EN ISO 27799:2008

Health informatics - Information security management in health using ISO/IEC 27002 (ISO 27799:2008)

ISO 27799:2008 defines guidelines to support the interpretation and implementation in health informatics of ISO/IEC 27002 and is a companion to that standard.
ISO 27799:2008 specifies a set of detailed controls for managing health information security and provides health information security best practice guidelines. By implementing this International Standard, healthcare organizations and other custodians of health information will be able to ensure a minimum requisite level of security that is appropriate to their organization's circumstances and that will maintain the confidentiality, integrity and availability of personal health information.
ISO 27799:2008 applies to health information in all its aspects; whatever form the information takes (words and numbers, sound recordings, drawings, video and medical images), whatever means are used to store it (printing or writing on paper or electronic storage) and whatever means are used to transmit it (by hand, via fax, over computer networks or by post), as the information must always be appropriately protected.

Medizinische Informatik - Sicherheitsmanagement im Gesundheitswesen bei Verwendung der ISO/IEC 27002 (ISO 27799:2008)

1.1   Allgemeines
Diese internationale Norm gibt Richtlinien vor, um die Interpretation und Umsetzung der ISO/IEC 27002 (Information Technology – Security techniques – Code of practice for information security management) in der medizinischen Informatik zu unterstützen und ist ein begleitendes Dokument zu jener Norm ).
Die vorliegende internationale Norm spezifiziert einen Satz detaillierter Maßnahmen zum Management der  Sicherheit von Gesundheitsinformationen und stellt Best Practices Leitlinien zur Sicherheit von Gesundheitsinformationen zur Verfügung. Mit der Umsetzung dieser internationalen Norm ist es Organisationen der Gesundheitsversorgung und anderen Verwahrern von Gesundheitsinformationen möglich, ein minimal erforderliches Sicherheitsniveau sicherzustellen, das den Randbedingungen der Organisationen angemessen ist und das die Vertraulichkeit, Integrität und Verfügbarkeit von persönlichen Gesundheitsinformationen aufrecht erhält.
Diese internationale Norm gilt für Gesundheitsinformationen in all ihren Aspekten; denn in welcher Form auch immer die Informationen vorliegen (Worte und Zahlen, Tonaufzeichnungen, Abbildungen, Videomaterial und medizinische Bilder), welche Mittel auch immer zur Speicherung genutzt werden (auf Papier drucken oder schreiben oder elektrisches Speichern) und welche Mittel auch immer zur Übertragung genutzt werden (manuell, per Fax, über Computernetzwerke oder per Post), die Informationen müssen immer angemessen geschützt werden.
Diese internationale Norm definiert gemeinsam mit ISO/IEC 27002, was bezüglich Informationssicherheit in der Gesundheitsversorgung erforderlich ist; sie definieren nicht, wie diese Anforderungen zu erfüllen sind. Somit ist diese internationale Norm - so weit es irgendwie möglich ist - technologieneutral. Neutralität im Hinblick auf die Umsetzung von Technologien ist ein wesentliches Kennzeichen.

Informatique de santé - Gestion de la sécurité de l'information relative à la santé en utilisant l'ISO/CEI 27002 (ISO 27799:2008)

L'ISO 27799:2008 fournit des lignes directrices permettant d'interpréter et de mettre en œuvre l'ISO/CEI 27002 dans le domaine de l'informatique de santé et constitue un complément à cette dernière.
L'ISO 27799:2008 spécifie une série de contrôles détaillés en vue de la gestion de la sécurité des informations de santé et apporte des indications de bonne pratique en matière de sécurité des informations de santé. La mise en œuvre de la présente Norme internationale permettra aux organismes de santé et aux autres dépositaires d'informations de santé de garantir le niveau minimal requis en termes de sécurité propre aux dispositifs de leur organisme et de garantir la confidentialité, l'intégrité et la disponibilité des informations personnelles de santé.
L'ISO 27799:2008 s'applique à tous les aspects de l'information de santé, quelle que soit la forme (mots, chiffres, enregistrements sonores, dessins, vidéos et images médicales), le support utilisé pour les stocker (imprimés, écrits papier, stockage électronique) ou les moyens mis en œuvre pour leur transmission (en main propre, par fax, par réseau informatique ou par la poste), car l'information doit toujours être protégée efficacement.

