ISO 27001 Healthcare Requirements: What U.S. Organizations Need

No U.S. federal law requires a healthcare organization to hold ISO 27001 certification. What the standard does require is an information security management system (ISMS): a defined scope, a documented risk process, a Statement of Applicability, management commitment, internal audits and, if you want the certificate, two external audit stages. HIPAA is the law. ISO 27001 is the voluntary framework that hospitals, payers and health-system customers increasingly ask vendors to prove.

This guide explains what the 2022 edition asks of a healthcare organization, how it fits with the HIPAA Security Rule, what evidence auditors look for, and what to plan for in time, people and budget.

TL;DR

• ISO 27001 is voluntary in the U.S. HIPAA is mandatory for covered entities and business associates, and HHS does not treat a private certification as proof of Security Rule compliance.
• The standard requires an ISMS: scope, leadership commitment, risk assessment and treatment, a Statement of Applicability, internal audit, management review and continual improvement.
• A HIPAA risk analysis can feed your ISO 27001 risk work, but the two are not interchangeable. Map them instead of running two separate programs.
• Scope is the biggest early decision. A certificate covers only what you put in scope, such as one product, one site or one business unit.
• Budget for staff time first, then gap remediation, then certification body fees. A structured estimate beats a guess.

Table of Contents

• Is ISO 27001 required for healthcare in the U.S.?
• What ISO/IEC 27001:2022 requires
• Annex A controls that matter most in healthcare
• How ISO 27001 relates to the HIPAA Security Rule
• Scoping your ISMS and assessing gaps
• From gap assessment to certificate: the main steps
• Documentation and audit evidence to prepare
• Where healthcare implementations stall
• Time, staffing and budget
• Our perspective
• Get a realistic estimate before you commit
• FAQ
• Sources

Is ISO 27001 required for healthcare in the U.S.?

No. ISO 27001 is a voluntary, sector-agnostic standard. The legal baseline for U.S. healthcare is HIPAA, and HHS says plainly that it does not endorse or recognize private organizations’ certifications as evidence of Security Rule compliance. The HHS FAQ on certifying compliance is the document to read before anyone promises your board that a certificate “makes you HIPAA compliant.”

So why do healthcare organizations pursue it anyway? Three reasons come up most often:

1. Buyer pressure. Health systems, payers and large employers send security questionnaires to vendors. A certificate from an accredited body shortens those reviews.
2. A recognized structure. HIPAA tells you what to protect and leaves much of the method to you. ISO 27001 gives a repeatable management system around that.
3. International work. If you serve patients, sponsors or partners outside the U.S., ISO 27001 is the credential they already know.

If none of those applies to you, a HIPAA-only program may be the right call. We would rather you know that than buy a certification you will not use.

What ISO/IEC 27001:2022 requires

The standard, published by ISO, defines the requirements an ISMS must meet and is meant to be adapted to an organization’s size and needs. That wording matters for healthcare: the standard does not prescribe a clinical-specific control list. You decide what applies to a 40-bed critical access hospital, a telehealth startup or a billing company, and you justify those decisions.

The mandatory clauses (4 to 10) are the same for everyone. In healthcare terms they look like this.

Context and scope

You identify the interested parties (patients, regulators, payers, partner hospitals), their requirements, and the boundary of your ISMS. For a healthcare organization the scope statement usually names the systems that create, receive, maintain or transmit patient data: the EHR, patient portal, billing platform, medical device networks, cloud environments and the teams that operate them.

Be precise. A certificate for one product or business unit says nothing about the rest of the enterprise, and sophisticated buyers read the scope statement first.

Leadership and resources

Top management must show commitment by integrating the ISMS into organizational processes and making resources available. The ISACA implementation guide for ISO/IEC 27001:2022 covers this in detail. In practice, auditors want to see an information security policy approved by leadership, named roles, and a budget line, not a policy that lives only in the compliance officer’s folder.

