Scope of analysis and verification for hospital certification

Responsibility: Healthcare Poland Audit and Certification Center.

Healthcare Poland Audit and Certification Center, offers a comprehensive analysis and verification of the compliance of hospitals with the requirements of the international standards of the Global Healthcare Systems Hub (GHSH).

The goal of the process is to classify the facility as a GHTC-compliant provider, allowing the hospital to be included in the international medical tourism network.

1 GHTC compliance analysis and verification

The certification process will begin with a detailed analysis of the hospital’s operations in the following key areas:

(a) Compliance with RODO regulations and patient rights.

• Verification of patient data management systems, including medical records, for compliance with the European Regulation on the Protection of Personal Data (RODO).
• Evaluate procedures in place to ensure compliance with patient rights, such as the right to privacy, transparency of treatment processes and patient consent to data processing.

(b) Data security in accordance with NIS2

• Audit of the hospital’s IT infrastructure in terms of protecting medical records and securing data from cyber threats.
• Verification of encryption systems, access management and incident response plans in accordance with NIS2 requirements.

(c) Coding and interoperability standards

• Evaluate the medical record coding standards in use to ensure data interoperability, which is key in international patient circulation.
• Verify compliance with global standards, e.g. HL7, DICOM, ICD-10, which are required under GHTC.

(d) Quality of medical services

• Evaluation of clinical and organizational processes in the context of international quality standards, such as JCI (Joint Commission International) or ISO 9001 accreditations.
• Audit of procedures for receiving international patients, including service in foreign languages, access to translation, and processes for reporting and resolving complaints.

2 Proposed implementation model if deficiencies are identified

If the analysis reveals any gaps in compliance with GHTC requirements, the Center offers support in implementing appropriate corrective actions, which include:

(a) Planning corrective actions

• Preparation of a detailed plan to implement the missing items in accordance with international standards.
• Training of staff on GHTC standards and implemented procedures.

(b) Technical and operational support

• Implementing or upgrading IT systems to ensure compliance with data security and interoperability requirements.
• Development of internal documentation and policies in compliance with GHTC requirements, including data protection and quality management policies.

(c) Monitoring and pre-audit

• Conduct regular follow-up audits to assess the progress of implementations and prepare the facility for full certification.

3 Post-certification support

Once certified in accordance with GHTC requirements, the Center offers additional operational support to maximize the benefits of being part of the GHTC network:

(a) Collaboration with GHTC agents and networks

• The Center supports the process of establishing partnerships with agents and medical tourism brokers that provide access to international patients.
• Facilitate the hospital’s integration with GHTC platforms and recommender systems that refer patients to certified facilities.

(b) Direct patient referral

• Mediating the referral of international patients to the hospital through partner networks.
• Promoting the hospital as a facility that meets the highest quality standards in international rankings and on GHTC platforms.

(c) ESG strategy development (optional).

• Supporting the hospital in the development of a sustainability strategy, which further strengthens the image of the facility in terms of social and environmental responsibility.

The certification process conducted by the Healthcare Poland Audit and Certification Center provides a professional approach to analysis, implementation and operational support. Once successfully certified, the hospital will be fully prepared to provide services within the framework of the GHTC organization, which will open up new opportunities for international cooperation and increase accessibility for patients from all over the world. If you have any questions, we remain at your disposal and are ready to provide details of the process and quote the cost of the Certification.

Organisational recommendations for cross-border and medical tourism wards

The checklist below summarises the organisational requirements verified by CAC HCPL during the gap analysis of a facility preparing to serve international patients. It is the operational core of the TQAMS standard.

• Place of service – a separate ward (or sub-ward) that does not simultaneously deliver the NFZ contract, entered into the RPWDL register with the appropriate code, included in the organisational bylaws and approved by the Social Council.
• Medical staff – compliance with the Ministry of Health regulation on guaranteed inpatient services; on duty, combining with other wards is possible.
• Nursing staff – at least one nurse with a command of English present at all times.
• Other staff – physiotherapist and care assistants proportional to the nursing team, with the scope depending on the clinical profile.
• Medical consultations – guaranteed access to the necessary specialist consultations in English, secured by contract clauses covering hours other than NFZ hours.
• Diagnostics and equipment – access to the required laboratory and imaging examinations, with reports issued in English.
• Ward standard – single rooms with a private bathroom.
• Medical documentation – questionnaires, consent forms with a description of the procedure and discharge summaries in Polish and English; extended consents (e.g. blood transfusion) in English.
• Operating theatre – organisationally separated so that it does not collide with services contracted by the NFZ (a separate theatre or separate hours).
• Pricing – a price list covering all possible services, including the management of complications and, where relevant, storage and transport of remains.
• Patient information – patient rights charter and ward rules in English, preferably available online.
• Recommended – an orientation video of the ward and a video describing the procedure in English; staff ID badges with photograph and role in English.