Zdravstvena informatika - Upravljanje informacijske varnosti v zdravstvu z uporabo standarda ISO/IEC 27002 (ISO 27799:2008)

General Information

• Status: Withdrawn
• Publication Date: 30-Jun-2008
• Withdrawal Date: 09-Aug-2016
• ICS: 35.240.80 - IT applications in health care technology
• Technical Committee: CEN/TC 251 - Medical informatics
• Drafting Committee: CEN/TC 251/WG 1 - Information models
• Current Stage: 9960 - Withdrawal effective - Withdrawal
• Completion Date: 10-Aug-2016
• Ref Project: SIST EN ISO 27799:2008 - Health informatics - Information security management in health using ISO/IEC 27002 (ISO 27799:2008)

Relations

• Replaced By: EN ISO 27799:2016 - Health informatics - Information security management in health using ISO/IEC 27002 (ISO 27799:2016)
• Effective Date: 17-Aug-2016

Standards Content (Sample)

SLOVENSKI STANDARD
01-november-2008
Zdravstvena informatika - Upravljanje informacijske varnosti v zdravstvu z
uporabo standarda ISO/IEC 27002 (ISO 27799:2008)
Health informatics - Information security management in health using ISO/IEC 27002
(ISO 27799:2008)
Medizinische Informatik - Sicherheitsmanagement im Gesundheitswesen bei
Verwendung der ISO/IEC 17799 (ISO 27799:2008)
Informatique de santé - Gestion de la sécurité de l'information relative à la santé en
utilisant l'ISO/CEI 27002 (ISO 27799:2008)
Ta slovenski standard je istoveten z: EN ISO 27799:2008
ICS:
35.240.80 Uporabniške rešitve IT v IT applications in health care
zdravstveni tehniki technology
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

EUROPEAN STANDARD
EN ISO 27799
NORME EUROPÉENNE
EUROPÄISCHE NORM
July 2008
ICS 35.240.80
English Version
Health informatics - Information security management in health
using ISO/IEC 27002 (ISO 27799:2008)
Informatique de santé - Gestion de la sécurité de Medizinische Informatik - Sicherheitsmanagement im
l'information relative à la santé en utilisant l'ISO/CEI 27002 Gesundheitswesen bei Verwendung der ISO/IEC 27002
(ISO 27799:2008) (ISO 27799:2008)
This European Standard was approved by CEN on 15 June 2008.
CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European
Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such national
standards may be obtained on application to the CEN Management Centre or to any CEN member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by translation
under the responsibility of a CEN member into its own language and notified to the CEN Management Centre has the same status as the
official versions.
CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Cyprus, Czech Republic, Denmark, Estonia, Finland,
France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal,
Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland and United Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION
EUROPÄISCHES KOMITEE FÜR NORMUNG
Management Centre: rue de Stassart, 36  B-1050 Brussels
© 2008 CEN All rights of exploitation in any form and by any means reserved Ref. No. EN ISO 27799:2008: E
worldwide for CEN national Members.

Contents Page
Foreword.3

Foreword
This document (EN ISO 27799:2008) has been prepared by Technical Committee ISO/TC 215 "Health
informatics" in collaboration with Technical Committee CEN/TC 251 “Health informatics” the secretariat of
which is held by NEN.
This European Standard shall be given the status of a national standard, either by publication of an identical
text or by endorsement, at the latest by January 2009, and conflicting national standards shall be withdrawn at
the latest by January 2009.
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent
rights. CEN [and/or CENELEC] shall not be held responsible for identifying any or all such patent rights.
According to the CEN/CENELEC Internal Regulations, the national standards organizations of the following
countries are bound to implement this European Standard: Austria, Belgium, Bulgaria, Cyprus, Czech
Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia,
Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain,
Sweden, Switzerland and the United Kingdom.
Endorsement notice
The text of ISO 27799:2008 has been approved by CEN as a EN ISO 27799:2008 without any modification.

