ISO standards, in health care: an integrated review of theoretical foundations, legal framework, empirical evidence, and health policy implications

Abstract

Background. ISO standards, notably ISO 9001, ISO 15189 and ISO 13485, have been applied in health-care settings for more than three decades. Despite broad adoption and an increasingly dense regulatory landscape, a synthesis integrating theoretical foundations, legal frameworks, empirical evidence, and implementation contexts remains lacking. Objectives. This integrated review aims to: 1) situate ISO certification within quality and safety science; 2) analyse EU and national legal frameworks defining the role of ISO standards in health care; 3) provide a synthetic appraisal of evidence on process and clinical outcomes, incorporating recent literature (2000–2024); and 4) formulate health policy recommendations. Material and methods. A language-unrestricted search of MEDLINE, Embase, and Web of Science (key words: “ISO certification”, “quality management”, “patient safety”, “health care quality”; years 2000–2024) was supplemented by searches of EUR-Lex, the Polish Legal Acts Internet System (ISAP), and WHO, ECDC, and OECD documents. Findings. ISO certification is grounded in the Donabedian triad, sociotechnical systems theory, and Reason’s systemic error model. The EU legal framework, notably MDR Regulation 2017/745, IVDR Regulation 2017/746, and Directive 2011/24/EU, renders ISO compliance de facto mandatory in key health-care domains. Current empirical evidence confirms reductions in adverse events in certified facilities, though causal inference remains constrained by selection bias and cross-cultural heterogeneity. Interpretation. ISO constitutes a valuable but insufficient quality management instrument. Its effectiveness depends on integration with just culture principles, adverse event reporting systems, and external clinical audits.