prEN ISO 27799
(Main)Health informatics - Information security management in health using ISO/IEC 27002 (ISO/DIS 27799:2025)
Health informatics - Information security management in health using ISO/IEC 27002 (ISO/DIS 27799:2025)
ISO 27799:2016 gives guidelines for organizational information security standards and information security management practices including the selection, implementation and management of controls taking into consideration the organization's information security risk environment(s).
It defines guidelines to support the interpretation and implementation in health informatics of ISO/IEC 27002 and is a companion to that International Standard.
ISO 27799:2016 provides implementation guidance for the controls described in ISO/IEC 27002 and supplements them where necessary, so that they can be effectively used for managing health information security. By implementing ISO 27799:2016, healthcare organizations and other custodians of health information will be able to ensure a minimum requisite level of security that is appropriate to their organization's circumstances and that will maintain the confidentiality, integrity and availability of personal health information in their care.
It applies to health information in all its aspects, whatever form the information takes (words and numbers, sound recordings, drawings, video, and medical images), whatever means are used to store it (printing or writing on paper or storage electronically), and whatever means are used to transmit it (by hand, through fax, over computer networks, or by post), as the information is always be appropriately protected.
ISO 27799:2016 and ISO/IEC 27002 taken together define what is required in terms of information security in healthcare, they do not define how these requirements are to be met. That is to say, to the fullest extent possible, ISO 27799:2016 is technology-neutral. Neutrality with respect to implementing technologies is an important feature. Security technology is still undergoing rapid development and the pace of that change is now measured in months rather than years. By contrast, while subject to periodic review, International Standards are expected on the whole to remain valid for years. Just as importantly, technological neutrality leaves vendors and service providers free to suggest new or developing technologies that meet the necessary requirements that ISO 27799:2016 describes.
As noted in the introduction, familiarity with ISO/IEC 27002 is indispensable to an understanding of ISO 27799:2016.
The following areas of information security are outside the scope of ISO 27799:2016:
a) methodologies and statistical tests for effective anonymization of personal health information;
b) methodologies for pseudonymization of personal health information (see Bibliography for a brief description of a Technical Specification that deals specifically with this topic);
c) network quality of service and methods for measuring availability of networks used for health informatics;
d) data quality (as distinct from data integrity).
Medizinische Informatik - Informationssicherheitsmanagement im Gesundheitswesen bei Verwendung der ISO/IEC 27002 (ISO/DIS 27799:2025)
Informatique de santé - Management de la sécurité de l'information relative à la santé en utilisant l'ISO/IEC 27002 (ISO/DIS 27799:2025)
L'ISO 27799 :2016 donne des lignes directrices en matière de normes organisationnelles relatives à la sécurité de l'information et des bonnes pratiques de management de la sécurité de l'information, incluant la sélection, la mise en ?uvre et la gestion de mesures de sécurité prenant en compte le ou les environnement(s) à risques pour la sécurité de l'information de l'organisme.
Elle spécifie des lignes directrices permettant d'interpréter et de mettre en ?uvre l'ISO/IEC 27002 dans le domaine de l'informatique de santé et constitue un complément à cette dernière.
L'ISO 27799 :2016 fournit des préconisations de mise en ?uvre des mesures décrites dans l'ISO/IEC 27002 et les complète, le cas échéant, de façon à ce qu'elles puissent être utilisées efficacement dans le mangement de la sécurité des informations de santé. La mise en ?uvre de l'ISO 27799 :2016 permettra aux organismes de santé et aux autres dépositaires d'informations de santé de garantir le niveau minimal requis de sécurité approprié aux conditions de leur organisme et de protéger la confidentialité, l'intégrité et la disponibilité des informations personnelles de santé dans leurs activités de soins.
L'ISO 27799 :2016 s'applique à tous les aspects des informations de santé, quelle que soit la forme (mots, chiffres, enregistrements sonores, dessins, vidéos et images médicales), le support utilisé pour les stocker (imprimés, documents manuscrits ou stockage électronique) ou les moyens mis en ?uvre pour leur transmission (en main propre, par fax, par réseau informatique ou par courrier), de sorte que l'information soit toujours correctement protégée.
