ISO 27001 vs HIPAA: which to pursue first and when to do both
If you are a covered entity or business associate handling electronic protected health information, start with the HIPAA Security Rule risk analysis. HIPAA is a legal duty enforced by HHS's Office for Civil Rights, and no certificate satisfies it: HHS does not endorse or recognize private certifications, and a third-party certification does not stop HHS from later finding a violation. ISO/IEC 27001:2022 is different in kind. It is a certifiable management system standard, and an accredited certification body can issue a certificate against it. That certificate is useful evidence for customers and procurement teams, but it does not substitute for HIPAA compliance. Treat the ISO certificate as a commercial credential, not a legal finding.
The risk analysis under 45 CFR 164.308(a)(1)(ii)(A) is a required implementation specification and does not prescribe a method. Your first deliverable is an accurate and thorough assessment of risks to the confidentiality, integrity and availability of ePHI across systems, vendors and locations. The ISO 27001 risk assessment in clause 6.1.2 and risk treatment in clause 6.1.3 are structured differently, and they run against an organization-wide scope that ISO requires to cover all of clauses 4 to 10. Many teams can reuse the same asset inventory and risk register for both, but the HIPAA analysis must name ePHI flows explicitly. Confirm with your counsel and privacy officer which HIPAA documentation duties apply to your entity before you decide on scope.
Consider ISO 27001 first when the pressure is commercial rather than regulatory: a customer or payer contract requires an ISO certificate, procurement scores certificates, or your operations span countries where an ISO certificate is the expected evidence. In that case, scope the ISMS to the services that carry ePHI, and run the HIPAA risk analysis in parallel so the certificate does not become the only documented assessment. Doing both is reasonable when the HIPAA work already exists and the certificate adds a recognized external audit. Ask any certification body to confirm how it will treat HIPAA evidence, and ask your HIPAA advisers which Security Rule gaps the ISMS scope will leave open.
How ISO 27001 and HIPAA differ on scope, structure and proof
This table compares who each framework applies to, how each structures its requirements, and what proof each produces. Read it as a map of obligations and evidence, then check each row against your own legal counsel's reading of HIPAA and your certification body's scope rules for ISO 27001.
| Dimension | ISO/IEC 27001:2022 | HIPAA Security Rule |
|---|---|---|
| Who it applies to | Any organization that chooses to build and certify an ISMS, with scope set by organization, location or service | Covered entities (health plans, clearinghouses, covered providers) and business associates handling electronic protected health information |
| Legal status | Voluntary international standard; certification is issued by accredited certification bodies, not by ISO | US federal law (45 CFR Part 164 Subpart C), enforced by HHS OCR, with no certificate scheme |
| Risk analysis versus risk assessment | Risk assessment in clause 6.1.2 and risk treatment in clause 6.1.3, carried out in operation under clauses 8.2 and 8.3 | Risk analysis is a required implementation specification; OCR does not prescribe a method, so confirm the approach with counsel |
| Structure of requirements | Clauses 4 to 10 are mandatory for a conformity claim; scope can be narrowed but clauses cannot be dropped | 18 standards with 36 implementation specifications: 14 required and 22 addressable, plus organizational and documentation standards |
| Controls catalogue | 93 Annex A controls in four themes: organizational (37), people (8), physical (14) and technological (34) | No fixed control list; entities select measures that are reasonable and appropriate, and document addressable decisions |
| Documentation retention | Records retained as the management system requires; confirm retention periods against your certification body's guidance | Documentation kept for 6 years (45 CFR 164.316(b)(2)(i)), an ongoing storage and maintenance obligation |
| Control set change | 2013 edition had 114 controls in 14 clauses; the 2022 edition moved to 93 controls in 4 clauses, with 11 new, 24 merged and 58 updated | Security Rule text has not changed since 2013 amendments; HHS proposed a major revision on 6 January 2025 that is not yet final |
| Proof produced | An accredited third-party certificate, subject to surveillance and recertification audits on a three-year cycle | No certificate exists; HHS does not recognize private certifications, and OCR audits and investigations supply the scrutiny |
| Penalty exposure | No regulator penalty for the standard itself; certification can be withdrawn by the certification body | Civil money penalties per violation, with an inflation-adjusted range for penalties assessed on or after 28 January 2026 (45 CFR 102.3) |
What an ISO 27001 certificate does and does not prove to HHS
ISO does not certify organizations. An ISO/IEC 27001 certificate is issued by an accredited certification body after it audits your information security management system, and those bodies work to ISO/IEC 17021-1:2015 plus ISO/IEC 27006-1:2024. For a healthcare organization or business associate, the certificate proves that an independent auditor checked a management system against the standard's requirements at the scope stated on the certificate. It does not prove that the Security Rule standards in 45 CFR 164.308, 164.310, 164.312, 164.314 and 164.316 have been met, and HHS does not treat it as such. Before you rely on any certificate in a HIPAA conversation, confirm the certification body's accreditation, the scope statement and the certificate's validity date using the ISO certification page, which points to the IAF CertSearch database.
