Certifications for Healthcare: A sense of assurance and trust

Ever wondered what happens behind the scenes of various apps and services offered by cloud service provider?  
Actually a lot. This covers the entire software product lifecycle of design, development, operations, delivery, maintenance, and feedback from customers and users.  

How do we trust that everything which happens behind the scenes is well executed and done, audited regularly and nothing is compromised at any stage?  

This is where various control measures, certifications, and audits play a critical role for transparent and effective assessment. 
In this blog, I’ll talk about SAP Health Data Services for FHIR. How did we build assurance and trust throughout from design to active usage by our customers and partners? So, let’s begin. 

Service and Organisation Controls (SOC) 

The Service and Organisation Controls or in short SOC certification reports are global standards. These certification reports offer a detailed understanding into the design and operational effectiveness of internal control systems implemented within cloud product.   

There are different types of SOC reports as described in the diagram after this. They also differ upon the duration on which these SOC reports are generated.   

SAP Health Data Services for FHIR is certified for both SOC 1 and SOC 2 reports. They’re Type 2 reports which means controls are measured for a longer duration of time. What does this mean for you? 

For our Customers and Partners this certification is about assurance on the effectiveness of SAP controls related to financial reporting, security, availability, processing integrity, confidentiality, and privacy. Some of the controls and corresponding importance are highlighted in the following diagram. 

Personally, when I visit a hospital, I like to have my data to be stored and processed with absolute confidentiality. Data is shared only on a need-to-know basis even within hospital staffs having proper authorization. This way I’m happy that my personal information and my sensitive data are secured and not misused.  

Now, let me take you through an attestation in the next section. 

Cloud Computing Compliance Criteria Catalogue (C5) 

The C5 (Cloud Computing Compliance Criteria Catalogue) is a comprehensive standard defined by the German Federal Office for Information Security (BSI). The C5 is attestation for truthfulness and authenticity about the security compliance from the cloud service provider. 

The C5 attestation is an independent and external audit which covers broad range of security aspects including governance, risk management, and technical controls. The C5 attestation also comes in two types which covers scope of the auditor’s report: 

It confirms that SAP Health Data Services for FHIR has undergone a rigorous audit, proving its strong security controls and operational transparency. The C5 audit report is of Type 2. 

For our Customers and Partners, this means a cloud service offers strong security measures and high operational efficiency. Some of the controls and corresponding importance are highlighted in the following diagram.  

The list is exhaustive. I’m listing down key controls which you can relate easily and are always on our mind. 

When I visit a hospital, I prefer not to hear “System is down”, which means billing can’t be done or prescription can’t be generated. The C5 attestation and audit helps to avoid these situations so that it doesn’t happen with the cloud services used in hospital.     

International Organisation for Standardisation (ISO/IEC – 27000 family of standards) 

ISO standards are external certifications offered in accordance with ISO guidelines and are independent of any industry. It’s a set of standards used globally by organisations of all sizes and sectors to ensure compliance, safeguard sensitive data and improve trust with stakeholders.  

The standard mainly talks about the Information Security Management System (ISMS), its adoption and effective implementation by an Organisation, in the context of this blog, its cloud service provider. ISMS preserves the confidentiality, integrity, and availability of information by applying a risk management process and gives confidence to interested parties that risks are adequately managed. 

Some of the important measures and controls of the standard along with corresponding importance are listed in the following diagram. As you see, most of them apply to any industry and applicable to any product and services. 

SAP Health Data Services for FHIR in its product lifecycle is developed with the right set of roles and responsibilities defined. With awareness to the process, understanding of the risks involved and adherence to the performance evaluation.  

For our Customers and Partners, ISO standards mean that adequate due diligence and effective practices are followed for the service. 

Final words 

In healthcare industry where we deal with personal and sensitive data in highly regulated environment, it is of great significance to understand how well these apps and services are developed, maintained, and operated. 

Certification and attestation for the product and services ensures this for SAP Health Data Services for FHIR. When you use this service, you’re consuming the assurance and trust which comes along with it.  

For more details about the certifications and attestations of SAP Health Data Services for FHIR visit the SAP Discovery Center page. For viewing compliance report, visit SAP Compliance Finder.  

Looking forward for further engagement on this topic, I welcome your ideas and comments. 

