ISO 27799 is the extension of ISO 27001 to the health field — it defines how medical institutions and health systems manage sensitive medical information. Required by regulators and international clients in the Health Tech field. CBE has been guiding organizations for 30 years — with 100% success.
CBE specializes in guiding and certifying organizations for the ISO 27799 standard, tailoring the management system to the organization's needs.
Quick facts – ISO 27799
Goal
Protecting medical information to the international standard
Who needs it
Medical institutions and Digital Health companies
Importance in Israel
Required for international Health Tech
Complements
ISO 27001, HIPAA, ISO 13485
CBE – success rate
100% – hundreds of certified clients
ISO 27799 is the international standard for health information security management (Health Informatics). It extends ISO 27001 with requirements specific to the health sector: clinical information, patient records, connected devices and more.
The standard covers the entire medical information chain — from patient registration to the digital medical record — and defines security controls unique to medical environments with critical availability requirements.
CBE doesn't just guide you to ISO 27799 — we build a health GRC framework that combines ISO 27799, ISO 13485, HIPAA and Amendment 13, because the global health market requires all of them.
Encryption, access control and documentation of patient records.
IoMT — securing connected devices and medical networks.
Medical information must always be available — BCP is critical.
Compliance with HIPAA, GDPR and Amendment 13 alongside ISO 27799.
Clinical information, EHR and patient files — ISO 27799 defines unique protections.
To sector pageTelemedicine platforms and Health SaaS targeting the international market.
To sector pageLabs processing patient data and interfacing with EHR systems.
Medical information for insurance purposes — ISO 27799 + HIPAA.
To sector pageConnected devices (IoMT) require unique information security.
To sector pageMinistry of Health, HMOs and public institutions.
Compliance with HIPAA, GDPR and Israeli regulation
PHI is the most sensitive data — maximum protection
International health clients expect ISO 27799
Medical information must be available — unique BCP and DRP
Defining the organization's needs, stakeholders and the scope of the quality management system.
Process planning and control, managing customer requirements, external providers and output control.
Management commitment, quality policy and defining roles and responsibilities.
Measurement, analysis, internal audit and management review.
Risk and opportunity management, quality objectives and plans to achieve them.
Managing non-conformities, corrective actions and continuous improvement of the system.
Resources, employee competence, internal communication and documentation.
CBE performs a full Gap Analysis and builds a work plan tailored to your organization.
Full health GRC — a complete medical information security framework
CBE accompanies you at every stage — from mapping medical information to ongoing compliance
Mapping medical information and gap analysis against ISO 27799
Procedures, policy and controls unique to a medical environment
Applying controls, training medical and administrative staff
Reviewing compliance with all ISO 27799 requirements
Regulatory and HIPAA/GDPR updates
30 years, hundreds of clients, 100% success — here's what sets us apart
Committed to success! No client has ever failed a certification audit. Not certified — you don't pay!
We adapt the schedule to your deadline — tender, supplier, client.
CBE's skilled human team writes your procedures and documentation tailored to your organization.
ISO 27799 is the medical foundation. CBE also guides you to ISO 27001, HIPAA, ISO 13485 and more.
We don't disappear after the certificate. Annual audits, standard updates, organizational changes.
From startup to corporation — experience with every organization type in every field.
ISO 27799 covers medical information security — the full medical GRC also requires additional standards.
About CBE's GRC frameworkCBE specializes in guiding and certifying organizations for the ISO 27799 standard. The service is provided by CBE's experts, with 30 years of experience in ISO standards, over 4,000 satisfied clients and 100% success in audits.
Tell us about your medical system and what's driving you — we'll come back with a medical ISMS plan