HHS's position is direct. HHS does not endorse or recognize private organizations' certifications for the Security Rule, and a third-party certification does not stop HHS from later finding a violation. OCR enforces the rule through complaint investigations, compliance reviews and audits. Its 2024 to 2025 HIPAA audits reviewed 50 covered entities' and business associates' compliance with the provisions most relevant to hacking and ransomware. In an audit or investigation, the evidence OCR examines is your own: your documented risk analysis, risk management plan, policies, workforce training records, access logs and the results of the activities those documents describe. A certificate can help you produce that evidence faster, but the auditor will still ask what your organization did with ePHI, and an ISO scope that excludes the systems holding ePHI will not answer that question.
Use the certificate as supporting evidence, not as the program. Map your ISMS controls to the Security Rule standards so that an ISO audit result can be cited for the matching activities, such as access control, audit logging or incident response. Keep the Security Rule documentation separately, including the six-year retention requirement in 45 CFR 164.316(b)(2)(i), because a certificate does not carry those records for you. Ask any certification body whether its audit reports can be shared with a customer or regulator, and whether your ISMS scope covers the ePHI environment rather than only a corporate office. The NIST SP 800-66 Rev. 2 resource guide offers sample questions for each standard that can serve as the bridge between the two.
How the HIPAA risk analysis compares with the ISO risk assessment
A covered entity must perform a risk analysis as a required implementation specification under 45 CFR 164.308(a)(1)(ii)(A). The rule asks for an accurate and thorough assessment of risks and vulnerabilities to the confidentiality, integrity and availability of ePHI. OCR's guidance on risk analysis says the rule does not prescribe a methodology and that no single method guarantees compliance, so the entity chooses an approach that fits its size, complexity and capabilities. ISO/IEC 27001:2022 takes a different shape: clauses 6.1.2 and 6.1.3 define the risk assessment and risk treatment, and clauses 8.2 and 8.3 require them to run in operation. The organization sets the scope and selects controls from Annex A.
- Required versus scoped: The HIPAA analysis covers all ePHI the entity holds. An ISO scope can be narrowed by organization, location or service, but clauses 4 to 10 must all apply to any conformity claim.
- Addressable specifications: Under 45 CFR 164.306(d), an addressable specification requires a documented decision on whether it is reasonable and appropriate, and an equivalent alternative if it is not.
- Documentation retention: Security Rule documentation must be kept for 6 years under 45 CFR 164.316(b)(2)(i).
- No certificate for the analysis: HHS does not recognize a private certification as proof of the risk analysis, so OCR will look at the analysis itself.
Before relying on one analysis for both, confirm with counsel and your OCR-facing team whether a single risk register can carry the HIPAA record and the ISO evidence.
A business associate must comply with the Security Rule for the ePHI it creates, receives, maintains or transmits for a covered entity. The risk analysis obligation applies to the business associate directly, so an ISO certificate held by the associate does not replace its own analysis. The associate's contracts will usually ask how it manages risk, and the ISO risk assessment and treatment process is a common way to show that management in operation. The practical gap is that an ISO scope may not match the ePHI systems a covered entity cares about.