INTERNATIONAL ISO
STANDARD 27799
First edition
2008-07-01
Health informatics — Information security
management in health using
ISO/IEC 27002
Informatique de santé — Gestion de la sécurité de l'information relative
à la santé en utilisant l'ISO/CEI 27002

Reference number
ISO 27799:2008(E)
©
ISO 2008
ISO 27799:2008(E)
PDF disclaimer
This PDF file may contain embedded typefaces. In accordance with Adobe's licensing policy, this file may be printed or viewed but
shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In
downloading this file, parties accept therein the responsibility of not infringing Adobe's licensing policy. The ISO Central Secretariat
accepts no liability in this area.
Adobe is a trademark of Adobe Systems Incorporated.
Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation
parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In
the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below.

©  ISO 2008
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means,
electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or
ISO's member body in the country of the requester.
ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail [e-mail]
Web www.iso.org
Published in Switzerland
ii © ISO 2008 – All rights reserved

ISO 27799:2008(E)
Contents Page
Foreword. iv
Introduction . v
1 Scope . 1
1.1 General. 1
1.2 Scope exclusions. 1
2 Normative references . 2
3 Terms and definitions. 2
3.1 Health terms . 2
3.2 Information security terms . 3
4 Abbreviated terms . 5
5 Health information security . 5
5.1 Health information security goals. 5
5.2 Information security within information governance. 6
5.3 Information governance within corporate and clinical governance. 7
5.4 Health information to be protected. 7
5.5 Threats and vulnerabilities in health information security . 8
6 Practical action plan for implementing ISO/IEC 27002 . 8
6.1 Taxonomy of the ISO/IEC 27002 and ISO/IEC 27001 standards. 8
6.2 Management commitment to implementing ISO/IEC 27002 . 9
6.3 Establishing, operating, maintaining and improving the ISMS . 10
6.4 Planning: establishing the ISMS . 10
6.5 Doing: implementing and operating the ISMS. 18
6.6 Checking: monitoring and reviewing the ISMS . 19
6.7 Acting: maintaining and improving the ISMS . 20
7 Healthcare implications of ISO/IEC 27002.20
7.1 General. 20
7.2 Information security policy. 21
7.3 Organizing information security . 22
7.4 Asset management. 25
7.5 Human resources security. 26
7.6 Physical and environmental security . 29
7.7 Communications and operations management . 30
7.8 Access control . 36
7.9 Information systems acquisition, development and maintenance. 39
7.10 Information security incident management . 41
7.11 Information security aspects of business continuity management . 42
7.12 Compliance. 42
Annex A (informative) Threats to health information security . 45
Annex B (informative) Tasks and related documents of the Information Security Management
System . 50
Annex C (informative) Potential benefits and required attributes of support tools . 54
Bibliography . 57

ISO 27799:2008(E)
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies
(ISO member bodies). The work of preparing International Standards is normally carried out through ISO
technical committees. Each member body interested in a subject for which a technical committee has been
established has the right to be represented on that committee. International organizations, governmental and
non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the
International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.
The main task of technical committees is to prepare International Standards. Draft International Standards
adopted by the technical committees are circulated to the member bodies for voting. Publication as an
International Standard requires approval by at least 75 % of the member bodies casting a vote.
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent
rights. ISO shall not be held responsible for identifying any or all such patent rights.
ISO 27799 was prepared by Technical Committee ISO/TC 215, Health informatics.
iv © ISO 2008 – All rights reserved

ISO 27799:2008(E)
Introduction
This International Standard provides guidance to healthcare organizations and other custodians of personal
health information on how best to protect the confidentiality, integrity and availability of such information by
1)
implementing ISO/IEC 27002 . Specifically, this International Standard addresses the special information
security management needs of the health sector and its unique operating environments. While the protection
and security of personal information is important to all individuals, corporations, institutions and governments,
there are special requirements in the health sector that need to be met to ensure the confidentiality, integrity,
auditability and availability of personal health information. Thi
...