ISO/IEC 27799: ISO/IEC 27799 – Tutorial (about 60 minutes)

ISO 27799 is the international guidance that explains how to apply the well-known ISO/IEC 27002 information security controls inside healthcare, where a locked-out clinician or a corrupted record can harm a patient and not just a balance sheet. Hospitals, clinics, laboratories, care homes, ambulance services, health insurers and digital health companies use it alongside an ISO/IEC 27001 management system. After this tutorial you will be able to explain what the standard covers, how it is organised, how to put it to work in a health organisation, and how it relates to certification and to neighbouring standards and laws.

Free tutorial · about 60 minutes · 7 lessons · 5 diagrams · then a 25-question knowledge check and a certificate.

Course overview

Edition and status: The current edition is ISO 27799:2025, Health informatics – Information security controls in health based on ISO/IEC 27002, the third edition, published by ISO on 18 December 2025 and prepared by the technical committee ISO/TC 215 (Health informatics). It is based on ISO/IEC 27002:2022 and replaces ISO 27799:2016 and the technical specification ISO/TS 14441:2013, both of which are now withdrawn. Note that the owner's list calls it "ISO/IEC 27799", but the document is published by ISO alone (its health informatics committee), so its correct designation is ISO 27799. It is the current edition, and the ISO catalogue lists it as published. Verified 2026-10-29 on the ISO catalogue entry for the 2025 edition.

Who this is for: security and IT staff who have moved into a health organisation, clinical informatics and digital health teams, biomedical or clinical engineers who look after connected medical devices, compliance and data protection officers, auditors, and suppliers who sell software or cloud services to healthcare providers. It is also useful for people who already know ISO/IEC 27001 and want to understand what changes when the information is about patients.

Prerequisites: none. Some familiarity with basic security ideas (passwords, access rights, backups) helps. If you have never met ISO/IEC 27001 or ISO/IEC 27002, Lesson 2 gives you the vocabulary you need, and Lesson 3 explains how the three documents fit together.

By the end of this tutorial:

You will be able to explain why healthcare needs sector-specific security guidance and what ISO 27799 adds to ISO/IEC 27002.
You will be able to define the key terms of health information security, such as personal health information, emergency access and audit trail.
You will be able to describe how the 2025 edition relates to ISO/IEC 27002:2022 and its four control themes.
You will be able to outline how a health organisation uses the standard inside an ISO/IEC 27001 information security management system, from scope to improvement.
You will be able to state clearly what can and cannot be certified, and how auditors and regulators look for evidence that the guidance has been applied.
You will be able to apply the guidance to a realistic hospital group, including connected medical devices, cloud services and emergency access.
You will be able to compare ISO 27799 with related standards and rules such as ISO/IEC 27001, IEC 80001-1, IEC 81001-5-1 and the HIPAA Security Rule.

Lesson 1 – Origins, purpose and scope

Why healthcare is a special case

Every sector has sensitive information, but healthcare combines several difficult features at once. First, the information is among the most personal there is: diagnoses, mental health notes, genetic results, sexual health, medication and the details of a person's family. Once disclosed, it cannot be taken back, and it can lead to discrimination, embarrassment or fraud for the rest of a person's life. Many laws treat health data as a special category that deserves extra protection for exactly this reason.

Second, in healthcare the other two properties of security, integrity and availability, are directly tied to patient safety. If an allergy entry is silently deleted, a patient may receive a drug that harms them. If the electronic record system is down during the night shift, nurses may not know which medicines were already given. A ransomware attack on a hospital is not only a data breach; it can mean cancelled operations and diverted ambulances. Security failures in health therefore have clinical consequences.

Third, the working environment is unusual. A hospital is open around the clock, staff move constantly between wards, and many people share workstations. Doctors in training rotate between departments every few months. Students, agency nurses, volunteers and visiting specialists all need some access. Care is delivered not only in buildings but in ambulances, in patients' homes and by video. The organisation also runs technology that most companies never see: infusion pumps, imaging scanners, laboratory analysers and patient monitors, many of which contain software that is hard to patch.