- Scope alignment: Define the ISMS scope to include the services and systems that touch the covered entity's ePHI, and confirm that the scope is not narrowed to exclude them.
- Method traceability: Map each ISO risk criterion to the HIPAA threats and vulnerabilities for ePHI, so one assessment can answer both questions.
- Documented reasoning: Record the decision on each addressable specification under 45 CFR 164.306(d), since ISO documentation alone does not show that reasoning.
- Certification body checks: Accredited certification bodies work to ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024, but they do not assess HIPAA compliance.
Ask the covered entity which evidence it will accept, whether it expects the HIPAA-specific analysis or will accept an ISO risk assessment mapped to it.
A software or service vendor selling into healthcare is usually a business associate, so it must perform its own Security Rule risk analysis for any ePHI it handles. Buyers often ask for an ISO/IEC 27001 certificate as shorthand for mature security management, which can lead vendors to treat the certificate as a substitute for the analysis. Because OCR does not prescribe a method, the vendor can choose a risk approach that also satisfies the ISO clauses, but it must still produce the HIPAA record.
- Two outputs, one process: Run one risk assessment that produces a HIPAA analysis record and the ISO risk assessment and treatment records.
- Clear claims: State that the ISO certificate covers the ISMS in its defined scope, and do not present it as HIPAA compliance or as HHS recognition.
- Product boundaries: Decide which products and hosted environments fall inside the ISMS scope, since a narrower scope will invite questions from healthcare customers.
- Ongoing review: Keep the risk assessment current in operation, because a one-time analysis will not show the continuous process ISO requires under clauses 8.2 and 8.3.
Confirm with the customer whether it wants the risk analysis documentation directly, and whether the vendor's scope covers the services it will use.
Where ISO 27001 and HIPAA controls overlap
ISO/IEC 27001:2022 and the HIPAA Security Rule both expect documented risk decisions, controlled access and managed third parties, so much of the day-to-day work can serve both. The overlap is established through published mappings, which are starting points for your own control review rather than proof that one satisfies the other.
Access control and identity
Both frameworks expect access to information to be granted on need, reviewed and removed when roles change. HIPAA frames this through access control and authentication standards for ePHI, while ISO/IEC 27001:2022 covers it through its organizational and technological controls for access and authentication. Check whether your identity records, role definitions and review evidence cover the ePHI systems in HIPAA scope as well as the ISMS scope, since the two scopes often differ.
Risk assessment and treatment
The HIPAA risk analysis and the ISO risk assessment ask similar questions, but HIPAA requires an accurate and thorough assessment of risks to ePHI, and OCR does not prescribe a method. ISO/IEC 27001:2022 sets risk assessment in clause 6.1.2 and risk treatment in clause 6.1.3, carried out in operation under clauses 8.2 and 8.3. Confirm that one register can record ePHI risks and ISMS risks without losing HIPAA-specific threat and vulnerability detail.
Policies, documentation and retention
Both frameworks rely on written policies, procedures and records that show what was decided and why. The Security Rule requires documentation to be kept for 6 years, while ISO/IEC 27001:2022 requires documented information the organization determines as necessary for the ISMS. Ask whether your document control process applies a single retention rule and whether HIPAA-required documentation is tagged so it is not purged under an ISMS review cycle.
Incident handling and response
Both frameworks expect incidents affecting information or ePHI to be detected, assessed, responded to and learned from. HIPAA requires security incident procedures and response and reporting, and ISO/IEC 27001:2022 covers incident management in its organizational controls. Treat the HIPAA breach notification process as a separate legal workflow that the ISMS incident process feeds, and confirm who decides when an event is a reportable breach.
Vendor and business associate management
Covered entities must obtain satisfactory assurances from business associates, and ISO/IEC 27001:2022 expects supplier relationships to be controlled through its supplier-related controls. Mappings between the two show overlap in contract terms, due diligence and monitoring. Confirm that your business associate agreements and supplier risk reviews both reach the cloud and hosting providers that store or process ePHI.
