HISF 2022 compliance gap analysis: what NZ health sector audits miss
Sienna VanceApril 29, 2026
Key takeaways
HISF 2022 requires continuous logging and audit trail integrity, but assessments of NZ healthcare environments consistently find logging gaps on clinical devices that internal reviews marked as compliant.
The HISF framework audit methodology focuses on policy documentation, which means organisations with weak technical controls can pass self-assessments while remaining exploitable.
Access control drift is the most common finding in HISF gap analyses: accounts with elevated privileges that were provisioned for a project and never revoked, often 12 to 24 months old.
Regulatory exposure under the Privacy Act 2020 increases materially when HISF control failures intersect with health data: the Office of the Privacy Commissioner treats absent audit trails as an aggravating factor in breach investigations.
A HISF 2022 gap analysis conducted by an external party finds an average of 3 to 4 more control failures than the same organisation's self-assessment, based on Vulnox assessment data across NZ health sector engagements.
TL;DR
HISF 2022 is a serious framework with specific technical obligations that most NZ healthcare organisations are not fully meeting. The gap is not usually wilful. It is structural: self-assessments measure policy existence, not control effectiveness. External gap analysis consistently finds logging failures, unmanaged devices, and privilege accumulation that internal teams did not know existed. The regulatory consequence of those gaps, if a breach occurs, is worse than the remediation cost.
What a passing self-assessment looks like from the outside
A regional DHB-affiliated organisation completed its annual HISF self-assessment in late 2024. Governance policies: documented. Access control procedures: documented. Incident response plan: documented. The compliance officer signed off with minor findings. Three months later, an external assessment found 14 clinical devices with no centralised logging, six accounts with Domain Admin privileges belonging to staff who had left the organisation, and a network segment running imaging equipment that had not received a patch since 2021. None of this contradicted the self-assessment. The self-assessment never checked for it.
This is the structural problem with HISF 2022 gap analysis when it is conducted internally: the methodology measures what the organisation believes it has implemented, not what is actually running in the environment. The HISF framework is specific about technical control requirements. The audit methodology is not equally specific about how compliance with those controls is verified. That gap is where the real risk lives.
Why HISF 2022 technical controls fail without breaking documentation
HISF 2022 organises its requirements across security domains including governance, access control, device management, logging and monitoring, and incident response. Each domain has defined controls. The compliance question most organisations answer is: does a policy or procedure exist that addresses this control? The question that determines actual security posture is different: is the control operating as intended, consistently, across every asset in scope?
Those two questions produce different answers far more often than they should. A logging policy exists. Logging is not configured on the imaging VLAN because the team that set it up three years ago did not have access to the SIEM. An access control procedure exists. Privilege accumulation has been running silently since the last restructure because no one owns the quarterly access review that the procedure describes.
The HISF framework's evidence requirements, as written, are satisfiable with documentation. Regulators and external assessors look at different evidence: actual log data, active directory exports, patch history, network topology. The distance between those two evidence sets is where compliance theatre lives.
Example
One clinical network assessed in 2024 had a fully documented device management policy including onboarding checklists and lifecycle tracking requirements. The asset inventory in that policy listed 340 devices. Active scanning found 412. The undocumented 72 included legacy infusion pumps, a decommissioned radiology workstation still active on the network, and 14 tablets provisioned during a telehealth pilot that was formally ended 18 months prior. None were patched. None were logging. All were reachable from the clinical staff network segment.
Device discovery in healthcare environments is complicated by the mix of IT and OT asset types, vendor-managed equipment with restricted access, and VLAN segmentation that is often inconsistently maintained. Standard IT asset discovery tools miss embedded clinical devices regularly. HISF compliance that relies on a manually maintained asset register without active validation will undercount scope by a meaningful margin in most environments.
What external HISF gap assessments find that internal reviews miss
Assessment base: Vulnox assessment data, NZ health sector engagements, 2023 to 2025
Logging coverage gaps on clinical and IoT devices
In assessments of NZ health sector organisations, logging was absent or incomplete on clinical devices in every environment where the asset inventory had not been validated by active scanning. The pattern: central SIEM configured and operational, log sources defined, but the defined sources matched the documented asset list rather than the actual network population. Devices onboarded outside the standard IT process, including vendor-managed equipment and telehealth endpoints, were consistently outside log scope.
Under HISF 2022, logging and monitoring obligations apply to systems processing or transmitting health information. A device that processes health data and does not log is a compliance failure regardless of what the policy says. More directly: if a breach involves that device, the absence of logs is the first thing a Privacy Commissioner investigation will note. Incomplete audit trails shift the burden of proof onto the organisation.
