# Health Sector Controls Profile (ISO 27799): [Organization name]

> Sector profile for organizations that provide healthcare or hold
> personal health information: hospitals, clinics, laboratories,
> telehealth services, health insurers, and suppliers of clinical
> software and managed services. It records how the guidance in
> ISO 27799:2025 (information security controls in health, based on
> ISO/IEC 27002:2022) is applied inside an ISMS that meets
> ISO/IEC 27001:2022 + Amd 1:2024, mainly through risk treatment (6.1.3)
> and the Statement of Applicability. Medical devices are covered by
> reference only. Replace every `[bracketed]` value and every row marked
> *Example*.

<!--
Guidance: How to use this template
- Use it when the ISMS scope includes personal health information or
  systems used to deliver care: electronic health records, scheduling,
  laboratory and imaging systems, telehealth, connected medical devices,
  or building systems in care premises.
- Fill section 3 (clinical system and information landscape) and
  section 5 (the sector supplement register, from your licensed copy of
  ISO 27799) first. Sections 6 and 7 connect each health topic to
  Annex A and to concrete implementation.
- The main pitfall is locking clinicians out. A control that delays
  access to a patient record in an emergency can harm a patient. Design
  emergency ("break glass") access, then monitor it closely, instead of
  blocking it.
- ISO 27799 is guidance from ISO/TC 215 (health informatics). Certification
  is to ISO/IEC 27001; the health guidance enters your SoA as additional
  controls or as guidance on Annex A controls.
- Medical device safety and regulatory conformity belong to the device
  manufacturer's processes (risk management, software lifecycle). This
  profile only covers how a health organization secures devices on its
  networks and the information they hold.
- Related templates: `compliance/statement-of-applicability`,
  `compliance/risk-methodology`, `compliance/hipaa-security-solution-design`,
  `compliance/dpia`, `compliance/de-identification-assessment`,
  `compliance/medical-device-software-lifecycle`,
  `compliance/iso-14971-risk-file`, `healthcare/fhir-integration-design`,
  `isms/pims-27701-scope-roles`, `isms/iot-27400-security`.
-->

## Document control

<!-- Guidance: The owner is usually the CISO or information security manager. A clinical safety officer or chief medical information officer must review: clinical risk and security risk meet in this document. -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-110 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@ciso], [@clinical-safety-officer], [@data-protection-officer], [@head-of-clinical-systems] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal] |
| Standard and edition | ISO 27799:2025; ISO/IEC 27002:2022; ISO/IEC 27001:2022 + Amd 1:2024 |
| Next scheduled review | YYYY-MM-DD |
| Role in health data processing | [Care provider / Controller / Processor for care providers / Insurer / Research organization] |
| Care settings in scope | [Hospital / Clinic / Laboratory / Telehealth / Home care / None: software supplier] |
| Medical devices on the network | [Yes, see section 8 / No] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| ISMS manager (author) | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| Clinical safety officer | [@clinical-safety-officer] | [Reviewed: no patient safety conflict] | YYYY-MM-DD |
| Data protection officer | [@data-protection-officer] | [Reviewed] | YYYY-MM-DD |
| CISO | [@ciso] | [Approved] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 | YYYY-MM-DD | [@isms-manager] | First issue |
| [x.y] | YYYY-MM-DD | [@author] | [Change summary] |

## Contents

- [1. Purpose and scope](#1-purpose-and-scope)
- [2. ISO 27799 at a glance](#2-iso-27799-at-a-glance)
- [3. Clinical system and information landscape](#3-clinical-system-and-information-landscape)
- [4. Health-specific considerations](#4-health-specific-considerations)
- [5. Sector supplement register](#5-sector-supplement-register)
- [6. Mapping of health topics to Annex A](#6-mapping-of-health-topics-to-annex-a)
- [7. Implementation table](#7-implementation-table)
- [8. Medical devices and clinical equipment](#8-medical-devices-and-clinical-equipment)
- [9. Worked risk example](#9-worked-risk-example)
- [10. Regulatory examples](#10-regulatory-examples)
- [11. Size tiers](#11-size-tiers)
- [12. Records and evidence](#12-records-and-evidence)
- [13. References](#13-references)
- [Standard and licence note](#standard-and-licence-note)