Workforce security and training
Both frameworks expect people with system access to be screened, trained and removed from access promptly on departure. HIPAA sets workforce security and security awareness and training standards, and ISO/IEC 27001:2022 covers people controls such as screening, terms of employment and awareness. Check whether HIPAA training records and ISMS awareness records are kept in one system with dates, so you can show each framework's requirements from the same evidence.
Who assesses each framework and what is issued
This table compares who examines each framework, what the examination produces and how long the result stays valid. Read it to see whether a HIPAA obligation or an ISO 27001 certificate is the proof your customers, regulators or auditors will ask for, and where each one stops.
| Item | HIPAA Security Rule | ISO/IEC 27001:2022 |
|---|---|---|
| Who assesses | HHS Office for Civil Rights investigates complaints, runs compliance reviews and audits, and enforces the rule | Accredited ISMS certification bodies audit the organization; ISO itself does not certify organizations |
| Output issued | No certificate exists; HHS does not endorse or recognize private certifications | An accredited certificate for the defined ISMS scope, checkable through the IAF CertSearch database |
| Validity and cycle | No certification cycle; obligations apply continuously and OCR can act at any time | Three-year certification cycle with at least one audit, surveillance or recertification, in every calendar year |
| Effect of third-party certification | Does not prevent HHS from later finding a security violation | Gives customers accredited evidence of the ISMS, but is not a legal finding of HIPAA compliance |
| Penalty exposure | Civil money penalties under 45 CFR 102.3; for penalties from 28 January 2026, up to $2,190,294 per violation and a calendar-year cap of $2,190,294 | No regulator penalty tied to the certificate; loss or suspension follows certification body decisions |
| Standard transitions | Proposed Security Rule revision (90 FR 898) not yet final; confirm the current status before planning | ISO/IEC 27001:2013 certificates expired or were withdrawn by 31 October 2025; ISO/IEC 27006-1:2024 applies to all clients from 31 March 2026 |
| What DeployOpen provides | Prepares risk analysis, policies and evidence for OCR; does not issue audit reports or certificates | Prepares ISMS evidence and readiness; does not issue certificates, which only accredited bodies can grant |
Sequencing both frameworks without duplicating evidence
This sequence builds one evidence base from the HIPAA risk analysis and Security Rule documentation, then maps it to ISO/IEC 27001:2022 so each control is evidenced once and reused. The result is a defensible HIPAA program now and an ISMS that a certification body can assess later, if customers require it.
Define the ePHI environment and business associates
The compliance lead and system owners identify every system that creates, receives, maintains or transmits electronic protected health information, including cloud services, backups, endpoints and the business associates that touch that data. The output is a written inventory with data flows and a boundary statement. This boundary becomes the common scope for the HIPAA program and the ISMS. Covered entities and business associates must both comply with the Security Rule for ePHI (45 CFR 164.302), so the inventory should show which parties are inside your control and which are reached through contracts. It is done when the system owner signs off that nothing holding ePHI sits outside the boundary without a documented reason. Ask your ISO certification body early whether it accepts a scope narrowed by service or location, since clause 1 of ISO/IEC 27001:2022 does not allow dropping required clauses.
Complete the HIPAA risk analysis and risk management
The security officer and risk owners complete the required risk analysis, an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI (45 CFR 164.308(a)(1)(ii)(A)). OCR's guidance says the rule does not prescribe a methodology, so you choose one that fits your size and complexity and record why. Then select and document risk management measures. Write the results in a register that records each risk, its likelihood and impact rating, the chosen treatment and the owner. This step is done when leadership has reviewed and accepted the residual risks in writing. The same register can later serve as the input to the ISO 27001 risk assessment under clause 8.2 and the risk treatment under clause 8.3, so you avoid running two parallel risk exercises.