Ever wondered what happens behind the scenes of various apps and services offered by cloud service provider?  
Actually a lot. This covers the entire software product lifecycle of design, development, operations, delivery, maintenance, and feedback from customers and users.  

How do we trust that everything which happens behind the scenes is well executed and done, audited regularly and nothing is compromised at any stage?  

This is where various control measures, certifications, and audits play a critical role for transparent and effective assessment. 
In this blog, I’ll talk about SAP Health Data Services for FHIR. How did we build assurance and trust throughout from design to active usage by our customers and partners? So, let’s begin. 

Service and Organisation Controls (SOC) 

The Service and Organisation Controls or in short SOC certification reports are global standards. These certification reports offer a detailed understanding into the design and operational effectiveness of internal control systems implemented within cloud product.   

There are different types of SOC reports as described in the diagram after this. They also differ upon the duration on which these SOC reports are generated.   

SAP Health Data Services for FHIR is certified for both SOC 1 and SOC 2 reports. They’re Type 2 reports which means controls are measured for a longer duration of time. What does this mean for you? 

For our Customers and Partners this certification is about assurance on the effectiveness of SAP controls related to financial reporting, security, availability, processing integrity, confidentiality, and privacy. Some of the controls and corresponding importance are highlighted in the following diagram. 

Personally, when I visit a hospital, I like to have my data to be stored and processed with absolute confidentiality. Data is shared only on a need-to-know basis even within hospital staffs having proper authorization. This way I’m happy that my personal information and my sensitive data are secured and not misused.  

Now, let me take you through an attestation in the next section. 

Cloud Computing Compliance Criteria Catalogue (C5) 

The C5 (Cloud Computing Compliance Criteria Catalogue) is a comprehensive standard defined by the German Federal Office for Information Security (BSI). The C5 is attestation for truthfulness and authenticity about the security compliance from the cloud service provider. 

The C5 attestation is an independent and external audit which covers broad range of security aspects including governance, risk management, and technical controls. The C5 attestation also comes in two types which covers scope of the auditor’s report: 

It confirms that SAP Health Data Services for FHIR has undergone a rigorous audit, proving its strong security controls and operational transparency. The C5 audit report is of Type 2. 

For our Customers and Partners, this means a cloud service offers strong security measures and high operational efficiency. Some of the controls and corresponding importance are highlighted in the following diagram.  

The list is exhaustive. I’m listing down key controls which you can relate easily and are always on our mind. 

When I visit a hospital, I prefer not to hear “System is down”, which means billing can’t be done or prescription can’t be generated. The C5 attestation and audit helps to avoid these situations so that it doesn’t happen with the cloud services used in hospital.     

International Organisation for Standardisation (ISO/IEC – 27000 family of standards) 

ISO standards are external certifications offered in accordance with ISO guidelines and are independent of any industry. It’s a set of standards used globally by organisations of all sizes and sectors to ensure compliance, safeguard sensitive data and improve trust with stakeholders.  

The standard mainly talks about the Information Security Management System (ISMS), its adoption and effective implementation by an Organisation, in the context of this blog, its cloud service provider. ISMS preserves the confidentiality, integrity, and availability of information by applying a risk management process and gives confidence to interested parties that risks are adequately managed. 

Some of the important measures and controls of the standard along with corresponding importance are listed in the following diagram. As you see, most of them apply to any industry and applicable to any product and services. 

SAP Health Data Services for FHIR in its product lifecycle is developed with the right set of roles and responsibilities defined. With awareness to the process, understanding of the risks involved and adherence to the performance evaluation.  

For our Customers and Partners, ISO standards mean that adequate due diligence and effective practices are followed for the service. 

Final words 

In healthcare industry where we deal with personal and sensitive data in highly regulated environment, it is of great significance to understand how well these apps and services are developed, maintained, and operated. 

Certification and attestation for the product and services ensures this for SAP Health Data Services for FHIR. When you use this service, you’re consuming the assurance and trust which comes along with it.  

For more details about the certifications and attestations of SAP Health Data Services for FHIR visit the SAP Discovery Center page. For viewing compliance report, visit SAP Compliance Finder.  

Looking forward for further engagement on this topic, I welcome your ideas and comments.