Meet HISF requirements for NZ hospitals and larger providers with ease

HISF is the Health Information Security Framework (HISO 10029), the cyber security standard for New Zealand's health sector published by Health New Zealand | Te Whatu Ora. A core framework document (HISO 10029:2022) explains its principles and functional processes, and separate guidance documents set requirements for hospitals, medium to large organisations, micro to small organisations and suppliers, so each organisation applies controls suited to its size.

It applies to health organisations that meet two or more of the segment criteria in HISO 10029.3:2023. These include operating across multiple locations, having more than about 25 staff, serving a population of over 10,000, having in-house IT staff, collecting health data from other providers, or developing software in-house. Smaller practices use the micro to small guidance instead, and public and private hospitals use the hospital guidance.

HISF is a Health Information Standards Organisation (HISO) standard rather than legislation, and its guidance presents requirements as recommended controls. Health New Zealand expects organisations and vendors in the health sector to adopt and align with it, and funding agreements or contracts can make HISF alignment a formal requirement. Check your own contracts to confirm what applies to your organisation.

Each segment guidance contains 75 requirements. The medium to large organisation requirements are numbered HML01 to HML75 and the hospital requirements HHSP01 to HHSP75. They cover the same topics, including policies, human resource security, asset lifecycle, incident management, business continuity, supplier management, identity and access, cloud security, medical devices, backups, logging and compliance.

HISF draws on internationally recognised security practice, and many of its requirements closely match ISO/IEC 27001 Annex A controls, such as access control, cryptography, supplier management, backups and logging. ISO 27001 certification does not automatically prove HISF compliance, because HISF adds health specific requirements such as medical device scanning, maintenance and disposal. Mapping one control set to both lets evidence count towards each.

HISF covers the security of health information, while privacy expectations are set separately by the Health Information Privacy Code 2020 under the Privacy Act 2020. The two work together: the Code sets rules for collecting, using and disclosing health information, and HISF describes the security controls that help protect that information from loss, misuse and unauthorised access.

Start with the HISO 10029:2022 core framework, confirm your segment, then work through the 75 requirements in the matching guidance document. Assign owners, assess gaps, write the required policies, implement technical controls and keep evidence that each requirement is met. Report progress to your Board or steering committee, and review compliance regularly as HML66 and HHSP67 require.

Yes. OneClickComply supports HISF for medium to large organisations and hospitals today. You get the HML and HHSP requirements linked to shared controls, automated evidence collection from your connected tools, AutoComplete policies and guidance from our in-house audit team. Controls you already hold for ISO 27001 and other frameworks count towards HISF.