Map existing Security Rule evidence to Annex A
The compliance lead builds a crosswalk that links each Security Rule standard and implementation specification to the ISO/IEC 27001:2022 Annex A controls that address it. Use the supplied mappings as a starting point, such as the CIS Controls Navigator and the NIST CSF 2.0 informative references, but treat them as references, not proof of equivalence. ENISA states its own mapping is not a measure of equivalence, and NIST does not check the correctness of non-NIST mappings. Annex A has 93 controls in four themes, so the crosswalk will show gaps where HIPAA addressable specifications have no matching ISO control and the reverse. Mark each row as covered, partly covered or missing, and name the evidence item behind it. It is done when every Annex A control has a status and one or more evidence references.
Close gaps in policies, controls and records
Control owners fix the gaps the crosswalk exposed. Typical work includes writing policies that meet the documentation standards in 45 CFR 164.316, documenting the reasoning for any addressable specification you did not implement, and adding ISO-specific items such as the statement of applicability and the required ISMS processes. Each fix should write its evidence to the shared store, not to a side folder. Keep in mind that Security Rule documentation must be retained for six years (45 CFR 164.316(b)(2)(i)), so the shared store needs versioning, access control and a retention rule from the start. This step closes when the crosswalk shows no open gaps or each open gap has a dated, owned remediation record approved by management.
Run the internal audit and management review
Someone independent of the control owners performs an internal audit of the ISMS against ISO/IEC 27001:2022, and management holds a review of the ISMS results, risks and objectives. The same audit sample can test HIPAA safeguards, such as access reviews, audit logs and workforce training records, so the work is not repeated. Findings go into a single corrective action log. This step is done when the audit report and management review minutes are filed in the shared store and every nonconformity has an approved corrective action. Not a legal sign-off: an internal audit is your own evidence, and it does not replace OCR's authority or a certifier's decision.
Test the HIPAA program against the pending rule
The privacy and security leads review the HHS proposed Security Rule revision published on January 6, 2025 (90 FR 898, RIN 0945-AA22). Comments closed March 7, 2025, and as of October 2026 no final rule has been published. The latest Unified Agenda lists the rulemaking under Long-Term Actions with final action projected for July 2027. Record which proposed changes would affect your current controls, such as encryption or asset inventories, and add them to the risk register as a watch item rather than a requirement. Confirm the current status with HHS or your counsel before you plan changes. The step is done when the watch item has an owner and a review date set by the organization.
Engage an accredited certification body if required
Only pursue ISO/IEC 27001 certification if customers, partners or contracts require it. ISO does not certify organizations; accredited certification bodies do, and they must apply ISO/IEC 27006-1:2024 to all clients from 31 March 2026 under IAF MD 29:2024. Ask candidate bodies for their accreditation scope and check certificates through the IAF CertSearch database that ISO references. The certification cycle is three years with at least one audit each calendar year under ISO/IEC 17021-1, so budget for recurring surveillance work. Certification does not make the organization HIPAA compliant and does not stop OCR from finding a violation. The step is done when the certification body has accepted the scope in writing and the stage 1 audit plan is agreed.
What drives the cost and effort of each path
Cost in both paths falls mainly on internal staff time, and most of it is spent before any external party is involved. For ISO/IEC 27001, the payments you will see on invoices are a certification body audit fee, which is paid to an accredited body that operates to ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024, and any consultant or implementation partner fees you choose to add. For HIPAA, there is no certification body to pay, so the external spend is usually counsel, a security assessor or an implementation partner, plus tooling. Your own engineers, compliance staff and business owners carry the risk analysis, the policy work and the evidence collection under either path. Ask each certification body and each partner for a line-item quote that separates these components, so you can see which costs are optional. One-time work includes defining scope, the first risk assessment and risk treatment, closing gaps against the Annex A controls or the Security Rule standards, and, for ISO, the first certification audit. Recurring work is different. An ISO certificate runs on a three-year cycle with at least one audit in every calendar year, so surveillance audits and documentation upkeep continue for as long as you hold it. HIPAA has no certificate cycle, but the Security Rule requires documentation to be kept for 6 years (45 CFR 164.316(b)(2)(i)), and risk analysis and evidence must be ready for any OCR complaint investigation, compliance review or audit. Budget both as continuing costs, not as project costs. The main drivers are the number of sites, the number of systems that hold or transmit ePHI, the number of business associates whose services you rely on, and where you draw the scope boundary. ISO scope can be narrowed by organization, location or service, but it cannot drop clauses, so a narrow scope lowers audit effort without lowering the work per clause. HIPAA applies to all ePHI wherever it sits, so a narrow scope is a risk decision rather than a certification choice. In a quote, request the audit day count and sampling basis, the number of sites in scope, the list of ePHI systems and business associates assumed, the surveillance audit schedule, and which deliverables are included. Figures should come only from written quotes that match your agreed scope.
