ISO 27789:2021

Overview

ISO 27789:2021 - Health informatics - Audit trails for electronic health records - specifies a common framework for audit trails in Electronic Health Record (EHR) systems. It applies to systems that process personal health information (PHI) and create a secure audit record each time a user reads, creates, updates, or archives PHI. The standard ensures that actions on EHRs are auditable across systems and domains while limiting audit records to identifiers and links (not PHI content).

Key point: audit records must at minimum uniquely identify the user and the subject of care, record the function performed (create/read/update/archive), and capture date/time.

Key topics and technical requirements

ISO 27789 defines the structure, content and management of audit logs for health informatics. Major technical topics include:

• Trigger events - which user actions generate audit entries (access, query, create, update, archive).
• Audit record format - required elements such as Event ID, action code, date/time, outcome indicator and event type.
• User and role identification - unique user IDs, alternative IDs, user names, role codes and purpose-of-use indicators.
• Participant object identification - identifiers for EHR segments, object type, lifecycle events and sensitivity.
• Access point and audit source - network access point IDs, audit enterprise/site IDs and source type codes to support cross-domain tracing.
• Security and lifecycle management - requirements for secure storage, availability, confidentiality, integrity, retention, and controlled access to audit data.
• Scope limitations - audit records should not contain PHI beyond identifiers/links; system management/security logs (e.g., performance monitoring) are out of scope and addressed by general security standards.
• Informative annexes - Annex A provides audit scenarios; Annex B outlines audit log services.

Applications and who uses it

ISO 27789 is used to design, implement and validate auditable EHR systems for:

• EHR vendors and software developers (audit log design and interoperability)
• Health IT architects and system integrators (cross-domain audit frameworks)
• Clinical and hospital IT managers, CISOs and compliance officers (governance, access monitoring)
• Auditors, privacy officers and regulators (investigations, incident response, legal evidence)
• Health information exchanges and multi‑site deployments (consistent auditing across domains)

Practical uses include forensic investigations, compliance with privacy laws, patient access and rights requests, supervision of access policy compliance, and retention/evidence management.

Related standards

• ISO/IEC 15408 (general computer and security assurance) - complements system security and management logging.
• DICOM audit interoperability - ISO 27789 harmonizes aspects with DICOM audit formats.
• ISO/TC 215 (Health informatics) outputs and regional/national EHR regulations may reference or adopt ISO 27789.