Privilege accumulation across clinical and administrative accounts
Access control drift is consistent across organisations that do not run automated access reviews tied to HR events. The typical finding: accounts provisioned for a project, a temporary role, or a visiting clinician, with elevated privileges that were never revoked. In one assessment, 23 accounts with elevated privileges belonged to individuals who were no longer employed by the organisation. The oldest had been inactive for 31 months. In another, a shared account used during a system migration had not been disabled and retained write access to a core clinical database.
HISF 2022 requires access controls to enforce least privilege. An account with privileges beyond what the current role requires is a control failure, not a configuration oversight. The compliance framing matters here: if that account is compromised, the organisation cannot demonstrate that access controls were functioning as the framework requires.
Incident response plans that have never been tested against a realistic scenario
HISF 2022 requires incident response capability, not just incident response documentation. In practice, most of the NZ health sector organisations assessed have a documented IR plan. Fewer than half have conducted a tabletop exercise in the preceding 12 months. Almost none have tested backup restoration under a scenario that resembles ransomware, meaning a scenario where primary systems are unavailable and the restoration process itself is under time pressure.
A plan that has never been tested is not evidence of incident response capability. It is evidence of intent. Regulators and cyber insurers are increasingly distinguishing between the two. When a breach occurs, the absence of documented testing becomes a factor in both the regulatory response and the insurer's coverage assessment.
Third-party and vendor access without compensating controls
Healthcare environments routinely grant remote access to equipment vendors, software support providers, and clinical system integrators. HISF 2022 requires that third-party access be managed with appropriate controls. In assessed environments, vendor access was frequently granted through persistent VPN accounts rather than session-based access, with no logging of what the vendor actually did during the session. In two cases, vendor accounts retained access after the support contract had ended.
Vendor access that is not session-scoped and logged creates a compliance gap and an attribution problem. If a breach originates through a vendor connection, the investigation requires log data that does not exist. The HISF framework's third-party requirements exist precisely because this vector is reliable and undermonitored.
The organisations with the most complete HISF documentation often have the largest technical gaps
Common belief
A thorough, well-maintained HISF compliance program with up-to-date policies and documented controls signals a mature security posture. Organisations that invest in governance documentation are assumed to have the underlying technical controls in place.
What we found
In assessed NZ health sector environments, the organisations with the most thoroughly documented HISF compliance programs showed no statistically meaningful difference in technical control effectiveness compared to organisations with lighter documentation. The technical findings, logging gaps, privilege accumulation, unmanaged devices, were present at similar rates regardless of documentation quality. The documentation told us what was intended. The environment told us what was running.
Documentation maturity and control effectiveness are not correlated in healthcare environments the way compliance programs assume they are. The reason is organisational: the teams responsible for documentation (compliance officers, risk managers) are not the teams responsible for technical implementation (IT operations, clinical engineering). When those teams do not communicate consistently, documentation reflects intent and the technical environment reflects operational reality, and the two diverge over time.
The specific failure mode: a well-documented HISF compliance program creates confidence that reduces scrutiny. Internally, if documentation is comprehensive and the self-assessment process is documentation-driven, the signal is positive. The actual control state is not being measured. Externally, if an audit relies on documentation review rather than technical testing, the same gap persists.
This is not a criticism of documentation. Governance documentation is necessary. The point is that documentation is a necessary but not sufficient condition for technical control effectiveness, and HISF gap analysis that treats documentation as the primary evidence source will miss the gap consistently.
The regulatory exposure when HISF controls fail
Privacy Act 2020 breach notifications to the Office of the Privacy Commissioner increased 34% between 2022 and 2024
Office of the Privacy Commissioner, Annual Report 2024. Health sector notifications represent the largest single category. The increase tracks the expansion of mandatory notification obligations, but also reflects improved detection, which is itself a product of better logging, making HISF logging requirements directly relevant to regulatory exposure.
Absent or incomplete audit trails cited as an aggravating factor in the majority of Privacy Commissioner determinations involving health data breaches
Office of the Privacy Commissioner case notes, 2022 to 2024. This is the direct regulatory consequence of HISF logging failures: when a breach investigation cannot reconstruct what data was accessed, the Commissioner treats the control failure as compounding the harm.
Average time from initial access to breach detection in NZ healthcare environments: estimated at 60 to 90 days
Consistent with global healthcare sector data from the IBM Cost of a Data Breach Report 2024, which found healthcare detection timelines among the longest of any sector. Extended dwell time in NZ health environments is attributable to the logging gaps described above.
What HISF 2022 gap analyses consistently overlook
Vendor-managed clinical equipment
Equipment under vendor management agreements is frequently excluded from scope in self-assessments on the basis that the vendor is responsible for security. HISF 2022 does not support this exclusion: the framework applies to systems processing health information, regardless of who manages them. Vendor-managed imaging, infusion, and monitoring systems are in scope. Their patching state, network connectivity, and logging configuration are the organisation's compliance responsibility.
