When you’re sharing sensitive medical records and case information with a service provider, you need to know that information is being handled securely and appropriately.
Certifications and recognised standards can provide assurance that a provider has the right processes and controls in place to manage quality, information security and cyber security. But the names themselves don’t always make it clear what they actually mean for you.
At MedBrief, our approach is backed by ISO 9001, ISO 27001 and Cyber Essentials Plus certifications, alongside the NHS Data Security and Protection Toolkit (DSPT).
So, what do these standards mean in practice?
ISO 9001
ISO 9001 is an internationally recognised standard for quality management systems.
It focuses on how an organisation manages its processes, monitors performance and continually looks for ways to improve the quality of the services it provides.
For our clients, this means MedBrief has established processes in place for how our services are delivered and managed.
This is particularly important when working with medical records, where consistency and accuracy matter throughout the process, from requesting and organising records to preparing chronologies and providing clinical services.
Put simply, ISO 9001 demonstrates that quality is built into the way we work.
ISO 27001
Clinical negligence and personal injury cases involve highly sensitive information, making information security an important consideration when choosing a provider.
ISO 27001 is an internationally recognised standard for information security management. It provides a framework for identifying information security risks and putting appropriate controls in place to manage them.
Achieving certification requires organisations to demonstrate that they have a structured approach to protecting the information they hold.
For MedBrief clients, this provides assurance that information security is managed systematically across the organisation and treated as an ongoing responsibility.
Cyber Essentials Plus
Cyber Essentials Plus is a UK government-backed certification focused on protecting organisations against common cyber threats.
Unlike the basic Cyber Essentials certification, Cyber Essentials Plus involves independent technical testing to verify that the required security measures are working effectively.
For legal teams trusting us with medical records and case information, this provides an additional level of assurance around the cyber security measures we have in place.
NHS Data Security and Protection Toolkit
MedBrief has also exceeded the 2025–26 standards of the NHS Data Security and Protection Toolkit (DSPT).
The DSPT allows organisations to measure their performance against data security and information governance requirements and demonstrate that they are appropriately protecting health and care information.
This is particularly relevant to the work we do at MedBrief, where we regularly handle sensitive medical information as part of clinical negligence and personal injury cases.
Exceeding the DSPT standards provides further assurance around the way we approach the security and protection of health and care data.
What does this mean for our clients?
Although each certification and standard covers a different area, together they demonstrate the wider approach we take to quality and security at MedBrief.
ISO 9001 demonstrates our approach to quality management.
ISO 27001 demonstrates how we manage information security.
Cyber Essentials Plus provides independently tested assurance around our protection against common cyber threats.
And our NHS DSPT status demonstrates our approach to protecting health and care information.
For our clients, this provides assurance that the processes and controls behind our services have been assessed against recognised standards, rather than relying solely on our own claims about quality and security.
Security across one platform
These standards form part of a wider approach to how we manage case information.
MedBrief brings medical record requesting, hosting, sorting and pagination, medical chronologies, Early Case Assessments and other services together through one secure platform.
Having these services connected means case information doesn’t need to be continually moved between separate providers and systems as work progresses.
Our platform is also fully auditable, providing greater visibility over activity and how case information is managed.
For legal teams, this means the convenience of having more of the process in one place is supported by recognised standards for quality, information security and cyber security.
More than a badge
Certifications can easily become a collection of logos at the bottom of a website. What matters is what sits behind them.
For MedBrief, ISO 9001, ISO 27001, Cyber Essentials Plus and our NHS DSPT status reflect the processes, controls and standards that support the way we work every day.
Whether you’re requesting medical records, accessing case information through our platform or instructing one of our clinical services, the same approach to quality and security sits behind the service.
Because when you’re trusting a provider with sensitive medical and case information, knowing how that information is managed matters.