ISO 27001 for Australian health tech

Why health buyers run the hardest security reviews

Health data sits in the highest-sensitivity class of personal information under Australian privacy law, and the organisations buying health tech — hospitals, primary health networks, insurers — carry health-sector obligations of their own. When they onboard you, your risk becomes their risk. Their review is built accordingly.

Expect it to go past the standard questionnaire. Health buyers ask for the map, not the policy: where patient data enters your system, every place it’s stored, who can see it under which role, which subcontractors touch it, how long it’s kept and how it’s destroyed. Procurement often routes the same answers through privacy and clinical stakeholders as well as IT security, so three reviewers read your evidence with three different concerns.

And the review recurs. Health contracts commonly carry ongoing assurance clauses — periodic re-review, notification duties, audit rights — so the evidence has to stay current, not just exist once at onboarding. Fintechs get the same dynamic from their regulated customers (ISO 27001 for Australian fintechs covers it); in health it arrives with a privacy officer attached.

Scoping ISO 27001 around health data, not around the company

ISO 27001 suits this buyer precisely because it certifies the management system that produces those answers. The health-specific work is in the scoping.

• The scope statement. Define it around the health data flows, and expect buyers to read that line first. A certificate scoped to exclude the product that handles patient data is worse than no certificate — it reads as an evasion.
• Classification. Health data as your highest classification tier drives everything downstream: access decisions, encryption, retention, what gets logged and for how long.
• Access control and logging. “Who looked at this record, and when” is a question health buyers ask in those words. Least-privilege roles plus event logging that can answer it are the controls their reviewers sample first.
• Suppliers. Every subprocessor that touches health data belongs in your supplier assessments, because each one will appear in the buyer’s questions — and in their own risk register once you’re onboarded.

Data residency arrives early in every health procurement. ISO 27001 doesn’t require data to stay in Australia, but health buyers very often do, contractually — and where your data lives is a separate question from where you’re certified. Understand the distinction before a procurement team tests you on it: data residency and ISO 27001 walks through it.

Mechanically, certification costs and takes what it does for any organisation of your size and scope — the breakdown is in what ISO 27001 actually costs in Australia — and if you’re early-stage, the small-scope advantages in ISO 27001 for Australian SaaS startups apply to you too. Nothing about the process changes in health. What changes is how hard the output gets read.

What most people get wrong

Certifying the company but never mapping the data. Teams scope the ISMS around the organisation — laptops, offices, the cloud account — and arrive at the hospital’s review unable to answer its first real question: show us everywhere patient data goes. The asset register lists systems; nobody has drawn the flows between them, the third parties in the chain, or where records go when they’re deleted.

For a health buyer that gap is disqualifying, because their obligations attach to the data, not to your org chart. Build the data flow map early and make it an ISMS artefact — reviewed, versioned, consistent with your Statement of Applicability. The hardest part of the review becomes a document you hand over on day one.

How Secure60 handles this

Our governance capability builds the ISMS around your health data flows: classification, policies, supplier assessments, the data flow map as a maintained artefact, evidence kept live. The same engagement runs the operational security health reviewers sample — access logging, monitoring, vulnerability management — so “who looked at this record” has an answer on demand. Secure60 is ISO 27001:2022 certified ourselves, and our delivery infrastructure via Rackcorp spans ten Australian datacentres, which matters when residency comes up in the same meeting.