ISO 27001 is an international standard for managing information security. Organizations certified to ISO/IEC 27001 have an information security management system (ISMS) that has been independently audited by a certification body. The system helps organizations find security risks, implement appropriate controls, and continually review and improve their information security practices.
Also called: ISO/IEC 27001, ISO 27001:2022, ISMS certification
Quick facts
- Function: Security assurance
- Domain: Information security
- Used by: Vendor risk teams, compliance officers, global organizations
- Related terms: SOC 2 Type II, HITRUST certification
What does ISO 27001 certification involve?
The ISO 27001 certification involves an independent audit of an organization’s information security management system. After initial certification, organizations undergo regular surveillance audits, typically annually, and a full recertification audit every three years.
What does ISO 27001 cover?
ISO 27001 covers an organization’s information security management system as a whole, not just a specific set of technical security controls. It requires organizations to identify risks, establish security policies, select appropriate controls, monitor performance, and continually improve practices.
The certificate defines the scope of the certification which may cover specific business operations, locations, systems, or services rather than the entire organization. Buyers should confirm that the scope includes the services and teams they plan to outsource.
Why does it matter when outsourcing patient access?
The ISO 27001 certification provides evidence that a service provider manages information security through a documented, independently audited process. This matters when outsourcing patient access because teams typically handle protected health information (PHI), scheduling data, insurance details, and other sensitive patient information across multiple locations.
It is important to note that the ISO 27001 does not replace HIPAA requirements or a business associate agreement (BAA). Healthcare organizations should still confirm that their vendor meets applicable HIPAA obligations and has appropriate safeguards for PHI.
ISO 27001 vs. SOC 2 vs. HITRUST
- ISO 27001: An international standard for managing information security through a documented, independently audited management system.
- SOC 2 Type II: An independent examination of a service organization’s controls relevant to security and other applicable Trust Services Criteria over a period of time.
- HITRUST certification: An independently assessed certification demonstrating that an organization meets the requirements of a defined HITRUST framework and assessment scope.
Each provides a different type of assurance and buyers should evaluate the certification or report’s scope, validity, and relevance to the services being outsourced.
FAQs
Is ISO 27001 recognized in US healthcare?
Yes, the ISO 27001 is an internationally recognized information security standard used across a variety of industries, including healthcare. US healthcare organizations can use it to evaluate a vendor’s information security practices.
How can buyers verify a certificate?
Ask the provider for its certificate and check:
- Certification body: Which organization issued the certificate, and is it accredited?
- Scope: Does certification cover the services, locations, and operations being outsourced?
- Validity: Is the certificate current and has it been maintained?
- Standard version: Does it identify the applicable standard, such as ISO/IEC 27001:2022?
Buyers can also check the certificate through IAF CertSearch or contact the issuing certification body to confirm its status.
