Security Guide for Medical Institutions
Under the Ordinance for Enforcement of the Medical Care Act, administrators of hospitals, clinics, and midwifery homes must take measures to ensure cybersecurity. The MHLW guidelines they refer to were revised to version 7.0 in June 2026, and the cybersecurity checklist reviewed during on-site inspections was published the same month. This page organizes Pottech's 106 security articles into seven themes so that directors, administrators, and IT staff can start with what matters for their facility.
Medical Information System Safety Guidelines (v7.0)
14 articlesCovers the changes in version 7.0 of the MHLW guidelines, the key points of each volume, and the FY2026 cybersecurity checklist. Includes how to appoint a security officer and what small clinics need to do first.
Start here
- 安全管理ガイドライン第7.0版の変更点｜医療機関がすべきことJapanese
- 令和8年度サイバーセキュリティ対策チェックリスト全項目解説Japanese
- 二要素認証は令和9年度にどこまで必須か｜電子カルテ・サーバ・VPNJapanese
- Guideline Compliance for Small Clinics: How Far to Go
- The Governance Part of the Guidelines: What Executives Are Accountable For
All articles in this theme (14)
- 安全管理ガイドライン第7.0版の変更点｜医療機関がすべきことJapanese
- 令和8年度サイバーセキュリティ対策チェックリスト全項目解説Japanese
- 二要素認証は令和9年度にどこまで必須か｜電子カルテ・サーバ・VPNJapanese
- Guideline Compliance for Small Clinics: How Far to Go
- The Governance Part of the Guidelines: What Executives Are Accountable For
- The Planning and Management Part of the Guidelines
- The System Operations Part of the Guidelines
- A Three-Ministry Guidelines Compliance Checklist
- The Medical Information System Security Manager: Role and Appointment
- Building a Security Governance Structure in a Hospital, Including One-Person IT Departments
- Guideline Compliance When Using the Cloud
- Outsourcing Guideline Compliance: What Can and Cannot Be Delegated
- Requirements for External Storage of Medical Information: What Can Leave the Hospital
- Putting Security into Your Procurement Requirements for Medical Information Systems
Three-Ministry Guidelines
13 articlesExplains compliance with the "three-ministry, two-guideline" framework: the MHLW guidelines for medical institutions and the METI/MIC guidelines for system and service providers, including responsibility demarcation, outsourcing, and integration with ISMS documents.
Start here
- The Three Ministries' Two Guidelines Explained Simply: Essential Checks When Adopting an EMR
- The METI/MIC Guidelines: What Is Required of Service Providers
- A Three-Ministry Guidelines Compliance Checklist
- Drawing the Line: Demarcating Responsibility Between Hospitals and Vendors
All articles in this theme (13)
- The METI/MIC Guidelines: What Is Required of Service Providers
- A Three-Ministry Guidelines Compliance Checklist
- Drawing the Line: Demarcating Responsibility Between Hospitals and Vendors
- Integrating ISMS Documents with the Three-Ministry Guidelines
- Outsourcing Guideline Compliance: What Can and Cannot Be Delegated
- Guideline Compliance When Using the Cloud
- ISMS for Healthcare SaaS: Assessing Multi-Tenant Risk
- Requirements for External Storage of Medical Information: What Can Leave the Hospital
- Putting Security into Your Procurement Requirements for Medical Information Systems
- ISMS for PHR Operators: The Relationship with Japan's Personal Information Protection Act
- The Three Ministries' Two Guidelines Explained Simply: Essential Checks When Adopting an EMR
- Implementing the Three-Ministry Guidelines: Practical Steps, Accountability, and Risk Assessment
- Cloud Security for Medical Institutions: Shared Responsibility, the Three-Ministry Guidelines, and Zero Trust
ISMS & Certification
55 articlesPractical guidance for healthcare companies and medical SaaS providers obtaining and maintaining ISMS (ISO/IEC 27001) certification: cost, timeline, scope, documentation, audits, Annex A controls, and comparisons with the Privacy Mark and SOC 2.