Decommissioned systems still active on the network
Systems formally removed from asset registers but still powered on and network-connected are a consistent finding. They do not appear in compliance scope because they do not exist in documentation. They appear in network scans because they are reachable. In healthcare environments, these are frequently radiology workstations, clinical terminals, and administrative endpoints from previous refresh cycles.
Privileged access to cloud-hosted clinical systems
HISF gap analyses focused on on-premises infrastructure consistently miss access control drift in cloud-hosted clinical platforms. SaaS and IaaS environments used for patient data, clinical scheduling, and telehealth have their own identity and access management layers that are not always integrated into the organisation's centralised access review process. Privilege accumulation in these environments is invisible to reviews that only examine on-premises directory services.
Backup integrity under adversarial conditions
Backup documentation is treated as evidence of backup capability. Restoration has rarely been tested under realistic conditions, meaning conditions where primary systems are unavailable, not just conditions where a single file needs to be recovered. HISF 2022 incident response requirements imply operational continuity capability. An untested backup is not that.
What NZ healthcare organisations say before an external gap analysis, and what the assessment finds
We completed our HISF self-assessment last quarter and the findings were minor. We are confident in our compliance posture.
Root cause:Self-assessments measure documented intent. The confidence reflects documentation quality, not control effectiveness. In every case where this statement preceded an external assessment, the external assessment found material technical gaps that the self-assessment did not capture, because the self-assessment methodology did not include active technical testing.
Our vendor manages that equipment. HISF compliance for those systems is their responsibility.
Root cause:This reflects a contractual assumption that is not supported by the HISF framework. The framework places compliance obligations on the health organisation, not the vendor. Vendor agreements may include security commitments, but those commitments do not transfer HISF compliance responsibility. The equipment is in scope. Its controls are the organisation's problem.
We have a SIEM and we are logging everything.
Root cause:The SIEM is operational. The log sources defined in the SIEM match the documented asset list. The documented asset list understates the actual environment. Devices onboarded outside the standard IT process are not logging. 'Everything' means everything the team knows about, which in every assessed environment is a subset of everything that exists on the network.
We do not have the budget for a full external assessment every year.
Root cause:This is a real constraint. The response is not to argue the budget. It is to note that the cost of a Privacy Commissioner investigation, including legal representation, breach notification obligations, and remediation under regulatory direction, is structurally higher than the cost of an assessment that prevents it. The calculation changes when the comparison is explicit.
Where HISF 2022 compliance failures will surface next
By 2027, at least one significant NZ health sector breach will be traced to a vendor-managed clinical device that was outside compliance scope in the affected organisation's HISF gap analysis.
Vendor-managed equipment is consistently excluded from self-assessment scope. It is consistently reachable on clinical networks. It is consistently underpatched. The attack surface is established and the monitoring gap is documented. The breach has not happened yet at scale in NZ, but the structural conditions are identical to breach patterns in comparable international health environments.
Confidence: highA documented NZ health sector breach investigation that identifies vendor-managed clinical equipment as the initial access vector by end of 2027.The Office of the Privacy Commissioner will issue specific guidance on HISF audit trail requirements within 18 months, following a breach investigation where logging gaps prevented reconstruction of the data access timeline.
The Commissioner's current determinations already treat absent audit trails as aggravating. The logging gap in NZ healthcare environments is systemic and documented. As breach notifications continue to increase, the Commissioner will encounter this failure pattern repeatedly and respond with specific guidance, as comparable regulators in the UK and Australia have done.
Confidence: mediumOPC guidance or a formal determination explicitly referencing HISF logging obligations by mid-2027.
The self-assessment problem is structural, not a resource or intention problem
I do not think NZ healthcare organisations are negligent in their approach to HISF 2022 compliance. I think the gap analysis methodology that most of them use is structurally unsuited to finding technical control failures. A compliance officer reviewing documentation against a controls checklist is doing the job they were asked to do. They are not doing a technical assessment, and treating the output as equivalent to one is the error. The HISF framework is specific enough in its technical requirements that documentation-based self-assessment will always produce an optimistic picture of the actual control environment. That is not a criticism of the people conducting the review. It is a criticism of a methodology that conflates evidence of intent with evidence of effectiveness.
Counterargument
The counterargument is that external assessments are expensive and resource-intensive, and that smaller health sector organisations genuinely cannot afford annual external gap analysis. This is true and the constraint is real. The response is not to pretend documentation-based self-assessment is equivalent. It is to be specific about what a self-assessment can and cannot tell you, and to prioritise the highest-risk domains, logging, access control, and device management, for at least periodic technical validation even if full external assessment is not annual.
One thing to do this week
Pull your current HISF 2022 asset inventory and run an active network scan against the same scope. Compare the two lists. The delta, devices on the network that are not in your documented scope, is your starting point. Every device in that delta is outside your logging, access control, and patch management processes. Every one is a compliance gap and a potential breach vector. You do not need a full external assessment to find this. You need a scan and the willingness to look at what it returns.
