Healthcare and life sciences
ISO certification and data security for healthcare and life sciences
Quality and information security certification for organisations where patient safety and patient data both matter.
Certification and audits for healthcare and life sciences
Healthcare and life sciences organisations answer to two kinds of scrutiny: whether their products and services are safe, and whether the patient data they hold is protected. Medical device makers work to quality system requirements, while hospitals, laboratories and health tech companies hold some of the most sensitive personal data there is.
We certify medical device quality management systems to ISO 13485, and information security and privacy systems to ISO 27001 and ISO 27701. We also assess data protection practices against the DPDP Act and GDPR, and test patient portals, apps and connected systems for vulnerabilities.
Certification supports, but does not replace, regulatory approvals such as device registration or marketing authorisation. In the United States there is no official HIPAA certification, though ISO 27001 and independent testing help demonstrate the safeguards HIPAA expects.
What we hear
Pressures we audit against
- 01
Regulatory quality expectations
Device regulators in many markets expect a quality management system aligned with ISO 13485, and they look closely at design controls, risk management and post-market surveillance.
- 02
Sensitive patient data
Health records are attractive to attackers and treated as sensitive under most privacy laws, which raises the cost of any breach.
- 03
Connected devices and legacy systems
Hospital networks often mix modern cloud services with older clinical systems that cannot be patched easily.
- 04
Supplier oversight
Contract manufacturers, laboratories and software vendors all handle regulated work or data, and must be controlled as part of your system.
Standards and audits for this sector
ISO certification
ISO 13485
Independent certification of a quality management system built around medical device safety, performance and regulatory requirements.
ISO certification
ISO 27001
Independent certification of your information security management system against ISO/IEC 27001:2022.
Security audits
Data protection compliance
An independent check of how your organisation collects, uses, protects and deletes personal data.
ISO certification
ISO 27701
Certification of how your organisation governs personal data, as a controller, a processor or both.
Security audits
VAPT
Vulnerability scanning followed by hands-on exploitation, so you know which weaknesses an attacker could use.
Security audits
Web application security audit
Testing of your web application against OWASP guidance, with a certificate that names the URLs, dates and build covered.
ISO certification
ISO 9001
Independent assessment of your quality management system against ISO 9001:2015, by an accredited certification body.
Guides
5 min read
ISO/IEC 27001:2022: what changed and how audits treat it
The 2022 edition reorganised Annex A into 93 controls across four themes and tightened several clauses. This guide sets out what changed, what auditors look for and how to close the gaps in a sensible order.
5 min read
Preparing for stage 1 and stage 2 certification audits
Initial certification happens in two stages: a readiness review and a full assessment of how the system works. Here is what each stage covers and how to prepare without overbuilding.
5 min read
Integrated management system audits
Organisations with more than one ISO certification can be audited against them together. This guide explains what an integrated audit shares, what still has to be assessed standard by standard, and how to prepare.
5 min read
Transferring your certification to a new certification body
You can move an accredited management system certification from one certification body to another without starting over. This guide explains who is eligible, what the pre-transfer review covers and what happens to your audit cycle.
5 min read
Surveillance and recertification: the three-year cycle
Certification is not a single event. This guide explains the three-year cycle, what each surveillance audit looks at, what puts a certificate at risk and how to plan recertification so it never lapses.
5 min read
Preparing for a CERT-In empanelled security audit
A security audit by a CERT-In empanelled organisation goes faster and says more when the auditee is prepared. This checklist covers scope, environments, access, evidence, fixes and the final report.
Frequently asked questions
Where we work
Our registered office is in Redwood Shores, California. Teams in London, Dubai, Mumbai and Singapore plan and lead audits in their regions.
Plan your certification
Tell us your sites, scope and the standards you need. We reply with an audit plan and a fixed quote.