ISO standards for healthcare providers

Hospitals, clinics and diagnostic centres look at ISO standards to organize patient flow, protect records and keep staff safe. Management-system standards do not replace clinical regulation or professional licensing. They give a structure for the non-clinical and supporting processes that surround care, and a separate accreditation route exists for medical laboratories.

Updated 5 November 2026

A clean white laboratory bench with a microscope and analysis equipment.

Why organizations in this sector ask

Consistent service processes

Appointments, referrals, handovers, complaints and cleaning schedules work better when they are defined and reviewed.

Patient data protection

Health records are sensitive. An information security management system helps show how access and storage are controlled.

Staff and continuity

Needle-stick incidents, manual handling and infection risks affect staff, and an outage affects care. Structured systems cover both.

Standards to look at first

Management-system certificationISO 9001Quality managementApplies to the management of administrative and supporting processes in a clinic or hospital, such as scheduling, complaints and supplier control. It does not assess clinical quality of care.Management-system certificationISO/IEC 27001Information securityRelevant to electronic health records, imaging systems and who may see patient information.Management-system certificationISO 45001Occupational health and safetyCovers staff hazards in care settings, including sharps, patient handling, exposure to infection and violence at work.Management-system certificationISO 22301Business continuityRelevant to keeping critical services such as emergency departments, power and records systems running during disruption.Specialist accreditation pathwayISO 15189Medical laboratoriesMedical laboratories follow the accreditation pathway under ISO 15189, not certification. An accreditation body assesses the laboratory's competence. Hospital laboratories should speak to the relevant accreditation body.

Common challenges

Handovers between shifts and departments rely on informal communication.
Patient records are accessed by more staff than necessary.
Equipment cleaning, calibration and maintenance records are inconsistent across departments.
Complaints are handled by whoever receives them, with no common route.
Contingency plans exist on paper but are not tested.

Evidence you may be asked to show

Documented procedures for key support processes and records of staff training.
Access control rules and audit logs for patient information systems.
Equipment maintenance and calibration records.
Complaint logs showing how each was investigated and closed.
Incident reports and evidence of drills or tests of contingency plans.

Questions an auditor might ask

How do you control who can open a patient's record, and how do you check it?
Show me how a complaint is received, investigated and communicated back to the patient.
How do you know medical equipment has been maintained and checked on schedule?
What would you do if your records system were unavailable for a day?
How are new staff trained and assessed before working unsupervised?

What a certification scope can look like

Example: Provision of outpatient clinical services and associated administrative support at a named facility.
Example: Management of patient registration, scheduling and records for a private clinic.
Example: Operation of a diagnostic imaging centre, including reception and reporting workflows.
Example: Hospital support services, such as sterile supply and facilities management.

These are illustrations to discuss with the certification body. We do not approve or pre-approve scope. MIYAAR CONNECT explains and connects; the certification body audits and decides.

Common questions

Does ISO 9001 certification show our clinical care is good?

No. It relates to how management and support processes are run within a stated scope. Clinical standards and licensing are set by health authorities and professional bodies, so check with the regulator.

How is a medical laboratory different?

Medical laboratories follow an accreditation pathway under ISO 15189, where an accreditation body assesses technical competence. This is not the same as certification by a certification body.

Can a hospital certify just one department?

Scope can be limited to defined activities and locations, but it is agreed with the certification body. Review how your scope will be worded and whether it is acceptable to the people asking for it.

What affects cost for a healthcare provider?

The number of staff, sites and departments in scope, and the complexity of the services. See the page on certification cost factors. A certification body provides the quote.

What affects certification cost

Useful reading

Get a quote for healthcare providers

Share a few details. We review your inquiry and may connect it with a suitable independent certification body, with your consent.

Request a Quote Find My ISO Standard