In a hospital, the hard part is usually ownership. Clinical, IT, privacy and compliance leaders each hold a piece. Decide early who chairs the ISMS steering group. Our piece on why IT managers often lead ISMS implementation covers the trade-offs.

Risk assessment and treatment

You need a defined, repeatable risk method: criteria for likelihood and impact, a way to identify risks to the confidentiality, integrity and availability of information, owners for each risk, and a treatment plan. For healthcare, availability deserves extra weight. A ransomware outage that forces ambulance diversion is a patient safety event, not only an IT problem.

Statement of Applicability

The Statement of Applicability (SoA) lists the Annex A controls you need, justifies including them, and justifies excluding any you leave out. The text of the 2022 standard sets out that requirement. Auditors treat the SoA as the map of your whole system, so it must agree with your risk treatment plan. We walk through it in our Statement of Applicability guide.

Operation, evaluation and improvement

You run the risk process, monitor results, conduct internal audits, hold management reviews, and fix nonconformities. These clauses generate most of the evidence an auditor asks to see.

Annex A controls that matter most in healthcare

The 2022 edition groups 93 Annex A controls into four themes: organizational, people, physical and technological. You do not implement all of them by default; you select based on risk. In healthcare, these tend to carry the most weight:

The 2022 revision added controls such as threat intelligence, cloud services security, data masking and data leakage prevention, which fit healthcare’s cloud and data-sharing patterns. Our Annex A controls explainer goes through each theme.

How ISO 27001 relates to the HIPAA Security Rule

The two overlap heavily but differ in purpose. HIPAA is a legal requirement that protects electronic protected health information (ePHI). ISO 27001 is a management system standard that protects information of any kind and can be certified.

The overlap shows up most in risk. The Security Rule requires covered entities and business associates to conduct a thorough risk analysis, and HHS’s guidance on risk analysis describes it as an ongoing process. ISO 27001 likewise expects risk assessment to be repeated at planned intervals and when things change. A well-run ISMS can generate the documentation a HIPAA risk analysis needs, provided it explicitly covers every system that holds ePHI.

The gaps run both ways:

• ISO 27001 does not know HIPAA. It has no breach notification clock, no patient access rights and no business associate agreement requirement. You must add these to your legal and regulatory register.
• HIPAA does not require an ISMS. It does not demand internal audits, management review or a Statement of Applicability.
• Certification is not a safe harbor. HHS says it does not endorse private certifications, so an OCR investigation will look at your actual safeguards and risk analysis, not the certificate.

The Security Rule is also in motion. In December 2024 HHS’s Office for Civil Rights issued a notice of proposed rulemaking that would remove the distinction between “required” and “addressable” specifications, among other changes. A proposal is not a final rule, so check the HHS page for its current status before you plan around it. Either way, a documented, tested ISMS leaves you better placed than an informal program.

For a control-by-control comparison, see our guide to HIPAA vs. ISO 27001 for U.S. healthcare.

A practical note on channels: risk analysis should include the unglamorous ones. Many clinics still exchange records by fax, and this overview of fax privacy safeguards for healthcare is a reasonable prompt for checking whether those routes are in your asset inventory.

Scoping your ISMS and assessing gaps

Scope drives cost, timeline and the value of the certificate. Three patterns work for healthcare organizations:

• Product or service scope. Common for health tech vendors: the SaaS platform, its infrastructure and the teams that run it. Fastest to certify and directly answers customer questionnaires.
• Site or department scope. A lab, a revenue cycle center or a data center. Useful when one unit carries the contractual pressure.
• Enterprise scope. Right for organizations where a single ISMS replaces several overlapping programs, but it takes longest.

Once scope is set, run a gap assessment against the clauses and Annex A. Start from what you already have. Most healthcare organizations that have run a HIPAA program already own a risk analysis, policies, workforce training records, incident procedures and business associate agreements. These are real assets, not boilerplate to be replaced.