Finally, there is a constant tension between protecting information and getting it to the right clinician quickly. A security rule that makes sense in a bank, such as locking an account after a few failed logins, might stop an emergency doctor from seeing a patient's history at the worst possible moment. Health security must be strong and must not get in the way of care.

What ISO 27799 is for

ISO/IEC 27002 is the general catalogue of information security controls used worldwide, written for any type of organisation. It is deliberately generic. ISO 27799 takes that catalogue and explains how to apply it in health. It adds health-specific implementation guidance so that the controls fit the situations a health organisation meets every day. Those situations are familiar to anyone who has worked in a hospital: balancing confidentiality with timely access, emergency access to records, medical devices on the network, knowing who looked at a record, and the many kinds of people who touch patient information.

The standard is a controls and implementation guidance document, like ISO/IEC 27002, not a management system requirements standard, and it is not used for accredited certification. It is meant to be used together with an information security management system (ISMS) built to ISO/IEC 27001, where the organisation decides which controls it needs on the basis of its own risks.

A short history

The first edition of ISO 27799 appeared in 2008 and was built on the version of ISO/IEC 27002 then current. A second edition followed in 2016 to follow the 2013 revision of ISO/IEC 27002. After ISO/IEC 27002 was reorganised in 2022, ISO/TC 215 revised ISO 27799 again, and the third edition was published in December 2025.

Two changes in the 2025 edition are worth noticing even before you open it. The title changed from "Information security management in health using ISO/IEC 27002" to "Information security controls in health based on ISO/IEC 27002". This makes the purpose clearer: the management system is the job of ISO/IEC 27001, while ISO 27799 focuses on controls and how to implement them in health. The new edition also replaced ISO/TS 14441:2013, an older technical specification on security and privacy requirements for electronic health record systems used in conformity assessment, so readers who used that document should now look to ISO 27799.

Scope in plain words

The scope of the 2025 edition is broad. In summary, it covers:

general information and communication technology, such as servers, laptops, networks and office software, when used by a health organisation;
software and systems built specifically for healthcare, such as electronic health record systems and medical devices that contain health software, whether that software is programmable, firmware or both;
other digital equipment in places where care is given, such as environmental and infection control systems, building management and physical security systems;
information in any form, including text, numbers, sound, drawings, images and video, however it is collected, stored or transferred;
organisations of every type and size that provide healthcare or look after personal health information for another reason, whether the data is held on their own premises or in the cloud;
every setting in which care is delivered, from hospitals and clinics to ambulances, mobile diagnostic units and residential care, and every service model including remote and virtual care.

The phrase "or look after personal health information for another reason" matters. It brings in organisations that are not care providers at all: a health insurer, a research institute, a company that runs a symptom-checker app, or a cloud provider hosting a hospital's records. If you hold health information, the guidance is relevant to you.

Lesson 2 – Key concepts and vocabulary

ISO 27799 uses the vocabulary of the ISO/IEC 27000 family and of health informatics. The definitions below are explanations in plain words, not the official wording of the standards.