## 1. Purpose and scope

<!-- Guidance: State the health data you hold, in which role, and in which care settings. Match the boundary to the ISMS scope (DOC-ISMS-002) and, for privacy, to the PIMS scope if you run one (DOC-ISMS-100). -->

This profile explains how [Organization name] protects personal health
information and the systems used to deliver or support care. It:

- describes the clinical systems, information types and care settings
  in scope (section 3);
- sets out the health-specific considerations that shape every control
  decision (section 4);
- records which health-specific controls and guidance from ISO 27799:2025
  apply and why (section 5);
- maps each health topic to the ISO/IEC 27001:2022 Annex A controls in
  the Statement of Applicability, DOC-ISMS-011 (section 6), and assigns
  owners and evidence (section 7).

In scope: [clinical applications, health data stores, integration
engines, telehealth platforms, connected devices on clinical networks,
building and environmental systems in care premises].

Out of scope: [device manufacturing and conformity assessment, handled
by the manufacturer's quality system; clinical decisions themselves].

## 2. ISO 27799 at a glance

<!-- Guidance: Describe the standard in your own words and keep the licensed copy with the document owner. Cite its section numbers in section 5. -->

| Question | Answer for this profile |
|---|---|
| What it is | Information security controls, with implementation guidance, for health organizations, based on ISO/IEC 27002:2022 |
| Edition | ISO 27799:2025 (third edition, published 2025-12-18; replaces the 2016 edition) |
| Publisher | ISO/TC 215, health informatics |
| Certifiable? | No. Certification is to ISO/IEC 27001:2022 + Amd 1:2024 |
| Systems it addresses | Generic ICT plus health-specific software and systems such as electronic health records and medical devices with health software, and other digital equipment in care premises such as environmental, infection control, building management and physical security systems (summarised from the public scope) |
| Settings it addresses | Hospitals, clinics, ambulances, mobile units, care at home, and remote or virtual care (summarised from the public scope) |
| How it is organised | In line with the four themes of ISO/IEC 27002:2022, with health guidance on existing controls and some health-specific content (check your copy for the exact structure and annexes) |
| Licensed copy held by | [@isms-manager], [document repository path] |

```mermaid
flowchart LR
  A["ISO/IEC 27001:2022 + Amd 1:2024: ISMS requirements"] --> B["Risk assessment and treatment (6.1.2, 6.1.3)"]
  C["ISO/IEC 27002:2022: control guidance"] --> B
  D["ISO 27799:2025: health guidance"] --> B
  E["Clinical risk management"] --> B
  B --> F["Statement of Applicability DOC-ISMS-011"]
  F --> G["Implementation table, section 7"]
```

## 3. Clinical system and information landscape

<!-- Guidance: List systems by clinical criticality, not only by data volume. An auditor or clinical safety officer will ask what happens to patient care when each system is down for 4 hours. -->

### 3.1 Systems

| System | Purpose | Health data held | Clinical criticality | Downtime procedure | Owner |
|---|---|---|---|---|---|
| Electronic health record | [Clinical documentation, orders, results] | [Full record] | [High] | [Paper forms, read-only replica] | [@head-of-clinical-systems] |
| Scheduling platform *(Example)* | Clinical appointment and theatre scheduling for hospital customers | Patient name, contact, procedure, clinician | Medium | Daily printed schedule, offline export | Product director |
| Laboratory system | [Orders, results] | [Results] | [High] | [Phone results for critical values] | [@lab-manager] |
| Imaging archive | [Images, reports] | [Images] | [High] | [Modality local storage] | [@radiology-it] |
| Integration engine | [Message routing between systems] | [In transit] | [High] | [Queueing, manual re-send] | [@integration-lead] |
| Telehealth platform | [Video consultations] | [Session metadata, notes] | [Medium] | [Phone consultation] | [@telehealth-lead] |

