ISO 9001:2026 certifies a health facility’s management system, not its clinical outcomes, and the 2026 edition makes that system harder to fake and easier to run. The requirement that top management promote quality culture and ethical behaviour (5.1.1 i)), with staff aware of it (7.3 e)), is the standard’s version of a patient-safety culture: will a nurse report a near-miss and be supported? Risks including disruption to care must be analysed (6.1.2), opportunities evaluated (6.1.3) and changes such as a new hospital information system communicated, monitored and reviewed (6.3 e) to g)). DOH licensing and ISO 15189 accreditation remain separate tracks. ISO 9001:2015 certificates are valid until 30 September 2029.
Gap assessment, documentation update, training, internal audit and support through your transition audit, delivered end to end by our expert, experienced, professional and friendly local Filipino lead auditors.
Key facts for health facilities
- ISO 9001:2026 was published on 16 September 2026 as the sixth edition. It cancels and replaces ISO 9001:2015 and incorporates Amendment 1:2024 (climate change).
- Global ACI (successor to IAF and ILAC since 1 January 2026) issued Global ACI-TECH-3-TR 2029-09-30 (M): transition period to 30 September 2029; new and initial accredited certifications only to the 2026 edition from 31 March 2028.
- ISO 9001 is not a DOH licensing requirement. DOH Administrative Order No. 2012-0012 requires health facilities to have policies and procedures on a quality assurance programme and continuous quality improvement; ISO 9001 is one way to run that programme, not the mandated way.
- No new mandatory documents or records. Patient records, incident reports, calibration records and complaint files carry over.
- Sterling does not certify; accredited certification bodies do. We prepare facilities and audit them before the certification body arrives.
What ISO 9001 covers in a health facility, and what it does not
ISO 9001 certifies that the processes around care are defined, resourced, monitored and improved: admission and discharge, records, procurement, equipment maintenance and calibration, laboratory and imaging workflow, pharmacy, sterile supply, complaints and incident learning. It does not certify clinical judgement or outcomes, and no accredited certificate should be presented as if it did. That boundary is what keeps the certificate credible with regulators and patients.
The regulatory context is worth stating plainly. Hospitals and other health facilities operate under a DOH licence to operate issued through the Health Facilities and Services Regulatory Bureau and the regional offices, under DOH Administrative Order No. 2012-0012 and its supplements, which classify facilities and require each one to have policies and procedures on a quality assurance programme and continuous quality improvement. ISO 9001 does not replace the licence and is not named in the order; it is a recognised way to build the quality programme the order asks for, with the added value of an independent audit. PhilHealth, HMOs, referring physicians and the local government unit are interested parties whose requirements you must identify (4.2 a) and b)) and then, new in 2026, decide whether to address through the QMS (4.2 c)). ISO 13485 is a standard for medical device manufacturers, not for providers, and a diagnostic laboratory’s competence standard is ISO 15189, covered below.
Patient-safety culture is now a requirement, in the standard’s own words
5.1.1 i) requires top management to promote quality culture and ethical behaviour; NOTE 2 says these are reflected in shared values, attitudes, practices and actions; 7.3 e) requires persons working under the organisation’s control to be aware of them. In a hospital that is a patient-safety culture: the willingness of a nurse, technician or resident to report a near-miss, a wrong-dose catch or a specimen mix-up, and to be supported rather than blamed.
No document is required, and auditors will not accept one as evidence. They will ask a ward nurse, a medical technologist and the chief of clinics the same questions: what does this hospital expect of you when something goes wrong, what happened the last time you reported an error, and what did the hospital do with it? They will read incident reports for who filed them, and whether the people involved were the ones who reported. They will look at whether the morbidity and mortality conference, or the quality committee, discusses failures or only statistics. The 7.1.4 NOTE observes that social and psychological factors in the work environment can be influenced by the organisation’s quality culture and ethical behaviour, which is the standard’s acknowledgement that a hierarchical clinical setting shapes whether juniors speak. The 10.2.1 NOTE adds that customer complaints can be a source of nonconformities, so patient complaints must flow into corrective action rather than into customer relations alone. Philippine hospitals already run root-cause analysis on sentinel events; the 2026 edition asks leadership to make reporting safe enough that the events are known. The quality culture and ethical behaviour page sets out how to build that evidence in twelve weeks.
