BS EN ISO 27799:2016 gives guidelines for organizational information security standards and information security management practices including the selection, implementation and management of controls taking into consideration the organization's information security risk environment(s).

This International Standard defines guidelines to support the interpretation and implementation in health informatics of ISO/IEC 27002 and is a companion to that International Standard.4) This International Standard provides implementation guidance for the controls described in ISO/IEC 27002 and supplements them where necessary, so that they can be effectively used for managing health information security. By implementing this International Standard, healthcare organizations and other custodians of health information will be able to ensure a minimum requisite level of security that is appropriate to their organization's circumstances and that will maintain the confidentiality, integrity and availability of personal health information in their care.

This International Standard applies to health information in all its aspects, whatever form the information takes (words and numbers, sound recordings, drawings, video, and medical images), whatever means are used to store it (printing or writing on paper or storage electronically), and whatever means are used to transmit it (by hand, through fax, over computer networks, or by post), as the information is always be appropriately protected.

This International Standard and ISO/IEC 27002 taken together define what is required in terms of information security in healthcare, they do not define how these requirements are to be met. That is to say, to the fullest extent possible, this International Standard is technology-neutral. Neutrality with respect to implementing technologies is an important feature. Security technology is still undergoing rapid development and the pace of that change is now measured in months rather than years. By contrast, while subject to periodic review, International Standards are expected on the whole to remain valid for years. Just as importantly, technological neutrality leaves vendors and service providers free to suggest new or developing technologies that meet the necessary requirements that this International Standard describes.

As noted in the introduction, familiarity with ISO/IEC 27002 is indispensable to an understanding of this International Standard.

The following areas of information security are outside the scope of this International Standard:

• methodologies and statistical tests for effective anonymization of personal health information;
• methodologies for pseudonymization of personal health information (see Bibliography for a brief description of a Technical Specification that deals specifically with this topic);
• network quality of service and methods for measuring availability of networks used for health informatics;
• data quality (as distinct from data integrity).

Cross References:
ISO/IEC 27000
ISO/IEC 27002
ISO/IEC 11770-1
ISO/IEC 11770-2
ISO/IEC 11770-3
ISO/TS 14441:2013
ISO 15489-1
ISO 17090-1
ISO 17090-2
ISO 17090-3
ISO/TR 17791:2013
ISO/TS 17975
ISO/IEC 18028-4:2005
ISO 21091
ISO/TS 21298
ISO 22301
ISO 22313
ISO 22600-1
ISO 22600-2
ISO 22600-3
ISO/TS 25237
ISO/IEC 27001:2013
ISO/IEC 27005
ISO/IEC 27007
ISO/IEC/TR 27008
ISO/IEC 27031
ISO/IEC 27033-1
ISO/IEC 27033-2
ISO/IEC 27033-3
ISO/IEC 27033-4
ISO/IEC 27033-5
ISO/IEC 27035
ISO/IEC 27036-1
ISO/IEC 27036-2
ISO/IEC 27036-3
ISO/IEC 27037
ISO 27789:2013
ISO 22857
ISO/IEC 29100
ISO/IEC 29101
ISO 31000


All current amendments available at time of purchase are included with the purchase of this document.