Personal health information – information about an identifiable person that relates to their physical or mental health, the care they receive, or data collected while providing that care. It includes obvious items such as diagnoses and test results, and less obvious ones such as appointment times, identifiers that link to a record, and payment details for treatment.
Health organisation – any body that provides healthcare or acts as a custodian of personal health information: hospitals, general practices, pharmacies, laboratories, ambulance services, insurers, health apps, and their processors.
Custodian – a person or organisation that holds health information on behalf of patients and is responsible for protecting it. Being a custodian brings obligations even when the information was created by someone else.
Information security – keeping the confidentiality, integrity and availability of information. Confidentiality means only authorised people can see it; integrity means it is accurate, complete and not changed without authority; availability means it can be used when needed.
Information security management system (ISMS) – the policies, roles, processes, records and controls through which an organisation manages security in a planned, risk-based way. ISO/IEC 27001 sets the requirements for an ISMS.
Control – a measure that changes a risk: a policy, procedure, technical setting, physical barrier or practice. Examples are role-based access, encrypted backups and a locked medicines room.
Control theme – one of the four groups into which ISO/IEC 27002:2022 sorts its controls: organisational, people, physical and technological.
Electronic health record (EHR) – a structured, digital record of a patient's health and care, usually shared by many clinicians and departments, and often across organisations.
Health software and medical devices – software intended for health purposes, and devices used for diagnosis, monitoring or treatment. Many medical devices are now networked computers with a clinical purpose.
Role-based access control – granting access rights according to a person's job role (for example, ward nurse or radiographer) rather than one person at a time, so that rights follow the role and change when the role changes.
Legitimate relationship – the idea that a clinician should normally access a patient's record because they are involved in that patient's care, not merely because the system allows it.
Emergency access ("break-glass") – a controlled way for an authorised user to override normal access restrictions when a patient's safety requires it, with the reason recorded and the access reviewed afterwards.
Audit trail – a protected log of who created, viewed, changed or exported a health record, when, and from where. It lets the organisation detect inappropriate access and answer a patient who asks who has seen their data.
Pseudonymisation – replacing direct identifiers with codes so that data can be used, for example for research, without revealing who it is about, while a separately protected key allows re-linking where justified.
Consent – a patient's agreement to a particular use or sharing of their information. Its role differs between countries and between care and secondary uses, so security controls must support whatever the applicable law requires.
Statement of Applicability (SoA) – the ISO/IEC 27001 document that lists which controls an organisation has chosen, why, and whether they are implemented. In a health ISMS it is the natural place to show where ISO 27799 guidance was used.

Figure 1 – ISO/IEC 27001 decides which controls are needed from the risks; ISO/IEC 27002 and ISO 27799 guide how to implement them in health.

Keep Figure 1 in mind for the rest of the course. The requirements come from ISO/IEC 27001. The catalogue of controls and their general guidance come from ISO/IEC 27002. ISO 27799 sits beside ISO/IEC 27002 and makes that guidance fit the realities of health. A common beginner mistake is to treat ISO 27799 as a separate, competing system; it is better understood as a health lens over the same control set.

Lesson 3 – Structure of the standard

How the document is laid out

Like most ISO documents, ISO 27799 opens with its scope, its normative references, and terms and definitions. The rest of the document sets out information security controls, with implementation guidance, for health organisations. Because the 2025 edition is based on the 2022 version of ISO/IEC 27002, a reader who knows that catalogue will find familiar ground. The value of ISO 27799 lies in the health-specific implementation guidance it adds.

The practical consequence is simple: you need both documents. ISO 27799 does not repeat all of the text of ISO/IEC 27002. Use ISO/IEC 27002 for the full generic guidance on each control, and ISO 27799 for what the health context changes or adds.

The four control themes

ISO/IEC 27002:2022 organises its 93 controls into four themes, in clauses 5 to 8. The themes describe what a control acts on rather than which department owns it.

Organisational controls (clause 5) – the largest group: policies, roles, asset inventories, classification, access management rules, supplier relationships, cloud services, incident management, continuity, legal and regulatory compliance, and privacy protection. In health this is where you decide who owns clinical systems, how health information is classified, what suppliers and cloud providers must do, and how incidents that may affect patients are escalated.
People controls (clause 6) – screening, terms of employment, awareness and training, disciplinary processes, responsibilities after leaving, confidentiality agreements and remote working. Health organisations have an unusually wide set of people: permanent staff, rotating doctors, students, agency workers, volunteers and contractors. Each group needs appropriate agreements, training and timely removal of access.
Physical controls (clause 7) – secure areas, entry control, clear desk and clear screen, equipment siting, storage media, supporting utilities and secure disposal. Hospitals are public buildings, so physical security has to protect information without turning wards into fortresses. Screens in public corridors, paper notes at the bedside and printers at nursing stations are classic exposures.
Technological controls (clause 8) – user endpoints, privileged access, authentication, malware protection, vulnerability management, configuration, backup, logging, monitoring, network security, cryptography and secure development. In health this theme must also cope with medical devices that cannot run standard security agents, and with clinical systems that must stay available all the time.