Traceability, calibration and preservation in care and diagnostics
Clause 8 is substantively unchanged, and its traceability, calibration and preservation requirements are where a health facility’s QMS meets patient safety most directly. 8.5.2 requires identification of outputs and their status, and controlled unique identification where traceability is a requirement; 7.1.5.2 requires calibration or verification of equipment used for measurements that must be trusted; 8.5.4 requires preservation of outputs during processing and delivery.
In practice: specimens are identified from collection to result, blood products and implants are traceable to the patient, and medication administration is recorded against the order (8.5.2). Analysers, infusion pumps, blood pressure monitors, sterilisers and imaging equipment are calibrated or verified against traceable standards, with records and a defined response when equipment is found out of tolerance, including a review of results already issued (7.1.5.2). Specimens, vaccines, reagents and blood are preserved through storage and transport, with cold-chain records (8.5.4). Patient property, which the 8.5.3 NOTE confirms includes personal data, is protected and the patient informed if it is lost or damaged. Nonconforming outputs (8.7), from a haemolysed sample to a mislabelled report, are identified, controlled and corrected with records of the decision and who made it. None of this has changed since 2015; the wording that requires the records has, from “retain” to “shall be available as evidence of”, and existing records satisfy it.
Laboratories: how ISO 9001 and ISO 15189 fit together
ISO 15189 is the international standard for the quality and competence of medical laboratories, and it is applied through accreditation, not certification. The Philippine Accreditation Bureau accredits medical laboratories to ISO 15189 and has been a signatory to the international arrangement for medical testing since 29 October 2019. ISO 9001 certifies a management system; ISO 15189 accreditation attests technical competence to produce valid results.
The two are complementary rather than competing. A hospital can certify its whole management system to ISO 9001 while its laboratory holds, or works towards, ISO 15189 accreditation; a stand-alone diagnostic centre may choose ISO 9001 for the organisation and ISO 15189 for the laboratory’s testing scope. The management-system elements of ISO 15189, including document control, nonconformities, internal audit and management review, align with the corresponding clauses of ISO 9001, so a laboratory that already runs ISO 15189 will find the ISO 9001 system mostly in place. What ISO 9001:2026 adds that ISO 15189 does not express in the same way is the leadership requirement on quality culture and ethical behaviour (5.1.1 i)), the separate treatment of opportunities (6.1.3) and the structured planning of changes (6.3). If a referring physician or a payer asks for “ISO certification of the laboratory”, clarify which they mean: accreditation of testing competence is ISO 15189, certification of the management system is ISO 9001, and the certificates are issued by different bodies under different rules.
Risks, opportunities and continuity of care
6.1.2 requires risks to be determined, analysed and evaluated, with actions proportionate to their potential impact on the intended results of the QMS, and its NOTE 1 names the ability to keep providing conforming services during and after a disruption. For a Philippine facility that means power failure during surgery, typhoon access, a supplier of oxygen or reagents failing, an information-system outage and a surge in demand.
Each entry needs a likelihood and consequence rating with a reason, a treatment decision, and an effectiveness check that feeds 9.1.3 e) and the management review under 9.3.2 g). The climate determination in 4.1 sits alongside; for most facilities the honest determination is that climate change is relevant through typhoon and flood exposure and power reliability, recorded as a determination, not an emissions inventory. Opportunities are now a sub-clause of their own (6.1.3): a new service line, telemedicine, a partnership with a referral network or an automated laboratory line must be analysed for benefit and feasibility, decided with a reason, and reviewed for effect under 9.1.3 f) and 9.3.2 h). 8.2.1 e) extends customer communication to information on contingency actions including disruptions, which for a hospital is what patients and referring physicians are told when a service is suspended.