L'ISO 27799 :2016 et l'ISO/IEC 27002 définissent les exigences en termes de sécurité de l'information dans les soins de santé, mais elles ne définissent pas la façon de satisfaire à ces exigences. En d'autres termes, dans toute la mesure du possible, la technologie est absente de l'ISO 27799 :2016. La neutralité sur les technologies de mise en ?uvre est une caractéristique importante. La technologie en matière de sécurité continue de se développer rapidement. Le rythme de cette évolution se mesure actuellement en mois et non plus en années. En revanche, bien que les Normes internationales soient soumises à des révisions régulières, il est prévu qu'elles restent valides pendant plusieurs années. De manière également importante, la neutralité sur les technologies laisse aux fournisseurs et aux prestataires de services l'entière liberté de suggérer des technologies nouvelles ou en développement qui peuvent répondre aux exigences décrites dans l'ISO 27799 :2016.
Comme mentionné dans l'introduction, la connaissance de l'ISO/IEC 27002 est indispensable à la compréhension de l'ISO 27799 :2016.
Les domaines suivants de la sécurité de l'information ne relèvent pas du domaine d'application de l'ISO 27799 :2016:
a) les méthodologies et les essais statistiques en vue d'une anonymisation efficace des informations personnelles de santé;
b) les méthodologies en vue de la pseudonymisation des informations personnelles de santé (voir la bibliographie pour une brève description d'une Spécification technique qui traite spécifiquement de ce sujet);
c) la qualité des services fournis par le réseau et les méthodes pour évaluer la disponibilité des réseaux utilisés pour l'informatique de santé;
d) la qualité des données (par opposition à l'intégrité des données).
Zdravstvena informatika - Vodenje informacijske varnosti v zdravstvu z uporabo standarda ISO/IEC 27002 (ISO/DIS 27799:2025)
General Information
Relations
Standards Content (Sample)
SLOVENSKI STANDARD
01-marec-2025
Nadomešča:
SIST EN ISO 27799:2017
Zdravstvena informatika - Vodenje informacijske varnosti v zdravstvu z uporabo
standarda ISO/IEC 27002 (ISO/DIS 27799:2025)
Health informatics - Information security management in health using ISO/IEC 27002
(ISO/DIS 27799:2025)
Medizinische Informatik - Informationssicherheitsmanagement im Gesundheitswesen bei
Verwendung der ISO/IEC 27002 (ISO/DIS 27799:2025)
Informatique de santé - Management de la sécurité de l'information relative à la santé en
utilisant l'ISO/IEC 27002 (ISO/DIS 27799:2025)
Ta slovenski standard je istoveten z: prEN ISO 27799
ICS:
35.030 Informacijska varnost IT Security
35.240.80 Uporabniške rešitve IT v IT applications in health care
zdravstveni tehniki technology
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
DRAFT
International
Standard
ISO/DIS 27799
ISO/TC 215
Health informatics — Information
Secretariat: ANSI
security management in health
Voting begins on:
using ISO/IEC 27002
2025-01-20
Informatique de santé — Management de la sécurité de
Voting terminates on:
l'information relative à la santé en utilisant l'ISO/IEC 27002
2025-04-14
ICS: 35.030; 35.240.80
THIS DOCUMENT IS A DRAFT CIRCULATED
FOR COMMENTS AND APPROVAL. IT
IS THEREFORE SUBJECT TO CHANGE
AND MAY NOT BE REFERRED TO AS AN
INTERNATIONAL STANDARD UNTIL
PUBLISHED AS SUCH.
This document is circulated as received from the committee secretariat.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL,
TECHNOLOGICAL, COMMERCIAL AND
USER PURPOSES, DRAFT INTERNATIONAL
STANDARDS MAY ON OCCASION HAVE TO
ISO/CEN PARALLEL PROCESSING
BE CONSIDERED IN THE LIGHT OF THEIR
POTENTIAL TO BECOME STANDARDS TO
WHICH REFERENCE MAY BE MADE IN
NATIONAL REGULATIONS.
RECIPIENTS OF THIS DRAFT ARE INVITED
TO SUBMIT, WITH THEIR COMMENTS,
NOTIFICATION OF ANY RELEVANT PATENT
RIGHTS OF WHICH THEY ARE AWARE AND TO
PROVIDE SUPPORTING DOCUMENTATION.