ISO/IEC 27002:2022 also gives every control a set of attributes that help you sort and filter them: the control type (preventive, detective or corrective), the security properties it protects (confidentiality, integrity, availability), cybersecurity concepts (identify, protect, detect, respond, recover), operational capabilities and security domains. A health organisation can use these attributes to build views of the control set, for example "all detective controls that protect integrity of clinical data".

Figure 2 – The four control themes of ISO/IEC 27002:2022, on which ISO 27799:2025 is based, each with typical healthcare concerns.

Health-specific threads that run through the themes

Some health concerns do not belong to a single theme; they show up again and again. It helps to recognise these threads before you read the controls one by one.

Timely access versus confidentiality. Access rules must prevent snooping without blocking urgent care. This affects access policy, authentication, session time-outs and emergency access.
Accountability for every access. Because many people can technically open many records, organisations rely heavily on logging and review to detect misuse, and on telling staff that access is monitored.
Integrity as a safety property. Changes to clinical data must be attributable and traceable. Corrections should be added rather than silently overwriting what was there.
Continuity of care. Backups, redundancy and downtime procedures (for example, paper fall-back forms and read-only copies of key data) protect patients when systems fail.
Medical devices and other clinical technology. Devices may run old operating systems, may be maintained by the manufacturer, and may be regulated so that changes need care. They must be inventoried, segmented and monitored.
Sharing across organisations. Health information routinely moves to other providers, laboratories, insurers and public health bodies. Agreements, secure transfer and minimum necessary disclosure matter.
Retention and the long life of records. Health records are often kept for decades, so storage, encryption keys and formats must be managed over a long period.

These threads explain why the health guidance often looks like the generic guidance with an extra condition attached: "do this, but make sure clinicians can still reach the record in an emergency", or "log this, and make the log useful for answering a patient's question".

Lesson 4 – How it works in practice

Start from the management system

ISO 27799 delivers its value inside an ISMS. In practice, a health organisation uses ISO/IEC 27001 to set up the management framework and uses ISO 27799, together with ISO/IEC 27002, while choosing and implementing controls. The steps below describe a typical journey. They are a practical sequence, not wording taken from the standard.

Figure 3 – A typical cycle for applying ISO 27799 inside an ISO/IEC 27001 ISMS, returning to risk assessment as things change.

1. Leadership and roles

Security in health only works when clinical and executive leaders own it. The board or executive team approves the security policy and accepts the remaining risks. A senior security lead (often called the CISO) runs the ISMS. Around that person, health organisations typically involve a data protection or privacy officer, a clinical lead who can judge the clinical impact of security decisions, clinical or biomedical engineering for medical devices, IT operations, and records management. Some countries have additional named roles; for example, organisations in the UK's National Health Service appoint a Caldicott Guardian to oversee the use of patient information. The exact titles vary; what matters is that clinical voices are part of security decisions.

2. Scope

The ISMS scope must reflect reality. A scope that covers only the IT department and the data centre, while leaving out wards, laboratories and connected devices, misses most of the risk. Good scoping names the sites, services, systems, suppliers and cloud services involved, and states clearly where any boundaries lie, for example a research institute that runs its own separate ISMS.

3. Inventory

You cannot protect what you do not know. The inventory covers information (patient records, images, lab results, billing data), applications (EHR, laboratory and radiology systems, pharmacy, scheduling), infrastructure, endpoints and, importantly, medical devices and building systems. For each item, record the owner, the location, who supports it and what data it handles. Clinical engineering often already has a device register; joining it with the IT asset list is a quick win.

