ISO Certification for Hospitals: Standards, Certification vs Accreditation and Steps

An ISO certified hospital is one where an independent certification body has audited a management system against an ISO standard and issued a certificate. The standard is most often ISO 9001 for quality management. ISO writes the standards but does not certify anyone. In India, certification bodies are themselves accredited by NABCB, medical laboratories are accredited to ISO 15189 by NABL, and hospitals as a whole are accredited by NABH. This guide covers which ISO standards hospitals actually use, how certification differs from accreditation, how ISO compares with NABH, and the steps to certification.

What ISO certification means for a hospital

The International Organization for Standardization (ISO) is a network of 177 national standards bodies, one per country. India’s member is the Bureau of Indian Standards (BIS), a founder member of ISO. ISO standards are developed by technical committees. Several of these work on healthcare, including ISO/TC 304 on healthcare organisation management, ISO/TC 212 on medical laboratories and in vitro diagnostic systems, and ISO/TC 215 on health informatics.

Three points are worth knowing before you start:

• ISO does not issue certificates. ISO states that it does not perform certification. Certificates come from external certification bodies, and no organisation can be “certified by ISO”.
• A certificate covers a defined scope. A hospital may certify the whole organisation or only part of it, such as diagnostics, pharmacy or the sterile services department. Always read the scope printed on the certificate.
• Not every ISO standard can be certified. Certification applies to “requirements” standards such as ISO 9001. Guidance standards, such as ISO 31000 on risk management, are used to shape good practice rather than to certify against.

ISO standards hospitals use

No single ISO standard covers a whole hospital’s clinical work. Hospitals pick the management system standards that fit what they want to control:

ISO 9001: quality management

ISO 9001 is the most common certification in hospitals because it applies to any organisation. It requires a documented quality management system with leadership commitment, defined processes, risk-based planning, internal audits, management review and continual improvement. It also requires organisations to monitor customer satisfaction, which for a hospital means patients and their families.

ISO published a new edition, ISO 9001:2026, on 16 September 2026, replacing ISO 9001:2015. ISO says it improves clarity and puts more emphasis on leadership, a culture of quality, ethical behaviour, and risks and opportunities. Certificates issued against the 2015 edition stay valid during a transition period, so ask your certification body when you need to move to the new edition.

ISO 7101: quality in healthcare organisations

ISO 7101:2023, Healthcare organization management: Management systems for quality in healthcare organizations: Requirements, is ISO’s first management system standard written specifically for healthcare. It was developed by ISO/TC 304. It asks for people-centred care, attention to patient and workforce safety and wellbeing, and monitoring of clinical and non-clinical performance. Because it is written as requirements, hospitals can seek certification against it. Check that a certification body is accredited for this standard before you commit.

ISO 15189: medical laboratories

ISO 15189:2022, Medical laboratories: Requirements for quality and competence, covers both the lab’s management system and its technical competence, and now includes point-of-care testing. Labs are accredited against it, not certified. In India the accreditation body is NABL (National Accreditation Board for Testing and Calibration Laboratories). Our NABL audit checklist walks through the requirements.

Environment, safety, information and energy

• ISO 14001 (current edition ISO 14001:2026, published April 2026) helps a hospital manage its environmental impact. It sits alongside, not in place of, legal duties such as the Bio-Medical Waste Management Rules, 2016. See our biomedical waste management guidelines and our guide to sustainable healthcare practices.
• ISO 45001:2018 covers occupational health and safety for staff, contractors and visitors. A revised edition is being developed to replace it.
• ISO/IEC 27001:2022 covers information security, which matters as more records move into hospital information systems and onto ABDM. It complements, but does not replace, compliance with the Digital Personal Data Protection Act, 2023. NABH’s Digital Health Standards for hospitals cover similar ground for hospital IT.
• ISO 50001:2018 sets up a system for improving energy performance.

One standard often confused with these is ISO 13485:2016, the quality management standard for medical devices. It is meant for device manufacturers and suppliers, not for hospitals that use the devices.

Certification vs accreditation

The two words are often mixed up, and searches for “ISO accreditation for hospitals” usually mean certification. ISO defines them like this:

• Certification is written assurance (a certificate) from an independent body that a product, service or system meets specific requirements.
• Accreditation is formal recognition by an accreditation body that a certification body, laboratory or inspection body is competent to do its work.

In India, three boards of the Quality Council of India cover the pieces that matter to hospitals:

• NABCB (National Accreditation Board for Certification Bodies) accredits management system certification bodies against ISO/IEC 17021-1:2015. It is a signatory to the international mutual recognition arrangements for accreditation, so certificates from NABCB-accredited bodies are recognised by other signatories.
• NABL accredits testing and calibration laboratories, including medical laboratories against ISO 15189.
• NABH accredits hospitals and other healthcare providers against its own healthcare standards. Here “accreditation” means the hospital itself is assessed, not a certification body.

ISO notes that accreditation of certification bodies is not compulsory. A certificate from an accredited body still gives you independent confirmation of the certifier’s competence, so check for the accreditation mark and verify the certificate with the certification body.

ISO vs NABH accreditation

For most Indian hospitals the choice is not ISO or NABH. The two do different jobs:

NABH puts it plainly in its international FAQs: ISO 9000 is a generic management system certification and is not written specifically for healthcare. NABH’s hospital standards cover clinical care in depth. The 6th edition has 10 chapters and 639 objective elements, and it cites ISO technical standards where they apply, such as ISO 7396-1 for medical gas pipeline systems.

ISO certification is most useful where NABH is not designed to certify. Examples are information security, environmental or energy management, a single support service, or a hospital that wants a management system discipline before it is ready for NABH. Hospitals heading for accreditation should read our guide to the NABH accreditation process. Those weighing international options can compare JCI accreditation standards.

How a hospital gets ISO certified

The route is similar for every management system standard, because certification bodies follow the same audit rules (ISO/IEC 17021-1):

1. Choose the standard and scope. Decide whether you are certifying the whole hospital or specific departments or sites.
2. Run a gap analysis against the standard’s requirements.
3. Build the management system: policy, objectives, process descriptions, risk assessment and the documented information the standard requires.
4. Train staff and run the system long enough to produce records, such as audits, corrective actions and patient satisfaction data.
5. Hold an internal audit and a management review and act on what they find.
6. Select an accredited certification body. Compare a few, check their accreditation covers your standard and sector, and agree the audit days and fees.
7. Complete the certification audit in two stages: stage 1 reviews documentation and readiness, stage 2 checks that the system works in practice.
8. Close any nonconformities, after which the certificate is issued for three years.
9. Keep it up through surveillance audits in years one and two, and a recertification audit before the certificate expires.

Costs depend on the certification body, the hospital’s size, the number of sites and the scope, so get written quotations rather than relying on published price lists.

Benefits and limits

Done well, ISO certification gives a hospital lasting habits: written processes, regular internal audits, management reviews and a corrective action system. These habits also help with NABH. Our guide to methods to maintain quality in hospitals covers how these fit with clinical governance.

The limits are real too. ISO 9001 does not judge clinical competence or outcomes. A certificate is only as credible as the body that issued it, and a narrow scope can make a hospital look more certified than it is. The common failure is a system that exists on paper for the auditor but not on the wards.

Patient experience is one area where ISO and NABH ask for the same evidence: proof that you listen to patients and act on what they say. A patient feedback system for hospitals such as LazyMonkey collects ward and discharge feedback through QR codes. It gives you the satisfaction records and trend reports that ISO 9001 audits and NABH assessments look for.

Frequently Asked Questions