Changing a hospital: a new information system, a new wing, a new service
6.3 requires changes to the QMS to be carried out in a planned manner, considering seven things: purpose and consequences, integrity of the QMS, availability of resources and information (c, strengthened), responsibilities, and, all new in 2026, how the change is communicated (e), how its effectiveness is monitored and evaluated (f) and how its results are reviewed (g). A hospital information system go-live is the textbook case.
Auditors will pick a recent change and ask who was told, what information the teams needed before it started, how the facility knew it was working, and where the result was reviewed. For a HIS migration that is the training plan and communication to wards, the data-migration checks, the post-go-live error rate, and the minute of the quality committee that reviewed it. The same discipline applies to opening a wing, adding a dialysis unit or outsourcing housekeeping, and to the transition to the 2026 edition itself, which is a planned change to the QMS and can be evidenced as one. Our planning of changes page sets out a one-page change plan that meets a) to g).
Interested parties and the management review agenda
4.2 c) is new: having identified the interested parties and their relevant requirements, the facility must decide which of those requirements the QMS will address. 9.3.2 c) is also new: changes in the needs and expectations of interested parties become a named management review input. For a health facility both are about DOH, PhilHealth, HMOs, patients and the medical staff.
The practical output is an interested-party table with a column that says whether each requirement is managed through the QMS, through the licensing function, through the medical staff bylaws or not at all, and a standing management review item that asks what changed this year in what regulators, payers and patients expect. New DOH circulars, changes to payer accreditation conditions and a change in referral patterns belong there. The management review also now reviews the effectiveness of actions on risks (9.3.2 g)) and on opportunities (9.3.2 h)) separately, and 9.1.3 e) and f) require the analysis behind each. Our management review inputs page has the full 2026 agenda.
Transition or first certification: the path for a facility
For a facility certified to ISO 9001:2015 the transition is an update: gap analysis, targeted updates to the policy, registers, change plan and review agenda, several weeks of culture evidence, one internal audit and one management review to the 2026 edition, then a transition audit at surveillance, recertification or a special visit once the certification body is accredited for the 2026 edition. For a facility certifying for the first time, build to the 2026 standard now.
The timing is set by Global ACI’s transition requirements. Certification bodies must complete their own accreditation transition by 30 September 2027, with some ready earlier; from 31 March 2028 new and initial accredited certificates can only be issued to the 2026 edition; and ISO 9001:2015 certificates lose validity after 30 September 2029. A hospital whose recertification falls in 2027 should ask its certification body in writing whether the visit can be conducted to the 2026 edition; one whose cycle runs to 2028 has a natural slot at the combined visit. The transition audit will review the changed requirements and any changes to the organisation’s context, and may be conducted remotely by ICT; for a hospital we recommend on site, because culture is observed on the ward. The transition checklist lists the steps.
How Sterling helps hospitals, clinics and laboratories
Sterling International Consulting has implemented and audited ISO 9001 in hospitals, multi-specialty clinics, dialysis centres and diagnostic laboratories across Luzon, the Visayas and Mindanao, from Makati, Cebu and Davao. We frame ISO 9001’s role conservatively, never as a clinical accreditation, and we build incident-reporting and culture evidence that a certification auditor will accept from interviews rather than from a policy.
Sterling Revise™ is the fixed-scope transition for certified facilities: week one documentation review and gap assessment against the ISO 9001:2026 standard, week two gap report with the number before you commit, weeks three and four plan, certification-body booking and first updates. For first-time certification we build to the 2026 edition from day one, sized to the facility, with the laboratory’s ISO 15189 path kept distinct where it applies. Call +63 977 815 1204, email info@iso-philippines.com or book a consultation.
Don’t take our word for it — read our clients’.
80+ verbatim client feedback letters → — searchable by standard and industry, quoted word-for-word from signed originals you can verify. And see the organizations we serve — Unilab, McDonald’s, SAP, GE, ZTE, JLL and more.
Plan your ISO 9001:2026 transition with Sterling
Free consultation for certified companies and first-timers · ISO 9001:2026 transition and implementation planning against the ISO 9001:2026 standard · itemized quotation within 48 hours. Call +63 977 815 1204, email info@iso-philippines.com, or book your slot →.