4. Risk assessment with clinical impact

Health risk assessment adds an extra impact dimension: harm to patients. A risk that leads to a short outage of the canteen payment system and one that leads to a short outage of the infusion pump drug library are not equal, even if they cost the same. Many health organisations rate impact on several scales, such as patient safety, confidentiality of health data, legal consequences, service disruption and reputation, and take the highest. Threats to consider include ransomware, insider snooping, lost devices, misdirected letters and emails, supplier compromise, unpatched devices, and errors when information is copied between systems.

5. Selecting controls

For each significant risk, the team chooses how to treat it and which controls to use, consulting ISO/IEC 27002 for the generic control and ISO 27799 for how to make it work in health. Typical health-specific choices include role-based access aligned with clinical roles, fast and secure login on shared workstations (for example, badge tap plus short PIN), break-glass emergency access with review, detailed access logging with proactive monitoring, network segmentation for medical devices, offline or immutable backups for clinical systems, and tested downtime procedures.

6. Statement of Applicability and treatment plan

The selected controls are recorded in the Statement of Applicability, with reasons and implementation status. A treatment plan lists what still needs to be done, by whom and by when. A good practice is to note in the SoA where ISO 27799 guidance shaped the implementation; this shows auditors and regulators that the health context was considered.

7. Implementation and training

Implementation is as much about people as technology. Clinicians need short, role-specific training that explains why rules exist: that looking up a neighbour's record is a disciplinary matter, that access is logged, how to use emergency access properly, how to report a lost device, and how to spot a phishing message. Training is more effective when it uses clinical examples rather than generic office scenarios.

8. Monitoring and review

Monitoring in health has two sides. The technical side is what any organisation does: security alerts, vulnerability scans, backup checks. The health-specific side is monitoring appropriate use of records: reviewing emergency access events, looking for staff who open the records of colleagues, family members or famous patients, and following up anomalies. Internal audits and management reviews then check that the whole system works.

9. Improvement

Incidents, near misses, audit findings and changes in technology or law all feed back into the risk assessment. A new telehealth service, a move of the EHR to the cloud, or a new class of connected device should each trigger a fresh look at risks and controls.

Lesson 5 – Assessment, certification and compliance

What can be certified

There is no accredited certification to ISO 27799 itself. Like ISO/IEC 27002, it is a controls and guidance document, not a management system requirements standard, and no accredited certification scheme exists for it. The certifiable standard is ISO/IEC 27001. A health organisation that wants an external certificate obtains ISO/IEC 27001 certification from an accredited certification body, and uses ISO 27799 to shape the controls inside that ISMS. If a supplier claims to be "ISO 27799 certified", ask exactly what was assessed, by whom, and against which document; the honest answer is usually an ISO/IEC 27001 certificate with a health-focused scope, or a consultancy assessment against ISO 27799 guidance, which is not the same thing as accredited certification.

How an ISO/IEC 27001 audit sees ISO 27799

A certification audit checks that the ISMS meets the requirements of ISO/IEC 27001: that the scope is sensible, risks are assessed and treated, the SoA is complete and consistent, controls are operating, and the system is monitored and improved. The auditor does not grade you against ISO 27799 line by line. However, if your SoA and risk treatment plan say you implemented controls following ISO 27799, the auditor can ask to see evidence that you did. For example, if you state that emergency access is used with retrospective review, the auditor may sample emergency access events and ask for the review records. Referencing the guidance therefore raises the bar for evidence, which is a good thing.