### 3.2 Information types

| Information | Why it needs extra care | Classification |
|---|---|---|
| Clinical records | Sensitive personal data; errors can harm patients | [Restricted] |
| Genetic and mental health data | Higher harm if disclosed; extra legal protection in many jurisdictions | [Restricted, need to know] |
| Results needing urgent action | Time-sensitive: delay can harm patients | [Restricted, integrity and availability critical] |
| De-identified research datasets | Re-identification risk | [Confidential] |
| Staff and clinician credentials | Enable prescribing and record access | [Restricted] |

## 4. Health-specific considerations

<!-- Guidance: These considerations apply across controls. Write how your organization handles each one, then refer to them in section 7. -->

| Consideration | What it means for controls | Your approach |
|---|---|---|
| Patient safety first | Security controls must not prevent timely care; integrity and availability can outrank confidentiality in an emergency | [Clinical safety review of every control that affects access] |
| Emergency access | Clinicians may need records they are not normally entitled to see | [Break-glass with reason entry, alert and next-day review] |
| Shared workstations | Wards use shared devices with frequent user switching | [Fast user switching with badge tap, session timeouts tuned per area] |
| Patient rights | Patients can access, and in many laws restrict or correct, their data | [Request procedure, see `compliance/data-subject-request-procedure`] |
| Consent and sharing | Sharing across care providers depends on law and patient choices | [Consent records linked to sharing rules] |
| Long retention | Clinical records are often kept for decades | [Retention schedule, format migration plan] |
| Secondary use | Research and analytics need de-identification or a legal basis | [De-identification assessment, ethics approval] |
| Mixed estate | Clinical devices, building systems and IT share premises and sometimes networks | [Segmented clinical device network, section 8] |

## 5. Sector supplement register

<!-- Guidance: Fill from your licensed copy of ISO 27799:2025. Use its section numbers and write labels in your own words. Do not paste control text. -->

| Entry ID | Reference in 27799 | Type | Your short label | Related Annex A | Applicable | Section 7 item |
|---|---|---|---|---|---|---|
| HLT-REG-001 *(Example)* | [Section number from your copy] | Health guidance on existing control | Emergency access to patient records | A.5.15, A.5.18, A.8.15 | Yes | HLT-IMP-001 |
| HLT-REG-002 *(Example)* | [Section number from your copy] | Health guidance on existing control | Audit trail of access to health records | A.8.15, A.8.16 | Yes | HLT-IMP-002 |
| HLT-REG-003 *(Example)* | [Section number from your copy] | Health guidance on existing control | Security of medical devices on the network | A.8.1, A.8.20, A.8.22 | Yes | HLT-IMP-004 |
| HLT-REG-004 *(Example)* | [Section number from your copy] | [Health-specific control or guidance] | Patient identification and record matching | A.8.3, A.5.34 | Yes | HLT-IMP-005 |
| HLT-REG-005 | [Section number from your copy] | [Type] | [Your label] | [A.x.y] | [Yes / No] | [HLT-IMP-nnn] |
| HLT-REG-006 | [Section number from your copy] | [Type] | [Your label] | [A.x.y] | [Yes / No] | [HLT-IMP-nnn] |

Confirm that each example label matches an entry in your copy before
keeping it. Where your copy contains controls that are specific to
health and not derived from ISO/IEC 27002, record them as additional
controls in the SoA.

