[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso\u002F27799":3},{"item":4,"lessons":16,"controls":58,"related":88},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso","27799","ISO\u002FIEC 27799","ISO 27799: Health informatics: Information security management in health using ISO\u002FIEC 27002",10,"International Organization for Standardization (ISO) and IEC","**What it covers.** An international standard giving guidance on applying the ISO\u002FIEC 27002 controls in healthcare. It addresses the security of personal health information, with specific attention to confidentiality, integrity and availability needs in health settings. It is used in many European health systems as a sector reference for information security.\n\n**In practice.** Healthcare organisations use it to interpret general security controls for clinical environments, such as access to patient records, emergency access, audit trails, medical devices and information sharing between care providers. It is typically applied within an ISMS based on ISO\u002FIEC 27001. Evidence includes risk assessments covering clinical systems and controls adapted to health information.\n\n**Common gaps.** Typical gaps are emergency access procedures that bypass logging, shared clinical workstations and medical devices outside security management.",null,"https:\u002F\u002Fwww.iso.org\u002Fisoiec-27001-information-security.html","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54],{"slug":19,"title":20,"published_at":21},"spains-aepd-blanket-refusal-to-disclose-health-data-access-logs-violates-gdpr-article-15","Spain's AEPD: Blanket Refusal to Disclose Health Data Access Logs Violates GDPR Article 15","2026-09-15T16:22:14.189+00:00",{"slug":23,"title":24,"published_at":25},"healthcare-data-breach-exposes-25k-patient-records","Healthcare Data Breach Exposes 25K+ Patient Records","2026-06-09T16:21:11.919+00:00",{"slug":27,"title":28,"published_at":29},"hospital-patient-records-exposed-by-threat-actor-black0utexi","Hospital Patient Records Exposed by Threat Actor Black0ut_Exi","2026-06-07T02:20:16.911+00:00",{"slug":31,"title":32,"published_at":33},"34m-french-medical-records-allegedly-compromised-in-dmp-database-breach","34M French Medical Records Allegedly Compromised in DMP Database Breach","2026-06-01T23:06:05.981+00:00",{"slug":35,"title":36,"published_at":37},"major-healthcare-data-breach-exposes-458k-patient-records-1780071625359","Major Healthcare Data Breach Exposes 458K Patient Records","2026-05-29T16:20:25.095+00:00",{"slug":39,"title":40,"published_at":41},"healthcare-data-controller-fined-5m-for-systematic-gdpr-violations","Healthcare Data Controller Fined €5M for Systematic GDPR Violations","2026-05-29T12:20:13.375+00:00",{"slug":43,"title":44,"published_at":45},"venezuelas-farmapatria-pharmacy-network-breached-3m-health-records-exposed","Venezuela's Farmapatria Pharmacy Network Breached, 3M Health Records Exposed","2026-04-21T00:09:07.328+00:00",{"slug":47,"title":48,"published_at":49},"iraqi-hospital-database-breach-exposes-32-million-patient-records","Iraqi Hospital Database Breach Exposes 32 Million Patient Records","2026-04-19T22:08:23.792+00:00",{"slug":51,"title":52,"published_at":53},"healthcare-authority-data-breach-exposes-critical-patient-records","Healthcare Authority Data Breach Exposes Critical Patient Records","2026-04-19T22:08:14.939+00:00",{"slug":55,"title":56,"published_at":57},"hong-kong-hospital-authority-suffers-healthcare-data-breach","Hong Kong Hospital Authority Suffers Healthcare Data Breach","2026-04-02T20:08:30.019+00:00",[59,64,69,74,79,84],{"slug":60,"name":61,"problem":62,"stories":63},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",6,{"slug":65,"name":66,"problem":67,"stories":68},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",5,{"slug":70,"name":71,"problem":72,"stories":73},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",4,{"slug":75,"name":76,"problem":77,"stories":78},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",2,{"slug":80,"name":81,"problem":82,"stories":83},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",1,{"slug":85,"name":86,"problem":87,"stories":83},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[89,95,100,105,110,114,120,124],{"family":90,"item":91,"code":92,"title":93,"together":94},"cis","3","Control 3","Data Protection",9,{"family":90,"item":96,"code":97,"title":98,"together":99},"6","Control 6","Access Control Management",7,{"family":101,"item":102,"code":103,"title":104,"together":63},"hipaa","security-rule","Security Rule","HIPAA Security Rule",{"family":106,"item":107,"code":108,"title":109,"together":63},"nist-sp","800-66","SP 800-66","SP 800-66 Rev. 2: Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide",{"family":90,"item":111,"code":112,"title":113,"together":68},"13","Control 13","Network Monitoring and Defense",{"family":115,"item":116,"code":117,"title":118,"together":119},"gdpr","32","Article 32","Security of processing",3,{"family":90,"item":121,"code":122,"title":123,"together":119},"8","Control 8","Audit Log Management",{"family":125,"item":126,"code":127,"title":128,"together":119},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework"]