Questions healthcare teams ask before comparing ISO 27001 and HIPAA
Does ISO 27001 make us HIPAA compliant?
No. An ISO/IEC 27001 certificate does not make an organization HIPAA compliant, and it does not satisfy the Security Rule on its own. HHS states that it does not endorse or recognize private organizations' certifications for the Security Rule, and that a certification does not prevent HHS from later finding a violation. ISO 27001 certifies an information security management system against its own requirements. Its Annex A controls overlap with many Security Rule topics, so much of the work carries over. The gaps sit in HIPAA-specific obligations, such as the required risk analysis of ePHI, the documentation rules in 45 CFR 164.316, and the documented decisions for addressable specifications under 164.306(d). Ask your certification body and counsel to map the certificate's scope against each standard before you claim coverage. HHS FAQ 2003
Can we do HIPAA compliance without outside help?
Possibly, because the Security Rule does not issue a certificate or prescribe a fixed method. The rule is technology neutral and scalable, so your organization chooses the measures that let it reasonably and appropriately implement each standard. OCR's guidance says no single risk analysis method or best practice guarantees compliance. Staff with security, privacy and operations knowledge can work from *NIST SP 800-66 Rev. 2*, which HHS lists as informational rather than legally binding and which gives sample questions for every standard. Outside help tends to matter most where independent judgment is needed: an accurate and thorough risk analysis, the documented rationale for addressable specifications, and testing that controls work as described. DeployOpen prepares systems, controls and evidence for compliance assessments but does not issue audit reports or attestations. Scope, deliverables and timing are agreed in writing before work starts.
How long does each take and what does it need from our staff?
The sources do not give a duration that fits your environment, so ask for a written timeline based on your defined scope. For ISO 27001, the certification cycle under ISO/IEC 17021-1 lasts three years, with at least one audit, either surveillance or recertification, in every calendar year. The ongoing demand is therefore recurring: internal audits, management review, surveillance visits and corrective actions. HIPAA has no certification cycle, but the Security Rule requires documentation to be kept for 6 years, and the risk analysis and policies must stay current as systems change. Staff demand differs. ISO asks for a management system owner, process owners for each control area, and people who can produce evidence on request. HIPAA asks for privacy and security leads, IT and clinical operations input to the risk analysis, and documented decisions for each addressable specification. Shared evidence, such as access reviews, incident logs and backup records, can reduce duplicate effort.
Does a vendor need ISO 27001 to sell to covered entities?
Not under HIPAA. The Security Rule applies to covered entities and business associates for electronic protected health information (45 CFR 164.302), so a vendor that handles ePHI must comply with the rule and accept the business associate terms its customers require. HIPAA does not name ISO 27001 or any other certificate as a requirement. A buyer may still ask for ISO 27001 because the standard is internationally recognized and certificates come from accredited certification bodies. Procurement questionnaires often ask for it. Before investing, ask each customer whether a certificate is a contract requirement, which scope it must cover, and whether another assessment, such as a SOC 2 report or a HITRUST assessment, would meet the need. Accredited certificates can be checked in the IAF CertSearch database, which ISO continues to reference.
Who pays for certification audits?