Start here
- What Is an ISMS (ISO/IEC 27001)? A Complete Guide for Healthcare Companies
- The Full Cost of ISMS Certification: Audit Fees, Consulting, and Internal Effort
- The ISMS Timeline: What Six Months Actually Looks Like
- Defining the Scope of Your ISMS
- ISMS vs Privacy Mark: Which One Should You Take?
All articles in this theme (55)
- Reading the 37 Organizational Controls
- Annex A 2022: 93 Controls Across Four Themes
- Reading the 8 People Controls
- Reading the 14 Physical Controls
- Reading the 34 Technological Controls
- Audit Fees: Ranges and What Moves Them
- Connecting Business Continuity Planning to the ISMS
- Comparing the Main Certification Bodies: BSI, JQA, BV, SGS, DQS
- How to Choose a Certification Body: What to Look for When Comparing Quotes
- ISMS for Clinical Trial Systems and Japan's ER/ES Guidance
- Common Audit Nonconformities and How to Prevent Them
- Writing a Corrective Action Report
- Designing ISMS Scope for a Healthcare Company
- Building an Incident Response Procedure (for Service Providers)
- Building an Information Asset Register
- Writing an Information Security Policy
- Running an Internal Audit: Plan, Checklist, Report
- ISMS-AC, UKAS and ANAB: Choosing an Accreditation Body
- When ISMS Becomes a Condition of Trade: Hospital, Pharma and Government Procurement
- The Benefits and Drawbacks of ISMS Certification
- The Full Cost of ISMS Certification: Audit Fees, Consulting, and Internal Effort
- The ISMS Timeline: What Six Months Actually Looks Like
- ISMS Document Architecture: What to Write and How Far to Go
- What Is an ISMS (ISO/IEC 27001)? A Complete Guide for Healthcare Companies
- When Not to Certify: ISMS vs Answering Security Check Sheets
- Defining the Scope of Your ISMS
- ISMS for Small Organisations: Certifying With Fewer Than 50 People
- Adapting Template Procedures to Your Organisation
- Integrating ISMS Documents with the Three-Ministry Guidelines
- ISMS vs Privacy Mark: Which One Should You Take?
- ISMS vs SOC 2: Choosing for Overseas Deals and SaaS Businesses
- ISO/IEC 27001:2022 — What Changed from the 2013 Edition
- Clause 10: Improvement — Nonconformity and Corrective Action
- ISO/IEC 27001 Clause 4: Context of the Organisation
- ISO/IEC 27001 Clause 5: Leadership and Top Management's Responsibility
- ISO/IEC 27001 Clause 6: Planning — Risk Assessment and Security Objectives
- ISO/IEC 27001 Clause 7: Support — Competence, Awareness and Documented Information
- ISO/IEC 27001 Clause 8: Operation
- Clause 9: Performance Evaluation — Monitoring, Measurement, and Internal Audit
- ISO 27017 and ISO 27018: The Cloud Add-Ons to ISO 27001
- ISO 27701 (PIMS): Connecting Privacy to Your ISMS
- Running a Management Review and Writing the Minutes
- ISMS for Healthcare SaaS: Assessing Multi-Tenant Risk
- ISMS for PHR Operators: The Relationship with Japan's Personal Information Protection Act
- Preparing for Recertification in Year Three
- How to Run a Risk Assessment: Designing the Criteria
- Risk Treatment Plans and Accepting Residual Risk
- SaMD: How ISMS Relates to QMS (ISO 13485)
- Designing Security Awareness Training: Operating at 100% Completion
- Setting Information Security Objectives and KPIs
- What Stage 1 (Documentation Review) Actually Examines
- What Stage 2 (On-Site Audit) Actually Examines
- How to Write a Statement of Applicability (SoA)
- Supplier Security Management: Questionnaires and Contract Clauses
- Preparing for the Surveillance Audit
Ransomware & Incident Response
14 articlesWhy medical institutions are targeted and how to prevent, contain, and keep care running: VPN vulnerability management, backup design, cyber-attack BCP, first response, and incident response planning.