## 6. Mapping of health topics to Annex A

<!-- Guidance: This is the template's own mapping of typical health topics, not a table from the standard. Use it to check SoA coverage. -->

| Health topic | Primary Annex A controls (short labels) | Notes |
|---|---|---|
| Classification of health information | A.5.12 information classification, A.5.13 information labelling | Special categories handled as Restricted |
| Role-based clinical access | A.5.15 access control rules, A.5.18 access rights provisioning and review, A.8.3 restricting access | Access by care relationship and role |
| Emergency access | A.5.15, A.8.2 privileged access rights, A.8.15 logging | Break-glass with retrospective review |
| Privacy of patient data | A.5.34 privacy and PII protection, A.5.31 legal requirements | Link to PIMS (DOC-ISMS-100) where in place |
| Records retention and integrity | A.5.33 protection of records, A.8.10 information deletion | Clinical retention periods per law |
| Data sharing with other providers | A.5.14 information transfer | Standard interfaces, encryption, sharing agreements |
| Suppliers of clinical software | A.5.19 to A.5.22 supplier relationships, A.5.23 cloud services | Processor terms, uptime, security updates |
| Workforce awareness | A.6.3 awareness, education and training | Clinical staff training in short formats |
| Care premises | A.7.1 to A.7.4 physical security, A.7.7 clear desk and clear screen | Public areas, shared terminals |
| Clinical devices and building systems | A.8.1 user endpoint devices, A.8.8 vulnerability management, A.8.22 network segregation | Section 8 |
| Monitoring access to records | A.8.15 logging, A.8.16 monitoring activities | Detect snooping on colleagues or public figures |
| Resilience of clinical systems | A.5.29, A.5.30 continuity, A.8.13 backup, A.8.14 redundancy | Downtime procedures tested with clinicians |
| Test data | A.8.33 test information, A.8.11 data masking | No real patient data in test without approval and masking |
| Incident management | A.5.24 to A.5.28 incident management | Joint with clinical incident reporting |

## 7. Implementation table

<!-- Guidance: One row per item, linked to the register and a risk ID. Evidence must be a sampleable record. -->

| Item ID | Register entry | What is done | Owner | Status | Due | Evidence |
|---|---|---|---|---|---|---|
| HLT-IMP-001 *(Example)* | HLT-REG-001 | Break-glass access with mandatory reason; privacy team reviews every use within 2 working days | Head of clinical systems | Implemented | 2027-03-31 | Break-glass review log |
| HLT-IMP-002 *(Example)* | HLT-REG-002 | Access to records logged; weekly automated report flags staff viewing records of patients sharing their surname | Privacy team | Implemented | 2027-02-28 | Monitoring reports, investigation records |
| HLT-IMP-003 *(Example)* | Annex A A.8.33 guidance | Test environments loaded only with synthetic or masked data | Engineering | Partial | 2027-06-30 | Test data approvals |
| HLT-IMP-004 *(Example)* | HLT-REG-003 | Clinical device network segment with allow-listed flows and passive monitoring | Network team | Planned | 2027-12-31 | Network diagram, device inventory |
| HLT-IMP-005 *(Example)* | HLT-REG-004 | Duplicate patient record detection with a monthly data quality review | Health records manager | Implemented | 2027-01-31 | Data quality report |
| HLT-IMP-006 | [HLT-REG-nnn] | [Action] | [@owner] | [Status] | YYYY-MM-DD | [Record] |

Status summary *(Example)*: 6 rows, of which 3 implemented, 1 partial,
1 planned and 1 blank row awaiting entries.

## 8. Medical devices and clinical equipment

<!-- Guidance: Cover devices by reference only: inventory, network placement, patching with the manufacturer, procurement requirements. Device design, safety and regulatory conformity belong to the manufacturer and the device standards listed here. -->

Rules for devices that connect to [Organization name] networks:

1. **Inventory**: every connected device is in the asset inventory
   (DOC-ISMS-012) with manufacturer, model, software version, support end
   date, location and clinical owner.
2. **Network placement**: devices sit in a clinical device segment with
   only the flows they need; no internet access unless the manufacturer's
   service requires it through a controlled gateway.
3. **Updates**: install only manufacturer-approved updates; where none
   exist, apply compensating controls and record the risk.
4. **Procurement**: request the manufacturer's security documentation,
   including a software bill of materials and the support period, before
   purchase (see `security/sbom-vex-policy`).
5. **Incidents**: report suspected device compromise to the manufacturer
   and, where the law requires, to the device regulator; treat it as a
   clinical safety incident too.

