ISO 27001 for Australian health tech

Why health buyers run the most demanding security reviews

Health data sits in the highest-sensitivity class of personal information under Australian privacy law, and the organisations buying health tech — hospitals, primary health networks, insurers — carry health-sector obligations of their own. Onboarding a supplier transfers that supplier’s risk onto them, and their review is built accordingly.

It extends past the standard questionnaire. Health buyers ask for the data map rather than the policy: where patient data enters your system, every place it is stored, who can see it under which role, which subcontractors touch it, how long it is kept and how it is destroyed. Procurement commonly routes the same answers through privacy and clinical stakeholders as well as IT security, so three reviewers read the evidence with three different concerns.

The review also recurs. Health contracts commonly carry ongoing assurance clauses — periodic re-review, notification duties, audit rights — so the evidence has to stay current rather than exist once at onboarding. Fintechs face the same dynamic from their regulated customers (ISO 27001 for Australian fintechs covers it), and in health it comes with a privacy officer attached.

Scoping ISO 27001 around health data

ISO 27001 suits this buyer because it certifies the management system that produces those answers. The health-specific work is in the scoping.

• The scope statement. Define it around the health data flows. Buyers read that line first, and a certificate scoped to exclude the product that handles patient data carries less weight than no certificate at all.
• Classification. Health data as the highest classification tier drives access decisions, encryption, retention, and what is logged and for how long.
• Access control and logging. Health buyers ask who accessed a given record and when, in those terms. Least-privilege roles plus event logging that can answer it are the controls their reviewers sample first.
• Suppliers. Every subprocessor that touches health data belongs in your supplier assessments, because each will appear in the buyer’s questions and in their own risk register once you are onboarded.

Data residency arrives early in every health procurement. ISO 27001 does not require data to remain in Australia, and health buyers frequently require it by contract, so where your data lives is a separate question from where you are certified. Data residency and ISO 27001 sets out the distinction.

Certification cost and duration are the same as for any organisation of your size and scope — the breakdown is in what ISO 27001 costs in Australia — and for early-stage companies the small-scope advantages in ISO 27001 for Australian SaaS startups apply. The process is unchanged in health; the output is read more closely.

The data flow map is the artefact health buyers ask for first

Teams that scope the ISMS around the organisation — laptops, offices, the cloud account — arrive at a hospital’s review unable to answer its first substantive question: every place patient data goes. The asset register lists systems, and nobody has drawn the flows between them, the third parties in the chain, or where records go on deletion.

For a health buyer that gap is disqualifying, because their obligations attach to the data rather than to your org chart. A data flow map built early and maintained as an ISMS artefact — reviewed, versioned, consistent with the Statement of Applicability — turns the hardest part of the review into a document handed over on day one.

How Secure60 handles this

Our governance capability builds the ISMS around your health data flows: classification, policies, supplier assessments, the data flow map as a maintained artefact, and evidence kept current. The same engagement runs the operational security health reviewers sample — access logging, monitoring, vulnerability management — so a question about who accessed a specific record has an answer on demand. Secure60 holds ISO 27001:2022 certification, and our delivery infrastructure via Rackcorp spans ten Australian datacentres, which is relevant when residency arises in the same meeting.