The law and guidance around the standard, in the buyer's four markets
ISO 81001-1 is a principles and concepts standard. It is voluntary unless a contract, a regulator or a scheme adopts it, and the obligations that surround it differ by market. This page names the held standards that matter to a CISO in health software, in the order the estate scans them: the United States, the European Union, the United Kingdom and Australia.
| Held standard | Rules kept | Why it matters to this buyer |
|---|---|---|
| HIPAA Security Rule | 67 | Applies to covered entities and business associates that hold electronic protected health information. The register's information management and security rows answer to it. |
| HIPAA Privacy Rule | 27 | Sets the permitted uses and disclosures of protected health information. It anchors the privacy management element. |
| FDA Quality Management System Regulation | 13 | The quality system requirement for medical devices, including software as a medical device. It is where the quality management element meets an inspector. |
| NIST Cybersecurity Framework 2.0 | 106 | Voluntary for most organisations and widely used as the common language for security governance. Useful where a supplier asks what good looks like. |
Named and counted, not quoted. The requirements are stated on the standard's own page in the library, in our words, with the clause cited.
| Held standard | Rules kept | Why it matters to this buyer |
|---|---|---|
| GDPR | 41 | Applies to personal data processing, including health data. It sets the lawful basis, the rights and the breach route the privacy element has to meet. |
| Regulation on the European Health Data Space (EHDS) | 77 | Adds obligations for electronic health data access and secondary use. It is the newest of the four and the one most likely to change a data flow. |
| EU Medical Devices Regulation (MDR 2017/745) | 26 | Applies to medical devices placed on the EU market, including software as a medical device. It carries the safety and effectiveness evidence. |
Named and counted, not quoted. The requirements are stated on the standard's own page in the library, in our words, with the clause cited.
| Held standard | Rules kept | Why it matters to this buyer |
|---|---|---|
| UK GDPR | 60 | The retained GDPR as it applies in the United Kingdom. It sets the lawful basis and the breach route for health data. |
| UK Data Protection Act 2018 | 83 | The Act that supplements the UK GDPR, including the health and social care provisions. |
| UK NCSC Cyber Assessment Framework | 63 | The assessment framework used across UK critical national infrastructure and increasingly by health providers and their suppliers. |
Named and counted, not quoted. The requirements are stated on the standard's own page in the library, in our words, with the clause cited.
| Held standard | Rules kept | Why it matters to this buyer |
|---|---|---|
| Australian Privacy Principles | 13 | The APPs apply to Australian privacy law and to health information in particular. They anchor the privacy element in this market. |
| Australia My Health Records Act 2012 | 40 | Applies to the national digital health record system and to participants in it. It is the clearest local example of a data flow with its own rules. |
| Australia Therapeutic Goods (Medical Devices) Regulations 2002 | 75 | The medical device requirements, including software as a medical device. The TGA is the regulator. |
Named and counted, not quoted. The requirements are stated on the standard's own page in the library, in our words, with the clause cited.
A scan of the library, not a fixed list
For each market the library was scanned for the standards whose name and jurisdiction match this buyer's activity and data: health, medical device, privacy, security and data protection. The top matches by the number of rules kept were then read for fit and the four, three, three and three on this page were chosen. A federal or primary regime comes before a single state one. Where a market's regime is not held, the page says so instead of stating it.
The scan is recorded in the run file for this build. The counts are the library's held rules at the date of the scan, not a claim about the standard.