What it covers. An international standard giving guidance on applying the ISO/IEC 27002 controls in healthcare. It addresses the security of personal health information, with specific attention to confidentiality, integrity and availability needs in health settings. It is used in many European health systems as a sector reference for information security.
In practice. Healthcare organisations use it to interpret general security controls for clinical environments, such as access to patient records, emergency access, audit trails, medical devices and information sharing between care providers. It is typically applied within an ISMS based on ISO/IEC 27001. Evidence includes risk assessments covering clinical systems and controls adapted to health information.
Common gaps. Typical gaps are emergency access procedures that bypass logging, shared clinical workstations and medical devices outside security management.