Further Reading
Gap Analysis
framework gap analysisVulnerability Assessment
vulnerability assessment servicesNIST SP 800-30 Risk Assessment Guide
NIST risk assessment guideNIST Vulnerability Assessment Definition
NIST's vulnerability assessment definitionHow to Perform Gap Analysis
compliance gap analysis guide
Frequently Asked Questions
What does a HISF 2022 compliance gap analysis actually test that a self-assessment does not?
An external HISF 2022 gap analysis includes active technical testing: network scanning to validate asset inventory accuracy, log source verification against actual device populations, access control review using directory exports rather than documented procedures, and patch state validation on clinical and IoT devices. Self-assessments measure whether policies exist. External gap analysis measures whether controls are operating. In Vulnox assessments of NZ health sector organisations, external review finds an average of 3 to 4 additional material control failures compared to the preceding self-assessment.
What are the most common HISF 2022 control failures found in NZ healthcare environments?
The four most consistent findings are: logging gaps on clinical and vendor-managed devices not captured in the SIEM; privilege accumulation where accounts retain elevated access after role changes or departure; incident response plans that have never been tested under realistic conditions; and third-party vendor access that is persistent rather than session-based and not logged at the activity level. All four are technically verifiable during assessment and consistently missed by documentation-based self-review.
How does a HISF 2022 logging failure affect a Privacy Act 2020 breach investigation?
The Office of the Privacy Commissioner treats absent or incomplete audit trails as an aggravating factor in breach determinations. When an investigation cannot reconstruct what data was accessed, by whom, and when, the organisation cannot demonstrate that its access controls were functioning. The Commissioner's case notes from 2022 to 2024 show this cited in the majority of health sector breach determinations. The practical effect is that a logging gap that was a compliance failure becomes a compounding factor in regulatory exposure.
Is vendor-managed clinical equipment in scope for HISF 2022 compliance?
Yes. HISF 2022 applies to systems that process or transmit health information, regardless of who manages them. Vendor management agreements may include security commitments, but they do not transfer HISF compliance obligations from the health organisation to the vendor. Imaging equipment, infusion pumps, monitoring systems, and telehealth endpoints under vendor management agreements are in scope. Their patch state, network segmentation, and logging configuration are the organisation's compliance responsibility.
How often should NZ healthcare organisations conduct an external HISF gap analysis?
For organisations with complex clinical environments, vendor-managed equipment, or recent significant changes to network architecture or staff, annual external assessment is the appropriate baseline. For smaller organisations with genuine resource constraints, the minimum is active technical validation of the three highest-risk domains, logging coverage, access control, and asset inventory accuracy, on a cycle not exceeding 18 months. Documentation-based self-assessment alone does not produce evidence of control effectiveness under the HISF framework.
What is the fastest way to identify HISF 2022 compliance gaps without a full external assessment?
Run an active network scan against your documented asset inventory and compare the two lists. The delta, devices present on the network but absent from your documented scope, represents assets outside your logging, patch management, and access control processes. This takes hours, not weeks, and consistently surfaces the device management and logging gaps that self-assessments miss. It is not a substitute for full gap analysis but it is an immediate, actionable diagnostic that any IT team can execute.
What is the difference between HISF 2022 and the Privacy Act 2020 in terms of health data security obligations?
HISF 2022 is a technical security framework specifying controls for health information systems: access management, logging, device security, incident response. The Privacy Act 2020 is the legal instrument establishing mandatory breach notification and data protection obligations. They interact directly: HISF control failures increase Privacy Act breach risk, and when a breach triggers a Privacy Commissioner investigation, the state of HISF controls becomes evidence. An organisation with demonstrable HISF compliance gaps at the time of a breach faces compounded regulatory exposure under both instruments.
Related Articles
GovRAMP Moderate authorization: why the Significant Change Request process catches providers off guard
GovRAMP Moderate is the first tier where you need a government sponsor, annual 3PAO reassessment, and a Significant Change Request process that can pause normal product releases for months. Most providers who stall post-authorization were not prepared for what maintaining Moderate status actually costs operationally.
GovRAMP Low+ authorization: the impact level that punishes providers who get the CUI boundary wrong
GovRAMP Low+ is where providers handling limited Controlled Unclassified Information land — or discover they should not be there. The defining failure is not a missing control. It is a CUI boundary that was drawn before anyone asked what data the government actually sends through the system.
GovRAMP High authorization: why FIPS-validated crypto and personnel security controls catch providers off guard
GovRAMP High is where cloud providers discover that having strong encryption is not the same as having FIPS 140-2 validated encryption — and that distinction alone has derailed authorizations from vendors who passed every other control family. The architectural constraints at High are qualitatively different from every lower tier.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.