Tools can help structure the work, but they do not replace your judgment. NIST makes the same point about its own HIPAA Security Risk Assessment toolkit: it can support the process, but it is not a substitute for your responsibility to define and manage your own compliance status. The same applies to any readiness tool, ours included. A fast starting point is our free 2-minute readiness check, which flags where you stand before you commit to a full assessment.

From gap assessment to certificate: the main steps

The path is the same for a clinic group or a health tech startup. The ISMS is established and documented (scope, roles and responsibilities, risk management, internal audit, management review and applicable controls), then assessed in Stage 1 and Stage 2 certification audits. A working order:

1. Secure sponsorship. Get a named executive and a resource commitment in writing.
2. Define scope and context. Include the legal register: HIPAA, state privacy laws, contractual duties.
3. Run the gap assessment. Compare current practices to clauses 4 to 10 and Annex A.
4. Assess and treat risk. Use one method across the whole scope and record owners and decisions.
5. Write the Statement of Applicability and policies. Keep them short enough that staff can follow them.
6. Implement and train. Fix the gaps, then train clinical and administrative staff in their own roles.
7. Operate for a period. Collect records: access reviews, backup tests, incident logs, vendor reviews.
8. Run an internal audit and a management review. Both are mandatory before certification.
9. Choose a certification body. In the U.S., look for bodies accredited by ANAB. Our list of certification bodies in the USA helps you compare.
10. Pass Stage 1 and Stage 2. Stage 1 reviews documentation and readiness. Stage 2 tests whether the system works in practice.

After certification, expect surveillance audits in the following years and a recertification cycle. A longer walkthrough is in our 80-step certification checklist.

Documentation and audit evidence to prepare

Auditors sample. They will not read everything, but they will follow a thread from a risk to a control to a record. Prepare these:

Documented information the standard requires

• ISMS scope statement
• Information security policy
• Risk assessment method, risk register and risk treatment plan
• Statement of Applicability
• Security objectives and how you measure them
• Evidence of competence (training, qualifications)
• Internal audit program and reports
• Management review minutes
• Nonconformity and corrective action records

Records that prove controls are working

• Access reviews for the EHR and other ePHI systems, with dates and approvers
• Onboarding and offboarding tickets for clinical and non-clinical staff
• Backup restore tests, not just backup job logs
• Vulnerability scan and patch records, including medical devices where relevant
• Vendor assessments and signed agreements for suppliers that handle patient data
• Incident records, including near misses and tabletop exercises
• Security awareness training completion

A common stumbling block: records that exist but cannot be dated or tied to an owner. Build the habit of logging who did what and when from day one, because Stage 2 will ask for evidence from the period before the audit, not a scramble the week before.

Where healthcare implementations stall

• Treating it as an IT project. Clinical operations, HR, facilities and procurement all own controls. Without them the ISMS covers only servers.
• Scope creep or scope shrink. Starting enterprise-wide and never finishing, or scoping so narrowly that customers reject the certificate.
• Duplicate programs. Separate HIPAA and ISO risk registers drift apart. Keep one register with a column for each requirement.
• Paper controls. Policies that the clinical floor cannot follow, such as password rules that break shared workstation workflows, produce audit findings and real risk.
• Vendor blind spots. Business associates and cloud providers often hold the most data and receive the least review.

Leadership also sets the pace. The responsibility to integrate and resource the ISMS sits with top management, a theme also explored in this enterprise document security guide, which is useful for thinking about how approvals and audit trails support a controlled document process.

Time, staffing and budget

We cannot give you one honest number for “healthcare,” because the spread is wide. What we can say is what drives it:

• Organization size and headcount. Certification body audit effort grows with the number of people in scope.
• Number of sites and systems. Each added location, EHR instance or cloud environment adds testing.
• Starting maturity. An organization with a current HIPAA risk analysis, tested backups and a vendor program starts far ahead of one with none.
• In-house versus outside help. Consultants speed things up but shift cost from time to fees.
• Tooling. Evidence collection and monitoring tools reduce manual effort over the years you maintain the system.

