ISO/IEC 27018: Protecting Patient Information in Cloud-Hosted Imaging Workloads

ISO/IEC 27018 Requirements

ISO/IEC 27018 is the international standard for organizations that process personal data in public clouds on behalf of others. It is applied as an extension of an ISO/IEC 27001 management system and adds privacy obligations to the security controls already in place. The standard distinguishes the controller, who decides why and how personal data are processed, from the processor, who processes the data on the controller's instructions. In a clinical trial the sponsor and the investigational sites are the controllers, and an imaging core lab processing their images in the cloud is a processor, which is the role the standard is written for.

Its obligations on the imaging core lab follow the recognized privacy principles:

• Consent and choice. The core lab must give the sponsor the means to honor the rights of the trial participants whose data it holds.
• Purpose limitation. Personal data may be processed only for the purposes the sponsor has instructed, and never for the core lab's own marketing or commercial purposes without express consent that is not a condition of the service.
• Data minimization. Temporary files and working copies containing personal data must be securely erased within a defined period.
• Disclosure limitation. Any legally compelled disclosure must be reported to the sponsor unless the law prohibits it, and every disclosure must be recorded.
• Transparency. Sub-processors, such as the cloud hosting provider, must be disclosed before processing begins, with notice of any change.
• Accountability. Breaches involving personal data must be reported to the sponsor promptly, within a maximum period set in the contract, with records of the incident and the response, and personal data must be returned, transferred or securely destroyed at the end of the engagement, including copies held in backups and by sub-processors.
• Information security. The core lab must hold confidentiality agreements with everyone who has access, restrict paper copies, control and log data restoration, protect storage media, prohibit unencrypted portable media, encrypt personal data sent over public networks, assign unique user identities with a record of who is authorized, pass its contractual obligations down to sub-processors, and ensure that storage reassigned from one customer to another holds no residual data.
• Location. The countries in which personal data may be stored, including by sub-processors, must be specified and disclosed to the sponsor, with notice of any intended change.

Why It's Relevant to an Imaging Core Lab

A sponsor's obligations under HIPAA, as a covered entity or business associate, and under the GDPR, as a controller, do not stop at the imaging core lab's door. The sponsor must be able to show where the data are, who can reach them, on whose instructions they are processed, what happens when something goes wrong, and what happens when the study ends. ISO/IEC 27018 turns each of these questions into a control with an auditable record, written for a processor operating in a public cloud. Intrinsic Imaging's Quality Management page describes the result: personal information embedded in imaging data is handled in line with GDPR and HIPAA expectations, with documented controls over processing, storage and sponsor data ownership.

Where the Standard Resolves Real Imaging Problems

Identifiable Data Within the Images Themselves

Examinations arrive at the imaging core lab with patient names and birth dates in DICOM headers, text burned into the pixel data, or local hospital identifiers. Under the standard, the core lab may handle this information only as the sponsor has instructed, which in a clinical trial means de-identification at intake and processing of pseudonymized data from then on, and it must securely erase the temporary files created during de-identification and transfer within a defined period and encrypt any personal data sent over public networks. At Intrinsic Imaging's core lab, the identifiable copy exists only for as long as it takes to remove the identifiers, and no intermediate copies remain in caches or working directories.

A Breach Notification Clock the Sponsor Does Not Control

A security incident at an imaging core lab can require a sponsor to notify regulators or patients within fixed statutory periods, yet the sponsor learns of the incident only when the core lab chooses to disclose it. ISO/IEC 27018 requires the core lab to notify the sponsor promptly of any unauthorized access to personal data or to the equipment and facilities that process it, to record the incident and the remediation, and to agree the maximum notification period in the contract. The sponsor's statutory deadline is therefore protected by a contractual deadline at Intrinsic Imaging's core lab that an auditor has confirmed exists and is followed.

Images Used for a Purpose the Patient Never Consented To

Imaging data accumulated across trials are valuable for developing and training algorithms, and a sponsor must be certain that its patients' images are not reused by its imaging core lab. The standard limits processing to the sponsor's documented instructions and prohibits use for the core lab's own commercial purposes without express consent that cannot be made a condition of the service. At Intrinsic Imaging's core lab, the sponsor's images are processed for the sponsor's study, and any secondary use is a matter for the sponsor's instruction and the patients' consent rather than for the core lab's discretion.

What Certification Means for a Sponsor

Sponsors and sites remain accountable to patients and regulators for the personal data in the images they send to an imaging core lab. Intrinsic Imaging's ISO/IEC 27018 certification means that an accredited body has verified that the core lab, as a processor in a public cloud, processes those images only on the sponsor's instructions and never for its own commercial purposes, discloses where they are stored and by whom, de-identifies at intake and erases the intermediate copies, encrypts data in transit, reports breaches within a contractual period, keeps a complete record of sub-processors and disclosures, supports the rights of participants through the sponsor, and returns or destroys every copy at close-out. For a sponsor completing a HIPAA business associate assessment or a GDPR data protection impact assessment, these are the answers the assessment requires, already documented and independently audited.