Meet the HISF micro to small requirements without the paperwork

It is HISO 10029.2:2023, guidance published by Te Whatu Ora in April 2023 as part of New Zealand's Health Information Security Framework. It sets 21 cyber security requirements, HMS01 to HMS21, for small health organisations, grouped under Plan, Identify, Protect, Detect and Respond. Each requirement comes with recommended controls, and HISF tools and templates are provided to help organisations implement and assess them.

It applies to health organisations that meet two or more of these criteria: stand-alone, based at a single site with basic technology, up to about 25 staff, managing a population under 10,000, minimal or no in-house IT, and no in-house software or web application development. In practice that covers many general practices, pharmacies and community or allied health providers. Hospitals, larger organisations and suppliers have their own HISF guidance documents.

HISF is not a law with fines. The core framework says its obligations apply to all organisations that collect, process or store personal health information about New Zealanders, and Te Whatu Ora expects organisations to assess and share their maturity. Whether it is a formal condition for you usually depends on your funding or service agreements with Health New Zealand, so check your contract terms.

They cover defined security roles, an approved security policy, an asset inventory, supplier assurance, periodic risk assessment, protection of shared information, role-based access, keeping systems up to date, restricting software installs, anti-malware, encrypted and tested backups, authorised devices, remote working, licensed software, secure networks, network separation, encrypted websites, logging, monitoring, incident management and continuity of access to health information.

HISF's five functional processes are adapted from the NIST Cybersecurity Framework, and its requirements are mapped to control catalogues including ISO 27001, the New Zealand Information Security Manual, CIS Controls and CERT NZ critical controls. An organisation with ISO 27001 controls in place will already meet much of HISF, but HISF has no certification of its own and focuses on health information specifically.

No. HISF covers information security: confidentiality, integrity and availability of health information. Privacy is handled separately by the Health Information Privacy Code 2020 and the Privacy Act 2020, which the framework lists as relevant legislation. Small providers usually need to meet both, using HISF for security controls and the Code for how health information is collected, used and disclosed.

Te Whatu Ora describes three steps: read the core HISO 10029:2022 framework, work through the 21 requirements and guidance in the micro to small document, then use the HISF tools and templates to implement and document your controls. The guidance is a set of recommendations, so other ways of meeting a requirement are acceptable if they achieve the same outcome.

Yes. OneClickComply supports HISF for micro to small organisations today. You can track each HMS requirement, collect evidence automatically from connected tools, generate policies with AutoComplete and reuse controls you already hold for frameworks such as ISO 27001. Our in-house auditors can review your self-assessment before you share it.