Other ways the guidance is assessed

Internal audit and self-assessment. Many organisations run a gap analysis against ISO 27799: for each control area, they compare current practice with the health guidance and rate the gap. This is a planning tool, not a certificate.
Supplier and procurement reviews. Hospitals often ask software and cloud suppliers to show how they meet the health guidance, for example in security questionnaires or contract schedules.
Regulatory and national schemes. Many countries have their own rules or assurance programmes for health data. ISO 27799 does not replace them, but it helps an organisation build controls that can be mapped to them. In the United States, the HIPAA Security Rule requires administrative, physical and technical safeguards for electronic protected health information; in the European Union, the GDPR treats data concerning health as a special category; national health systems may run their own toolkits or audits. The organisation must check which rules apply and map its controls to each.

What good evidence looks like

Evidence is most convincing when it comes from normal operation rather than being produced for the audit. Examples include access review records signed off by ward managers, reports of emergency access events with their follow-up, device inventories with network segment and patch status, backup restore test results for the EHR, records of downtime drills, training completion by staff group, and supplier agreements that include security and confidentiality terms for health data.

Lesson 6 – Worked example

The organisation

Riverbend Health is a fictional regional health group with two hospitals, eight community clinics and a home-care service, employing about 4,000 staff plus a steady flow of students and agency nurses. It uses a commercial EHR hosted by the supplier in the cloud, an on-site picture archiving system for radiology images, a laboratory system, and about 2,500 networked medical devices, including infusion pumps, patient monitors and imaging scanners. Last year a neighbouring hospital suffered a ransomware attack that forced it to cancel planned operations for a week. Riverbend's board asks for a structured security programme and an ISO/IEC 27001 certificate within two years.

Step 1 – Leadership and scope

The chief executive sponsors the programme. A security steering group is formed with the CISO, the chief medical information officer, the head of nursing informatics, the data protection officer, the head of clinical engineering and the IT operations manager. The steering group agrees a scope covering all sites, the home-care service, the EHR including the supplier's hosting, the radiology and laboratory systems, and connected medical devices. The research unit, which runs separate studies under its own governance, is excluded from the first certification scope, and the interfaces between it and the hospitals are documented.

Step 2 – Inventory

The IT asset list and the clinical engineering device register are merged. The exercise finds 300 devices that nobody had linked to a network segment, 40 imaging workstations running an operating system the vendor no longer supports, and several shared mailbox accounts used by ward clerks. Each asset gets a named owner: the EHR belongs to the chief medical information officer, devices to clinical engineering, and infrastructure to IT operations.

Step 3 – Risk assessment

Riverbend adopts an impact scale with five dimensions: patient safety, confidentiality, legal and regulatory, service disruption and reputation. The top risks identified are: ransomware spreading from office systems to clinical systems; unpatched imaging workstations being used as a foothold; staff browsing records without a care relationship; loss of the cloud EHR connection for several hours; and home-care staff losing tablets that cache patient data.

Step 4 – Choosing controls with the health guidance

For each risk the team reads the relevant ISO/IEC 27002 controls and the matching ISO 27799 guidance, then decides on concrete measures:

Ransomware. Segmenting the network so that medical devices and clinical servers sit in separate zones; immutable backups of the laboratory and radiology systems; agreeing with the EHR supplier how quickly service can be restored and testing it; a tested downtime procedure with paper forms and a read-only daily extract of key patient lists and medication charts on stand-alone laptops.
Legacy imaging workstations. Because the scanners are regulated and the manufacturer must approve changes, Riverbend cannot simply upgrade them. It isolates them in their own segment, allows only the connections the scanner needs, monitors that segment closely, and puts replacement into the capital plan. The remaining risk is formally accepted by the board for eighteen months.
Inappropriate access. Role-based access profiles are built with clinical leads for each role. Login on shared ward computers moves to badge tap and PIN so that people stop sharing sessions. An automated report flags staff who open records of patients with the same surname or address, of colleagues, or of patients flagged as public figures; a privacy officer reviews the flags weekly.
Emergency access. Rather than giving every clinician access to everything, Riverbend configures break-glass access: when a clinician needs a record outside their normal relationship, they confirm a reason, gain time-limited access, and the event is reviewed the next working day.
Home-care tablets. Full-disk encryption, mobile device management with remote wipe, minimal local caching of patient data and a simple, blame-free reporting route for lost devices.

