clinician Authentication: Prohibits shared generic clinical logins (e.g., a shared nursing station account); requires unique individual user IDs, role-based access control (RBAC) aligned with clinical care relationships, and automated session locking or badge tap-out on clinical workstations.
- Connected Medical Devices and Laboratory Systems: Requires network segmentation (VLAN isolation) between biomedical devices, clinical laboratory analyzers governed by ISO 15189 accreditation, medical device quality systems under ISO 13485 certification, and general hospital guest or corporate networks.
- Mobile Devices, Telehealth, and Removable Media: Enforces full-disk encryption, remote wipe capabilities, and strict controls on exporting clinical cohorts to portable media.
What Standards and Regulatory Requirements Govern ISO 27799?
Although ISO 27799:2016 is a guidance standard (organizations certify their ISMS against ISO/IEC 27001 with an extended Statement of Applicability referencing ISO 27799 controls), it maps directly to statutory healthcare privacy and security regimes worldwide:
- U.S. HIPAA Security Rule (45 CFR §§ 164.308, 164.310, 164.312) and HITRUST CSF: Maps directly to Administrative, Physical, and Technical Safeguards on a HIPAA compliance checklist, and serves as one of the core normative sources harmonized within the HITRUST CSF framework.
- EU GDPR (Articles 9 and 32) and NIS2 Directive: Demonstrates ‘state of the art’ technical and organizational measures for processing special-category health and genetic data in European clinical trials.
- Related ISO/TC 215 Standards: Operates alongside ISO 27789 (EHR audit trails), ISO 22600 (Privilege management and access control), and ISO/IEC 27018 / 27017 (Cloud PII and cloud security controls).
Frequently Asked Questions
What is ISO 27799 and how is it used in clinical research and healthcare?
ISO 27799:2016 (Health informatics — Information security management in health using ISO/IEC 27002) is an international standard developed by ISO/TC 215 that adapts ISO/IEC 27001 and 27002 security controls specifically for protecting personal health information (PHI) in hospitals, EHR systems, laboratories, and clinical research organizations.
What standards or regulatory requirements govern ISO 27799?
ISO 27799 is governed by ISO Technical Committee 215 and builds directly on ISO/IEC 27001 and ISO/IEC 27002. Organizations achieve formal certification under ISO/IEC 27001 with ISO 27799 in their Statement of Applicability to demonstrate compliance with the HIPAA Security Rule (45 CFR §§ 164.308–312), EU GDPR Article 32, and HITRUST CSF.
How does ISO 27799 integrate with EHR and health informatics workflows?
ISO 27799 guides EHR architects in balancing real-time clinical availability (including audited ‘break-the-glass’ emergency access) against strict confidentiality, enforcing unique clinician authentication, segmenting medical device networks, and archiving immutable EHR audit trails (aligned with ISO 27789) with separated administrative privileges.
Sources
- International Organization for Standardization (ISO): ISO 27799:2016 — Health informatics — Information security management in health using ISO/IEC 27002 (ISO/TC 215).
- International Organization for Standardization (ISO): ISO 27789:2021 — Health informatics — Audit trails for electronic health records.
- U.S. Department of Health and Human Services (HHS) / NIST: HIPAA Security Rule (45 CFR Part 164 Subpart C) and NIST SP 800-66 Rev. 2.