Budget in four buckets: internal staff time, gap remediation (technology and process fixes), external support, and certification body fees including annual surveillance audits. Staff time is the one teams most often forget, and in a clinical setting it competes with patient care.

This is where an estimate built on your own inputs beats a rule of thumb. Our ISO 27001 cost calculator takes your size, industry and security maturity and returns editable estimates you can check against the published cost model methodology.

Our perspective

We build cost and effort estimates for ISO 27001 projects, so we see the same pattern in healthcare again and again: organizations decide whether to pursue the standard before they know what it will take. Then a customer asks for a certificate, a number gets invented, and the project starts with the wrong budget and a scope nobody agreed.

Our view is that the sequence should run the other way. First, decide whether a buyer, a partner or your own risk profile justifies a voluntary standard on top of HIPAA. Second, pick a scope you can defend in one sentence. Third, price the effort with assumptions you can see and change. We built the calculator with transparent, editable assumptions and a versioned methodology because a figure you cannot challenge is a figure you cannot defend to a CFO.

We also want to be clear about what a certificate cannot do. It will not make you HIPAA compliant in the eyes of HHS, and it will not cover systems outside your scope. It is a well-regarded management system, and for the right organization it is worth the work. For the wrong one, a disciplined HIPAA program is the better use of the same money.

— Martin

Get a realistic estimate before you commit

If you are weighing ISO 27001 for a hospital group, clinic network, health tech product or billing operation, start with numbers rather than a hunch. Our ISO 27001 readiness assessment scores your maturity across the four Annex A control themes, and the calculator turns that into cost, effort and timeline estimates you can save, compare and export as a PDF. You can run the initial calculation without signing up.

Want a first read in two minutes? The free readiness check shows where the biggest gaps are.

FAQ

Is ISO 27001 the same as HIPAA compliance?

No. HIPAA is a federal law with specific privacy, security and breach notification duties. ISO 27001 is a voluntary management system standard. HHS states it does not endorse private certifications as evidence of Security Rule compliance, so treat ISO 27001 as a complement to your HIPAA program, not a replacement.

Can a small clinic or health tech startup get certified?

Yes. The standard is designed to be adapted to an organization’s size, and you can limit scope to a single product or service. Smaller scopes shorten the audit and keep the work manageable. Many startups start with the product that customers’ security reviews focus on.

Do we have to implement every Annex A control?

No. You select the controls your risk assessment shows you need and record them in the Statement of Applicability, with a justification for each exclusion. Auditors will challenge exclusions that do not match your risks, so write them carefully.

How long does certification take?

It depends on starting maturity, scope and available staff. An organization with a current HIPAA risk analysis and working security processes moves faster than one starting from scratch. You also need a period of operating records before the Stage 2 audit, so a realistic plan allows for months, not weeks. Use the calculator to model your own timeline.

Does a certificate cover our whole organization?

Only what is inside the scope statement. A certificate for one product or business unit does not extend to the rest of the enterprise, so read and write scope statements with care.

Sources

• ISO/IEC 27001:2022, Information security management systems (ISO)
• ISO/IEC 27001:2022 standard text
• ISACA implementation guide for ISO/IEC 27001:2022
• HHS: Are we required to certify our organization’s compliance?
• HHS: Guidance on Risk Analysis
• HHS: HIPAA Security Rule NPRM fact sheet
• NIST HSR Toolkit User Guide
• ISO certifications: process and FAQs (Cherry Bekaert)
• Fax privacy laws: safeguards for healthcare
• Enterprise document security guide

Recommended

• HIPAA vs. ISO 27001 for U.S. Healthcare: Map Controls, Prepare for OCR
• ISO 27001 Certification: What Organizations Need to Know
• ISO 27001 Certification Checklist: 80 Steps to Certification
• How to Find Accredited ISO 27001 Certification Bodies in the USA