Figure 4 – Emergency ("break-glass") access lets care continue while every override is recorded and reviewed afterwards.

Step 5 – SoA, training and operation

The Statement of Applicability lists every ISO/IEC 27002 control with a decision and, in a notes column, the ISO 27799 guidance used for health-specific areas such as access to records, logging, devices and continuity. Training is rebuilt as short role-based modules: one for clinicians on access and emergency use, one for ward clerks on misdirected letters and identity checks at the front desk, one for clinical engineers on device onboarding, and one for managers on approving access and acting on alerts.

Step 6 – Measuring and improving

Riverbend picks a small set of indicators: percentage of devices assigned to a network segment, time to remove access for leavers and rotating doctors, number of emergency access events and the share reviewed within one working day, results of quarterly restore tests, and completion of downtime drills per ward. Six months in, a downtime drill reveals that night staff cannot find the paper forms; the procedure and storage are changed. An access review finds that rotating doctors keep rights from previous departments for weeks; the HR rotation feed is connected to the identity system so that rights change automatically.

Step 7 – Certification

After a year of operation, an accredited certification body performs the ISO/IEC 27001 stage 1 and stage 2 audits. The auditors sample emergency access reviews, look at the segmentation of devices, ask ward staff how they would report a lost tablet, and check that the board formally accepted the legacy scanner risk. Riverbend receives its ISO/IEC 27001 certificate. It does not, and could not, receive an "ISO 27799 certificate", but the health guidance is visible throughout its ISMS and its evidence.

Lesson 7 – Relationship to other standards and frameworks

Health organisations live among many standards and laws. ISO 27799 is one piece of a larger picture, and knowing what each neighbour does helps you avoid both gaps and duplicated effort.

Standard or rule	Owner	What it does	How it relates to ISO 27799
ISO/IEC 27001	ISO and IEC	Requirements for an information security management system; the basis for certification.	Provides the management system in which ISO 27799 guidance is used. Certification is to this standard, not to ISO 27799.
ISO/IEC 27002:2022	ISO and IEC	Generic catalogue of 93 security controls with implementation guidance.	The foundation that ISO 27799:2025 is based on; you read the two together.
ISO/IEC 27701	ISO and IEC	Requirements and guidance for a privacy information management system.	Complements ISO 27799 on the privacy side, such as processing purposes and data subject rights, which matter greatly for health data.
IEC 80001-1	IEC, developed with ISO/TC 215	Risk management for connecting medical devices and health software to IT networks, covering safety, effectiveness and security.	Gives deeper guidance on the device-network side, which ISO 27799 addresses as part of its scope.
IEC 81001-5-1	IEC	Security activities across the lifecycle of health software, aimed at manufacturers.	Applies to the makers of health software and devices; ISO 27799 applies to the organisations that use and run them.
HIPAA Security Rule	US Department of Health and Human Services	Legal requirement for administrative, physical and technical safeguards of electronic protected health information in the United States.	A law, not a standard; ISO 27799 controls can help meet it, but compliance must be shown against the rule itself.

Other ISO/TC 215 documents go deeper on specific topics that ISO 27799 touches, for example audit trails for electronic health records, privilege management and access control in health, and pseudonymisation. When a particular area is a high risk for you, these focused standards can add detail. The risk management standard for medical devices themselves, ISO 14971, governs the manufacturer's safety risk process; a hospital's security team usually meets it indirectly, through the information a manufacturer provides about a device's security and the conditions for safe use.

Figure 5 – Laws, management system standards, control guidance and device standards all feed into one health organisation's ISMS.

A practical way to manage this landscape is to keep one control set, based on ISO/IEC 27002 and ISO 27799, and map it to each law and scheme that applies, instead of running a separate programme for each. One well-run control with good evidence can then satisfy several obligations at once.