The organization seeking certification pays the accredited certification body under its contract. The certification body sets the audit fee, so ask for a written quote tied to your scope, sites and audit days. Initial certification is a one-time cost, but the three-year cycle brings recurring surveillance and recertification audits. HIPAA has no certification audit to pay for. Its costs are internal staff time, any tools, any outside advisors you retain, and the cost of responding to OCR complaint investigations, compliance reviews and audits. The exposure is real: for penalties assessed on or after January 28, 2026, the inflation-adjusted HIPAA civil money penalty runs from $145 to $2,190,294 per violation, with a calendar-year cap of $2,190,294 (45 CFR 102.3). DeployOpen's fees follow from a written scope, and the company does not publish a price list.
What is the HHS proposed rule and does it change the plan?
HHS proposed a major Security Rule revision on January 6, 2025 (90 FR 898, RIN 0945-AA22), with comments due March 7, 2025. As of October 2026, no final rule has been published, and the latest Unified Agenda lists the rule under Long-Term Actions with final action projected for July 2027. Until a final rule takes effect, the current text in 45 CFR Part 164 Subpart C is what you must meet, so build the plan on it. The proposal's direction matters for planning because it focuses on the cybersecurity of ePHI, but a proposal is not a requirement and the final text may differ. Plan for flexibility: keep the risk analysis and documentation current, record decisions on addressable specifications, and review the final rule with counsel when it is published. Separately, the 2024 ISO amendment added climate-related wording to clauses 4.1 and 4.2, so check how it affects your ISMS scope with your certification body.
How does the ISO risk assessment differ from the HIPAA risk analysis?
Both require a documented assessment of risk, but HIPAA sets the subject matter while ISO sets the management system around the assessment. The Security Rule requires an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI (45 CFR 164.308(a)(1)(ii)(A)), and OCR notes that the rule does not prescribe a methodology. ISO/IEC 27001:2022 places risk assessment in clause 6.1.2 and risk treatment in clause 6.1.3, then requires both to be carried out in operation under clauses 8.2 and 8.3. Its criteria, owners and review cycles must be defined within the ISMS. You cannot exclude clauses 4 to 10 from a conformity claim, although scope can be narrowed by organization, location or service. In practice, one risk register can serve both if it names ePHI assets, threats, likelihood, impact and treatment decisions. Confirm with your certification body whether the ISMS scope includes the systems that hold ePHI.
How DeployOpen prepares HIPAA and ISO 27001 readiness
DeployOpen works on ISO 27001 vs HIPAA as an implementation and readiness partner, inside your own infrastructure. We scope the work in writing, build the controls and evidence, and hand over documentation your team and your assessors can review.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- The written scope names which systems hold ePHI and which ISMS boundary your organization wants to define.
- We confirm with you which certification body or HHS-facing evidence your organization needs before work begins.
How we build
- We map HIPAA Security Rule safeguards and ISO/IEC 27001:2022 Annex A controls to the same system components.
- We help run the risk analysis and risk treatment work, documenting the method you choose and why.
- We implement, customize and harden the self-hosted platforms in your own cloud accounts, data centers or air-gapped networks.
How we hand over
- You receive written documentation of policies, procedures, risk records and technical configurations for your review.
- Evidence packages are organized so that your internal reviewers and external auditors can trace each control to its record.
- We document the retention and maintenance routines your team must run after handover, including the six-year HIPAA documentation period.
How we support
- Ongoing support, upgrades and continuous security testing are available as retainers after the initial engagement.
- Retainers can cover periodic risk analysis updates and control reviews as your systems and ISMS scope change.
- Your team should confirm with the certification body or HHS guidance which evidence it expects before each review.
Sources and further reading
- HHS FAQ 2003: Are we required to certify our organization's compliance with the standards? ↗
- HHS OCR Guidance on Risk Analysis ↗
- 45 CFR Part 164 Subpart C, Security Standards for the Protection of Electronic Protected Health Information ↗
- ISO/IEC 27001:2022 (ISO) ↗
- ISO: Certification ↗
- IAF MD 29:2024 Transition requirements for ISO/IEC 27006-1:2024 ↗
