ISO 27799:2016

Overview

ISO 27799:2016 - Health informatics - Information security management in health using ISO/IEC 27002 - provides sector-specific guidance to protect personal health information. It adapts and interprets the controls of ISO/IEC 27002 for healthcare, helping organizations select, implement and manage security controls appropriate to their risk environment. ISO 27799 is technology‑neutral and applies to health data in any form (paper, images, recordings, electronic records) and across any transmission or storage method.

Key topics and technical requirements

ISO 27799 supplements ISO/IEC 27002 with healthcare-focused guidance. Major topics covered include:

• Information security policies: management direction and regular policy review.
• Organization of information security: roles, segregation of duties, project security, mobile devices and teleworking.
• Human resource security: pre-employment screening, training, responsibilities, and termination procedures.
• Asset management: inventory, ownership, acceptable use, classification, labelling and media handling.
• Access control: business requirements, user provisioning, privileged access management, authentication and access reviews.
• Cryptography: policy for cryptographic controls and key management guidance.
• Physical & environmental security: secure areas, entry controls, equipment siting and protection.
• Operations security: change management, backup, malware protection, logging, vulnerability management and audit considerations.
• Communications security and additional controls tailored to health informatics contexts.

Important clarifications:

• ISO 27799 and ISO/IEC 27002 together define what is required but not exactly how to implement it - they are technology‑neutral.
• Out of scope: anonymization/pseudonymization methodologies, network QoS measurement, and data quality (distinct from data integrity).

Applications and who uses it

ISO 27799 is practical for:

• Healthcare providers (hospitals, clinics) implementing information security for electronic health records (EHRs).
• Health information custodians and data controllers responsible for patient data confidentiality, integrity and availability.
• Health IT vendors and system integrators designing secure clinical systems.
• Risk managers, security officers and compliance teams aligning controls to clinical workflows.
• Auditors and assessors evaluating health-sector information security controls.

Benefits include standardized guidance for protecting personal health information, clearer risk‑based control selection, and better alignment with general information security frameworks.

Related standards

• ISO/IEC 27002 - Code of practice for information security controls (primary companion).
• ISO/IEC 27001 - Information security management systems (ISMS) - often used alongside ISO 27799 for certification and management-system alignment.

Keywords: ISO 27799, health informatics, information security, ISO/IEC 27002, health data security, personal health information, access control, cryptography, asset management, healthcare cybersecurity.