Reference standards for devices and health software (cite by name, check
editions): IEC 80001-1 (safety, effectiveness and security when health
software and IT networks are combined), IEC 81001-5-1 (security in the
health software lifecycle), ISO 81001-1 (health software safety and
security principles), ISO 14971 (medical device risk management, see
`compliance/iso-14971-risk-file`). For telehealth, ISO/TS 6268-3:2026
gives telehealth cybersecurity controls mapped to ISO 27799:2025.

## 9. Worked risk example

<!-- Guidance: Show one risk end to end using the scale in DOC-ISMS-010 (likelihood 1 to 5 times impact 1 to 5; Low 1-4, Medium 5-9, High 10-16, Critical 17 to 25 (in practice 20 and 25)). -->

*Example:* Quillmere Health Systems (320 staff, two offices and one
colocation suite) runs clinical scheduling as a managed service and acts
as processor for its hospital customers.

| Field | Value |
|---|---|
| Risk ID | R-073 *(Example)* |
| Scenario | Ransomware encrypts the scheduling platform; hospitals cannot see theatre lists for the next day |
| Inherent likelihood x impact | 3 x 5 = 15, High |
| Treatment | Immutable backups with restore test twice a year (DOC-ISMS-071), daily offline schedule export for each hospital, EDR on all servers, tested hospital downtime procedure |
| Residual likelihood x impact | 2 x 3 = 6, Medium |
| Acceptance | Medium residual risk accepted by the risk owner (the product director) and the department head (head of service operations), as DOC-ISMS-010 requires for Medium risks (DOC-ISMS-019 record ACC-073 *(Example)*) |
| Review | After each restore test and yearly |

## 10. Regulatory examples

<!-- Guidance: List what applies, as recorded in the legal register (DOC-ISMS-014). These are international examples; check the official texts. This is a documentation format, not legal advice. -->

| Framework | Region | Relevance | Check |
|---|---|---|---|
| Regulation (EU) 2016/679 (GDPR), Article 9 | EU and EEA | Health data is a special category of personal data | Supervisory authority guidance |
| Directive (EU) 2022/2555 (NIS2) | EU | Health is a sector of high criticality | National transposition |
| Regulation (EU) 2025/327 (European Health Data Space) | EU | Electronic health record systems and data access; obligations apply in stages from 2027 | Article 105 of the official text for dates |
| Regulation (EU) 2017/745 (MDR) | EU | Cybersecurity of medical devices including software | Manufacturer obligations |
| HIPAA Security Rule, 45 CFR Part 164 Subpart C | United States | Safeguards for electronic protected health information; amendments proposed in January 2025 (RIN 0945-AA22) were not final at the time of writing; the regulatory agenda moved them to long-term actions with a July 2027 target, which can change | Current status on the regulator's site |
| [National health information law] | [Country] | [Record retention, data localisation, health ID] | [Source] |

## 11. Size tiers

<!-- Guidance: Use the fictional settings as size references; health roles are examples. Show what changes per tier. -->

| Aspect | Small (under 50 people) | Medium (50 to 500) | Large or multi-site (over 500 or several sites) |
|---|---|---|---|
| Size reference | Quillmere Analytics Ltd, 46 staff (38 employees, 8 contractors), part-time ISMS manager | Quillmere Health Systems, 320 staff, full-time ISMS manager and 3-person security team | Quillmere Group, 2,400 staff, 6 sites in 4 countries, CISO and 14-person security office |
| Typical health role *(Example)* | Analytics supplier processing hospital data as processor, or a small clinic | Clinical software and managed service provider (Quillmere Health Systems itself) | Hospital group or regional health network with many sites |
| Use of ISO 27799 | Privacy, supplier, logging and test data entries | Most entries, clinical safety review, device guidance for customers | Full register per site, clinical device programme, building systems |
| Governance | ISMS manager with DPO support | ISMS manager, security team, clinical safety officer | CISO, site security leads, clinical safety committee |
| Access monitoring | Platform logs reviewed monthly | Automated weekly reports on record access | Dedicated privacy monitoring team |
| Review cycle | Yearly | Yearly plus after major release | Yearly per site, rolling group review |