Start here
- Ransomware Defence for Hospitals: Why You Are Targeted and Where to Start
- First Response to Ransomware: What to Do in the First Hour and the First Day
- A BCP for Cyberattacks: How It Differs from Disaster Planning, and Prioritising Clinical Continuity
- Backup Design for Hospitals: The 3-2-1 Rule and the Tier 1 Requirement
- Incident Response Planning for Healthcare Providers: Who Decides What, and How Care Continues
All articles in this theme (14)
- Ransomware Defence for Hospitals: Why You Are Targeted and Where to Start
- First Response to Ransomware: What to Do in the First Hour and the First Day
- A BCP for Cyberattacks: How It Differs from Disaster Planning, and Prioritising Clinical Continuity
- Backup Design for Hospitals: The 3-2-1 Rule and the Tier 1 Requirement
- Incident Response Planning for Healthcare Providers: Who Decides What, and How Care Continues
- Managing VPN Device Vulnerabilities: Perimeter Operations for Hospitals
- Learning from the Structure of Incidents: Failure Patterns Common to Healthcare
- Antivirus and EDR: What a Hospital Should Decide Before Buying
- Network Segmentation and Asset Management: Knowing What Connects to What
- Securing Network-Connected Medical Devices: Protecting Equipment That Cannot Be Patched
- Phishing Simulations: Raise the Report Rate, Not Lower the Open Rate
- Cyber Insurance for Healthcare Providers: What Is Covered, and What Is Not
- Connecting Business Continuity Planning to the ISMS
- Building an Incident Response Procedure (for Service Providers)
Data Breach Prevention
11 articlesOrganizes data breaches at clinics and hospitals by route (human error, credential compromise, external attacks, vendors) with prioritized countermeasures, plus removable media, mobile devices, staff training, and breach reporting obligations.
Start here
- Security Measures Clinics Must Take in an Era of Data Breaches: Priorities and a Checklist by Leak Route
- Breach Reporting Duties: Preliminary and Final Reports, and Notifying Individuals
- Managing USB Drives and Removable Media in Hospitals
- Designing Security Training and Drills That Work in a Hospital
All articles in this theme (11)
- Security Measures Clinics Must Take in an Era of Data Breaches: Priorities and a Checklist by Leak Route
- Breach Reporting Duties: Preliminary and Final Reports, and Notifying Individuals
- Managing USB Drives and Removable Media in Hospitals
- Designing Security Training and Drills That Work in a Hospital
- Endpoint Management: Securing Laptops and Tablets Taken Off Site
- Reviewing EMR Access Logs: Detecting and Deterring Improper Viewing
- Why Is Two-Factor Authentication Necessary? Security Lessons from a Data Leak at an Online Consultation Service
- 医療ITサービスへの不正アクセスから学ぶ｜医療機関のセキュリティ対策と委託先管理Japanese
- Phishing Simulations: Raise the Report Rate, Not Lower the Open Rate
- Securing Hospital Wi-Fi: Separating Clinical and Patient Networks
- Cyber Insurance for Healthcare Providers: What Is Covered, and What Is Not
Access Control & Authentication
11 articlesControls over who can access what and how: the FY2027 two-factor authentication deadline, password rules, role-based access and privileged IDs, access log review, in-hospital Wi-Fi, and remote maintenance connections.
Start here
- 二要素認証は令和9年度にどこまで必須か｜電子カルテ・サーバ・VPNJapanese
- Deploying Multi-Factor Authentication Under Clinical Constraints
- Designing a Password Policy That a Hospital Can Actually Follow
- Access Control and Privileged ID Management: What Is Realistic in a Hospital
- Reviewing EMR Access Logs: Detecting and Deterring Improper Viewing
All articles in this theme (11)
- 二要素認証は令和9年度にどこまで必須か｜電子カルテ・サーバ・VPNJapanese
- Deploying Multi-Factor Authentication Under Clinical Constraints
- Designing a Password Policy That a Hospital Can Actually Follow
- Access Control and Privileged ID Management: What Is Realistic in a Hospital
- Reviewing EMR Access Logs: Detecting and Deterring Improper Viewing
- Logging and Audit Trails: Getting Past 'We Collect It but Nobody Looks'
- Why Is Two-Factor Authentication Necessary? Security Lessons from a Data Leak at an Online Consultation Service
- Securing Remote Maintenance: Managing Vendor Support Connections
- Securing Hospital Wi-Fi: Separating Clinical and Patient Networks
- Network Segmentation and Asset Management: Knowing What Connects to What
- Endpoint Management: Securing Laptops and Tablets Taken Off Site
Vendor & Cloud Management
16 articlesManaging risk through EHR vendors, cloud services, and maintenance providers: security checksheets and question lists, responsibility demarcation and SLAs, choosing cloud providers, and supply chain risk.