Common pitfalls and best practices

Common pitfalls

Treating ISO 27799 as a certificate. Organisations promise customers an "ISO 27799 certification" that does not exist, instead of planning an ISO/IEC 27001 certificate with a health scope.
Leaving clinical technology out of scope. The ISMS covers office IT and the data centre, while infusion pumps, scanners and building systems stay invisible, even though they are often the weakest points.
Security that blocks care. Long passwords on shared ward computers, short time-outs during procedures, or account lockouts without an emergency route lead staff to share logins and write passwords on monitors, which makes things worse.
Logs that nobody reads. Access logging is switched on but never reviewed, so inappropriate browsing of records goes undetected until a patient complains.
Ignoring the people churn. Rotating doctors, students and agency staff keep old access for weeks or share accounts because onboarding is slow.
Risk assessment without clinical input. Impact is rated only in money or data volume, so a short outage of a life-critical system is treated like any other IT outage.
Untested downtime plans. Paper fall-back procedures exist on the intranet, which is itself unavailable during the outage, and staff have never practised them.

Best practices

Use the right document for each job. ISO/IEC 27001 for the management system and certification, ISO/IEC 27002 for the generic control guidance, ISO 27799 for the health-specific view.
Put clinicians in the room. Include clinical leads in risk assessment, access design and incident response, so security decisions consider patient safety.
Make the secure way the easy way. Fast login methods, single sign-on and session roaming on shared workstations reduce the temptation to share accounts.
Design emergency access deliberately. Provide a break-glass route with a recorded reason, time limits and prompt review, instead of granting broad standing access.
Monitor appropriate use proactively. Use automated rules to flag suspicious access patterns and review them regularly, and tell staff that monitoring happens.
Bring medical devices into the ISMS. Join the device register with the IT inventory, segment device networks, and work with manufacturers on patches and supported configurations.
Rehearse continuity. Test restores of clinical systems and run downtime drills on real wards, then fix what the drills reveal.
Map once, comply many times. Maintain one control set and map it to every applicable law and scheme rather than running parallel programmes.

Summary and key takeaways

ISO 27799:2025 is ISO's guidance on implementing the ISO/IEC 27002:2022 security controls in health, published by ISO/TC 215 in December 2025; it replaced the 2016 edition and ISO/TS 14441:2013.
Healthcare is a special case because confidentiality, integrity and availability failures can harm patients, not only organisations, and because care must never be blocked by security.
The scope is broad: general IT, clinical systems, medical devices with software, building and environmental systems, all forms of information, all care settings and all organisations that hold health information, on premises or in the cloud.
It builds on the ISO/IEC 27002:2022 control set, organised in four themes, and adds health-specific guidance; recurring health threads include emergency access, access accountability, integrity of clinical data, continuity of care and medical devices.
It is used inside an ISO/IEC 27001 ISMS: risk assessment with a patient-safety dimension drives control selection, recorded in the Statement of Applicability.
There is no accredited certification to ISO 27799; organisations certify to ISO/IEC 27001 and show through evidence how the health guidance was applied.
It works alongside privacy management, device-network risk management, manufacturer security standards and health data laws, best handled through one control set mapped to each obligation.

Reflection questions

Think of a health organisation you know or can imagine. Which three of its information assets would cause the most patient harm if they became unavailable for a day, and how would you show that in a risk assessment?
How would you design login and session handling for a busy emergency department so that staff do not share accounts but can still work quickly?
A supplier says its product is "ISO 27799 compliant". What questions would you ask to understand what that claim actually means and what evidence supports it?
Your organisation has a large fleet of medical devices that cannot run security software. Which controls from different themes would you combine to reduce the risk, and who would you need to involve?
If you had to map your security controls to both a national health data law and an ISO/IEC 27001 certification, how would you organise the work so that one piece of evidence can serve both?