Frequently asked questions
Does ISO 9001:2026 certify clinical care or patient outcomes? No. It certifies the management system around care: processes, records, equipment, procurement, complaints, incident learning and improvement. Clinical competence and outcomes are the province of DOH licensing, professional regulation and clinical accreditation schemes. A certificate presented as proof of clinical quality misrepresents what an accredited certification body has audited.
Is ISO 9001 required by the DOH for a licence to operate? No. DOH Administrative Order No. 2012-0012 requires health facilities to have policies and procedures on a quality assurance programme and continuous quality improvement, and does not name ISO 9001. ISO 9001 is a recognised way to run that programme with an independent audit behind it. Confirm current licensing requirements with the Health Facilities and Services Regulatory Bureau.
What does the quality culture and ethical behaviour requirement mean in a hospital? That leadership promotes, and staff can describe, a culture in which reporting a near-miss or an error is safe and expected (5.1.1 i), 7.3 e)). Auditors test it by interviewing nurses, technologists and physicians with the same questions and by reading incident reports for who filed them. No policy document satisfies it on its own.
Our laboratory is ISO 15189 accredited. Do we still need ISO 9001? Not for the laboratory’s testing competence, which ISO 15189 accreditation attests. ISO 9001 certifies the management system of the organisation as a whole, and adds the 2026 leadership, opportunity and change-planning requirements. Many hospitals hold both: ISO 15189 for the laboratory’s scope of tests and ISO 9001 for the facility. They are issued by different bodies under different rules.
Does the climate-change requirement apply to a clinic? Yes, in the sense that 4.1 requires every organisation to determine whether climate change is relevant to its QMS and to record the decision. For most Philippine facilities it is relevant through typhoon, flood and power exposure, which then enters the analysed risk register under 6.1.2. No carbon accounting is required by ISO 9001:2026.
Is our ISO 9001:2015 certificate still valid? Yes, until 30 September 2029 under Global ACI-TECH-3-TR 2029-09-30 (M), provided surveillance audits continue. The transition audit can be combined with a surveillance or recertification visit once your certification body is accredited for the 2026 edition, which each body must complete by 30 September 2027. Ask yours for its date.
How much work is the transition for a facility already certified to 2015? An update rather than a rebuild: a gap analysis, updates to the policy (5.2.1 e)), the risk and opportunity registers (6.1.2, 6.1.3), the change-planning method (6.3) and the management review agenda (9.3.2 c), g), h)), leadership and staff work on culture (5.1.1 i), 7.3 e)), then one internal audit and one management review to the 2026 edition before the transition audit.
Read next
The ISO 9001:2026 playbook; quality culture and ethical behaviour in ISO 9001:2026; risks and opportunities in ISO 9001:2026; the transition checklist; ISO 9001:2026 internal audit services; and ISO 9001 certification in the Philippines.
Sources
ISO 9001:2026, Quality management systems — Requirements, sixth edition (published 16 September 2026): 4.1, 4.2 a) to c), 5.1.1 i) and NOTE 2, 6.1.2 and NOTE 1, 6.1.3, 6.3 a) to g), 7.1.4 NOTE, 7.1.5.2, 7.3 e), 8.2.1 e), 8.5.2, 8.5.3 and NOTE, 8.5.4, 8.7, 9.1.3 e) and f), 9.3.2 c), g), h), 10.2.1 NOTE. Global ACI-TECH-3-TR 2029-09-30 (M), Transition Requirements for ISO 9001:2026 (issue date 4 September 2026; announced 16 September 2026). ISO 15189, Medical laboratories — Requirements for quality and competence. DOH Administrative Order No. 2012-0012, Rules and Regulations Governing the New Classification of Hospitals and Other Health Facilities in the Philippines (18 July 2012). DTI Philippine Accreditation Bureau: ILAC MRA signatory status for ISO 15189 medical testing and ISO/IEC 17020 inspection, 29 October 2019 (DTI-PAB news, 6 November 2019).
Certified to ISO 9001:2015? Take the free ten-minute ISO 9001:2026 gap check, then let a local Sterling lead auditor turn your result into your transition plan.