Start here
- 医療ITサービスへの不正アクセスから学ぶ｜医療機関のセキュリティ対策と委託先管理Japanese
- Supplier Security Management: Questionnaires and Contract Clauses
- Security Check Sheets for Vendors: What to Ask, and How
- Drawing the Line: Demarcating Responsibility Between Hospitals and Vendors
- Cloud Security for Medical Institutions: Shared Responsibility, the Three-Ministry Guidelines, and Zero Trust
All articles in this theme (16)
- 医療ITサービスへの不正アクセスから学ぶ｜医療機関のセキュリティ対策と委託先管理Japanese
- Supplier Security Management: Questionnaires and Contract Clauses
- Security Check Sheets for Vendors: What to Ask, and How
- Questions to Ask Your Vendor: Telling a Good Answer from a Worrying One
- Drawing the Line: Demarcating Responsibility Between Hospitals and Vendors
- Writing SLAs and Responsibility Boundaries: Why Uptime Alone Is Not Enough
- Supply Chain Risk for Hospitals: Seeing the Suppliers You Cannot See
- Selecting a Cloud Provider: Seven Things a Hospital Must Check
- Securing Remote Maintenance: Managing Vendor Support Connections
- Outsourcing Guideline Compliance: What Can and Cannot Be Delegated
- Guideline Compliance When Using the Cloud
- Security Requirements for EMR Replacement: Migration Is the Dangerous Window
- Putting Security into Your Procurement Requirements for Medical Information Systems
- ISMS for Healthcare SaaS: Assessing Multi-Tenant Risk
- ISO 27017 and ISO 27018: The Cloud Add-Ons to ISO 27001
- Cloud Security for Medical Institutions: Shared Responsibility, the Three-Ministry Guidelines, and Zero Trust
Frequently asked questions
By when must the FY2026 cybersecurity checklist be completed?
The checklist asks institutions to answer "yes" to every item within FY2026 and to write a target date for any "no" item. It is reviewed during on-site inspections under the Medical Care Act.
Related articles
Which documents are checked in person during inspections?
According to the checklist manual, four items are checked in person: the device inventory (2-1), the incident contact chart (3-1), the cyber-attack BCP (3-3), and the operating rules (4-1).
Is two-factor authentication mandatory for all systems from April 1, 2027?
No. Two-factor authentication, or equivalent measures, is required when systems expected to be in operation as of FY2027 (as of April 1, 2027) are newly introduced or updated. If that is difficult for technical reasons, the deadline is the next system update in FY2027 or later. It applies to client application logins and server OS logins.
What changed in version 7.0 of the guidelines?
According to the MHLW notice of June 29, 2026, the main changes include a new volume for institutions that outsource maintenance, references to the Basic Act on Cybersecurity and supply chain risk, removal of the periodic password change requirement, and clarification of two-factor authentication targets.
Related articles
Must small clinics without IT staff read the entire guidelines?
Version 7.0 adds a volume for institutions that outsource maintenance. Those that outsource security updates for all servers (including via cloud services) are deemed compliant with the other volumes by following this volume.
Do medical institutions need an ISMS?
The overview volume of version 7.0 states that institutions are expected to build and operate an ISMS to implement and improve safeguards continuously. This concerns the management system itself, not mandatory ISO/IEC 27001 certification.
Security support for medical institutions and healthcare companies
We support three-ministry guideline compliance, risk assessment, and ISMS (ISO/IEC 27001) certification, specializing in healthcare.
We will respond to your inquiry within 2 business days.