ISO 27799:2025

Overview

ISO 27799:2025 - Health informatics - Information security controls in health based on ISO/IEC 27002 provides sector‑specific information security controls and implementation guidance tailored to healthcare. Based on ISO/IEC 27002:2022, it adapts generic ICT controls to risks and realities of health data, electronic health record (EHR) systems, medical devices with software/firmware, building and environmental systems used in care settings, cloud services and remote care. The standard applies to information in all forms (paper, electronic, images, audio, video), all transfer methods, and all physical and virtual care settings (hospitals, clinics, ambulances, mobile units, residential care, telehealth).

Key topics and technical requirements

ISO 27799 organizes controls into practical topic groups that align with ISO/IEC 27002 while adding healthcare context. Key areas include:

• Organizational controls: information security policies, roles and responsibilities, asset inventory and classification, supplier and cloud service controls, legal and regulatory requirements.
• People controls: screening, contracts, awareness and training, remote working, incident reporting and disciplinary processes.
• Physical controls: secure perimeters, access control for facilities, equipment protection, secure disposal and off‑premises asset security.
• Technological controls: endpoint security, privileged access management, authentication, vulnerability management, configuration management, malware protection, backups, data masking, data leakage prevention and information deletion.
• Incident management & business continuity: event detection, response, evidence collection, learning and resilience planning.
• Health‑specific guidance (HLT items): uniquely identifying subjects of care, validation of displayed/printed data, publicly available health information, emergency communications and external incident reporting.

The standard explicitly supports use with ISO/IEC 27001:2022 for ISMS implementation and decision‑making on appropriate controls.

Applications - practical value

ISO 27799:2025 is practical for:

• Developing security policies for EHRs, clinical systems and medical devices
• Assessing and contracting third‑party vendors, cloud and managed service providers
• Designing secure telehealth and remote care workflows
• Securing medical devices with embedded software/firmware and associated networks
• Implementing access control, data classification, masking and leakage prevention to protect personal health information (PHI)
• Incident response planning, evidence collection and post‑incident learning in healthcare contexts

Who should use this standard

• CIOs, CISOs and IT/security managers in hospitals and clinics
• Health informatics and interoperability teams
• Medical device manufacturers and integrators
• Cloud and service providers for healthcare customers
• Compliance officers, risk managers and auditors working with personal health information

Related standards

• ISO/IEC 27002:2022 (controls guidance)
• ISO/IEC 27001:2022 (information security management systems)

Keywords: ISO 27799:2025, health informatics, information security controls, healthcare cybersecurity, EHR security, medical device security, personal health information, ISO/IEC 27002.