Skip to main content
Personal Impact in ISO 27799

Personal Impact in ISO 27799

$299.00
Who trusts this:
Trusted by professionals in 160+ countries
How you learn:
Self-paced • Lifetime updates
Your guarantee:
30-day money-back guarantee — no questions asked
Toolkit Included:
Includes a practical, ready-to-use toolkit containing implementation templates, worksheets, checklists, and decision-support materials used to accelerate real-world application and reduce setup time.
When you get access:
Course access is prepared after purchase and delivered via email
Adding to cart… The item has been added

This curriculum spans the design and operationalization of health information governance comparable to a multi-phase advisory engagement, covering policy alignment, risk modeling, access governance, incident response, and organizational change management specific to regulated healthcare environments.

Module 1: Establishing Governance Frameworks Aligned with ISO 27799

  • Define scope boundaries for health information governance across clinical, administrative, and research systems.
  • Select governance roles (e.g., Data Stewards, Custodians) with documented accountability for PHI integrity.
  • Map existing organizational policies to ISO 27799 control objectives to identify coverage gaps.
  • Integrate ISO 27799 requirements with other standards such as HIPAA, GDPR, and NIST CSF.
  • Develop escalation paths for unresolved data handling disputes between clinical and IT departments.
  • Establish a governance charter that defines authority for overriding local practices in favor of compliance.
  • Conduct stakeholder interviews to align governance expectations with clinical workflow realities.
  • Implement version control and audit trails for governance documentation to support regulatory audits.

Module 2: Risk Assessment and Control Prioritization

  • Conduct threat modeling specific to electronic health records (EHR) systems using asset-value weighting.
  • Assign risk owners for each high-impact scenario involving unauthorized PHI disclosure.
  • Use quantitative methods to justify control investments in encryption vs. access logging.
  • Document residual risks after control implementation with executive sign-off.
  • Adjust risk scoring models to reflect jurisdictional differences in breach notification laws.
  • Integrate third-party vendor risks into organizational risk registers.
  • Define thresholds for re-assessment triggers based on incident frequency or system changes.
  • Validate risk treatment plans against ISO 27799 control objectives 5.1 through 5.10.

Module 3: Designing Access Control Mechanisms for PHI

  • Implement role-based access control (RBAC) with clinical role definitions from medical staff bylaws.
  • Enforce least privilege by reviewing access logs quarterly and revoking excessive permissions.
  • Design emergency access overrides with time-bound tokens and mandatory post-use justification.
  • Negotiate access exceptions for research projects while maintaining auditability.
  • Integrate single sign-on (SSO) systems with multi-factor authentication for remote access.
  • Configure access review workflows that route attestations to clinical supervisors, not IT.
  • Define access control policies for legacy systems lacking modern identity integration.
  • Map access control rules to ISO 27799 control 8.2 and align with authentication policies.

Module 4: Data Classification and Handling Procedures

  • Classify data elements based on sensitivity, using clinical context (e.g., mental health vs. lab results).
  • Define handling rules for cross-border data transfers involving cloud-hosted EHR backups.
  • Label documents and messages containing PHI using automated content inspection tools.
  • Establish secure printing policies for workstations in shared clinical areas.
  • Define retention periods for classified data in alignment with legal and clinical requirements.
  • Implement data loss prevention (DLP) rules tuned to avoid alert fatigue in high-volume environments.
  • Train clinical staff on proper handling of classified data during patient handoffs.
  • Review classification accuracy annually using random sampling and audit logs.

Module 5: Incident Management and Breach Response

  • Define criteria for classifying events as reportable breaches under applicable laws.
  • Assign breach response roles with clear handoff points between legal, PR, and IT teams.
  • Preserve forensic evidence from EHR systems while minimizing disruption to patient care.
  • Conduct tabletop exercises simulating ransomware attacks on patient registration systems.
  • Document root cause analyses using ISO 27799 control 16.1.6 and link to preventive actions.
  • Integrate incident data into risk registers to inform future control decisions.
  • Coordinate breach notifications with external regulators within mandated timeframes.
  • Implement post-incident access reviews to detect compromised accounts.

Module 6: Third-Party and Vendor Risk Oversight

  • Conduct security assessments of cloud EHR providers using ISO 27799-aligned questionnaires.
  • Negotiate business associate agreements (BAAs) with enforceable audit rights.
  • Monitor vendor compliance through periodic review of third-party audit reports (e.g., SOC 2).
  • Define data residency requirements in contracts to comply with local health privacy laws.
  • Require vendors to report security incidents within four hours of discovery.
  • Validate vendor patch management timelines against organizational vulnerability thresholds.
  • Establish offboarding procedures for terminated vendor relationships involving data return or destruction.
  • Map vendor controls to ISO 27799 control 15 and maintain a centralized oversight dashboard.

Module 7: Security Awareness and Behavioral Influence

  • Develop role-specific training content for clinicians, billing staff, and IT support teams.
  • Design phishing simulations using healthcare-themed lures to improve detection rates.
  • Measure behavior change through pre- and post-training assessments with clinical scenarios.
  • Integrate security reminders into EHR login sequences without disrupting workflow.
  • Engage clinical champions to model secure behaviors in high-visibility departments.
  • Track repeat policy violations to identify departments needing targeted intervention.
  • Align messaging with organizational values (e.g., patient safety) rather than compliance alone.
  • Report awareness metrics to governance committees using leading and lagging indicators.

Module 8: Audit, Monitoring, and Continuous Improvement

  • Configure SIEM rules to detect anomalous access patterns in EHR audit logs.
  • Define key performance indicators (KPIs) for control effectiveness, such as patch latency.
  • Conduct internal audits using checklists mapped directly to ISO 27799 controls.
  • Escalate unresolved audit findings to executive leadership with risk impact statements.
  • Integrate control monitoring into existing IT service management (ITSM) workflows.
  • Perform control optimization reviews after major system upgrades or organizational changes.
  • Use automated compliance tools to generate evidence for external auditors.
  • Update governance documentation based on audit results and regulatory changes.

Module 9: Strategic Integration of Governance into Organizational Change

  • Embed governance checkpoints into project lifecycle reviews for new clinical systems.
  • Assess governance implications of mergers or acquisitions involving health data systems.
  • Align security architecture reviews with enterprise architecture governance boards.
  • Advocate for security requirements in procurement processes before vendor selection.
  • Define governance success metrics tied to patient trust and operational resilience.
  • Coordinate with clinical leadership to integrate governance into quality improvement initiatives.
  • Manage resistance to governance changes by demonstrating alignment with care delivery goals.
  • Update governance strategy annually based on threat intelligence and audit outcomes.
!