## 12. Records and evidence

<!-- Guidance: Name the records that prove the profile operates and map them in isms/control-evidence-matrix. -->

| Record | Proves | Owner | Location | Retention |
|---|---|---|---|---|
| Sector supplement register and SoA rows | Applicability decisions | ISMS manager | [ISMS repository] | [Life of the ISMS plus 3 years] |
| Break-glass review log | Emergency access is used properly | Privacy team | [Clinical system reports] | [Example: 6 years] |
| Record access monitoring reports and investigations | A.8.15 and A.8.16 applied to health data | Privacy team | [Restricted repository] | [Example: 6 years] |
| Clinical device inventory and segment rules | Device controls in section 8 | Clinical engineering | DOC-ISMS-012 | [Current plus 3 years] |
| Downtime procedure tests | Clinical continuity | Head of clinical systems | [BC folder] | [Example: 3 years] |
| Test data approvals | A.8.33 | Engineering | [Change tool] | [Example: 3 years] |
| Clinical safety reviews of security changes | Patient safety considered | Clinical safety officer | [Safety case file] | [Example: life of system] |

Link each record to its control in `isms/control-evidence-matrix`
(DOC-ISMS-033).

## 13. References

<!-- Guidance: Keep editions current. ISO 27799 aligns with ISO/IEC 27002:2022; check the device standards for new editions before each review. -->

| Reference | Edition and status | Use |
|---|---|---|
| ISO 27799:2025, information security controls in health based on ISO/IEC 27002 | Current (https://www.iso.org/standard/84647.html) | Health controls and guidance |
| ISO/IEC 27001:2022 + Amd 1:2024 | Current (https://www.iso.org/standard/82875.html, Amd 1: https://www.iso.org/standard/88435.html) | ISMS requirements, clause 6.1.3, Annex A |
| ISO/IEC 27002:2022 | Current (https://www.iso.org/standard/75652.html) | Control guidance |
| ISO/IEC 27701:2025 | Current (https://www.iso.org/standard/85819.html) | Privacy information management |
| ISO/IEC 27559:2022 | Current (cited without link) | De-identification framework |
| ISO/TS 6268-3:2026 | Current (cited without link) | Telehealth cybersecurity controls |
| IEC 80001-1, IEC 81001-5-1, ISO 81001-1, ISO 14971 | Check current editions (cited without link) | Devices and health software |
| Related templates | `compliance/statement-of-applicability`, `compliance/risk-methodology`, `compliance/hipaa-security-solution-design`, `compliance/dpia`, `compliance/de-identification-assessment`, `compliance/data-subject-request-procedure`, `compliance/medical-device-software-lifecycle`, `compliance/iso-14971-risk-file`, `healthcare/fhir-integration-design`, `isms/pims-27701-scope-roles`, `isms/iot-27400-security`, `isms/backup-restore-test-log`, `isms/control-evidence-matrix`, `security/sbom-vex-policy` | Linked documents |

## Standard and licence note

Structure aligned with ISO 27799:2025 and ISO/IEC 27001:2022 + Amd
1:2024 (clause 6.1.3 and Annex A). The register, considerations,
mapping and examples are original. No text, control wording, tables or
definitions from ISO or IEC standards are reproduced; the scope summary
is a short paraphrase of the public catalogue description. You need your
own licensed copy of ISO 27799 to fill section 5. Check the current
editions before use. Official ISO text, purchase or licensed access:
https://www.iso.org/standard/84647.html and
https://www.iso.org/standard/82875.html. Regulatory summaries are short
paraphrases; this is a documentation format, not legal advice.

Template licence: MIT.