Reference number
ISO/DIS 27799:2025(en)
DRAFT
ISO/DIS 27799:2025(en)
International
Standard
ISO/DIS 27799
ISO/TC 215
Health informatics — Information
Secretariat: ANSI
security management in health
Voting begins on:
using ISO/IEC 27002
Informatique de santé — Management de la sécurité de
Voting terminates on:
l'information relative à la santé en utilisant l'ISO/IEC 27002
ICS: 35.030; 35.240.80
THIS DOCUMENT IS A DRAFT CIRCULATED
FOR COMMENTS AND APPROVAL. IT
IS THEREFORE SUBJECT TO CHANGE
AND MAY NOT BE REFERRED TO AS AN
INTERNATIONAL STANDARD UNTIL
PUBLISHED AS SUCH.
This document is circulated as received from the committee secretariat.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL,
© ISO 2025
TECHNOLOGICAL, COMMERCIAL AND
USER PURPOSES, DRAFT INTERNATIONAL
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
STANDARDS MAY ON OCCASION HAVE TO
ISO/CEN PARALLEL PROCESSING
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
BE CONSIDERED IN THE LIGHT OF THEIR
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
POTENTIAL TO BECOME STANDARDS TO
WHICH REFERENCE MAY BE MADE IN
or ISO’s member body in the country of the requester.
NATIONAL REGULATIONS.
ISO copyright office
RECIPIENTS OF THIS DRAFT ARE INVITED
CP 401 • Ch. de Blandonnet 8
TO SUBMIT, WITH THEIR COMMENTS,
CH-1214 Vernier, Geneva
NOTIFICATION OF ANY RELEVANT PATENT
Phone: +41 22 749 01 11
RIGHTS OF WHICH THEY ARE AWARE AND TO
PROVIDE SUPPORTING DOCUMENTATION.
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland Reference number
ISO/DIS 27799:2025(en)
ii
ISO/DIS 27799:2025(en)
Contents Page
Foreword .vi
Introduction .vii
1 Scope . 1
2 Normative references . 1
3 Terms, definitions and abbreviated terms . 1
3.1 Terms and definitions .2
3.2 Abbreviated terms .3
4 General . 3
4.1 Structure of this Document .3
4.2 Safety.3
4.3 Selecting and applying controls .4
4.3.1 Determining controls .4
4.3.2 Application of Guidance .4
4.3.3 Use with ISO/IEC 27001:2022 .4
5 Organizational controls . 4
5.1 Policies for information security . .4
5.2 Information security roles and responsibilities .6
5.3 Segregation of duties.7
5.4 Management responsibilities .7
5.5 Contact with authorities .7
5.6 Contact with special interest groups . .7
5.7 Threat intelligence .7
5.8 Information security in project management .8
5.9 Inventory of information and other associated assets .8
5.10 Acceptable use of information and other associated assets .9
5.11 Return of assets .9
5.12 Classification of information .9
5.13 Labelling of information .10
5.14 Information transfer .10
5.15 Access control .11
5.16 Identity management .11
5.17 Authentication information . 12
5.18 Access rights . 12
5.19 Information security in supplier relationships . 13
5.20 Addressing information security within supplier agreements . 13
5.21 Managing information security in the ICT supply chain . 13
5.22 Monitoring, review and change management of supplier services .14
5.23 Information security for use of cloud services .14
5.24 Information security incident management planning and preparation .14
5.25 Assessment and decision on information security events .14
5.26 Response to information security incidents .14
5.27 Learning from information security incidents .14
5.28 Collection of evidence . .14
5.29 Information security during disruption . 15
5.30 ICT readiness for business continuity . 15
5.31 Legal, statutory, regulatory and contractual requirements . 15
5.32 Intellectual property rights . 15
5.33 Protection of records .16
5.34 Privacy and protection of PII .16
5.35 Independent review of information security .17
5.36 Conformance with policies, rules and standards for information security .17
5.37 Documented operating procedures .17
5.38 HLT – Information security requirements analysis and specification .18
iii
ISO/DIS 27799:2025(en)
5.39 HLT – Uniquely identifying subjects of care .19
5.40 HLT – Validation of displayed/printed data . 20
5.41 HLT – Publicly available health information .
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.