Cross-border healthcare under Directive 2011/24/EU

Cross-border healthcare is a regulated market, not a marketing exercise. Directive 2011/24/EU gives EU citizens the right to be treated in another Member State and to be reimbursed under the rules of their country of affiliation. CAC HCPL helps Polish providers translate that legal framework into working organisational practice.

Two routes for planned treatment

• S2 route – the public insurer covers the treatment directly at a public provider, after prior authorisation has been granted.
• Pay and claim – the patient pays and applies for reimbursement; this route also covers private providers, but reimburses only up to the tariff level of the insuring country.
• Prior authorisation is frequently required for treatment involving an overnight stay or highly specialised equipment. Without S2 the patient may be treated as a private patient and pay private prices, while reimbursement stays limited to public tariffs.

National Contact Points

Every Member State operates at least one National Contact Point that explains reimbursement rules, prior authorisation, the registration status of the provider, quality and safety standards and the complaint and redress path. Providers that want to serve EU patients must be able to answer the same questions in a documented and verifiable way.

Key sources

• Directive 2011/24/EU on patients’ rights in cross-border healthcare (EUR-Lex)
• European Commission – Cross-border healthcare
• National Contact Point in Poland (NFZ)
• European Health Data Space (EHDS)
• RPWDL – Polish register of healthcare providers

• Directive 2011/24/EU on patients’ rights in cross-border healthcare (EUR-Lex)
• European Commission – Cross-border healthcare
• National Contact Point for cross-border healthcare in Poland (NFZ)
• European Health Data Space (EHDS)
• RPWDL – Polish register of healthcare providers

• Operating theatre – organisationally separated so that it does not collide with services contracted by the NFZ: a separate theatre or separate hours of service.
• Medical staff – compliance with the Ministry of Health regulation on guaranteed inpatient services; combining duties with other wards is possible during on-call hours.
• Supporting staff – physiotherapist and care assistants proportional to the nursing team, with the scope depending on the clinical profile.
• Equipment – a clear answer to whether the equipment is dedicated or shared with the NFZ contract, and to its funding origin (e.g. KPO co-financing).
• Formalities – entry in the RPWDL register kept by the voivode, amendment of the organisational bylaws by the director and the consent of the Social Council.
• Redress – complaint handling and alternative dispute resolution (ADR) available to the patient after returning home.

• Organisational requirements – place of service and infrastructure.
• Staffing requirements – medical, nursing and supporting staff, including language competences.
• Medical documentation – mandatory bilingual (PL/EN) clinical and organisational documents, price list, emergency and risk-management procedures.
• Quality and safety – compliance with Directive 2011/24/EU, patient information standards, complaint handling and alternative dispute resolution.
• Cybersecurity and resilience – protection of patient data and continuity of IT systems in line with NIS2.

• Centrum Monitorowania Jakości w Ochronie Zdrowia (CMJ) – national hospital accreditation in Poland.
• Joint Commission International – standards, accreditation and certification programmes.
• Clinical risk management, tracer methodology and event-reporting culture as the operational backbone of any accreditation programme.

Cybersecurity and data protection

• NIS2 – Directive (EU) 2022/2555
• GDPR – Regulation (EU) 2016/679
• ISO/IEC 27001 – information security management; ISO/IEC 20000 – IT service management
• KSC / UKSC – Polish National Cybersecurity System Act of 5 July 2018 (zero audit, documentation, Art. 15 audit)

Quality, medical devices and continuity

• ISO 9001 – quality management systems
• ISO 13485 – quality management for medical devices; ISO 22301 – business continuity
• ISO 14001 – environmental management; ISO 45001 – occupational health and safety
• ISO 31000 – risk management; COSO – internal control framework
• MDR – Regulation (EU) 2017/745
• 5S / Lean – audits of work organisation (Seiri, Seiton, Seiso, Seiketsu, Shitsuke)

ESG, accessibility and emerging technologies

• ESG reporting and sustainability compliance
• WCAG 2.1 / 2.2 and the European Accessibility Act (Directive (EU) 2019/882)
• SDAI – Standard Dostawcy AI w Ochronie Zdrowia, the HCPL certification programme for AI suppliers
• Internal and clinical audit – IIA standards, IT audit (CISA/ISACA methodology), managerial control in the public sector

• Cybersecurity – ISO 27001 / ISMS, NIS2 and DORA, critical infrastructure, IT security audit, incident management, GDPR, Data Protection Officer.
• Audit and control – internal audit (IIA), IT audit (CISA/ISACA), clinical and medical audit, quality audit (ISO 9001, ISO 13485), managerial control, GRC systems.
• Compliance and ethics – compliance systems, business ethics, anti-corruption, SOX, healthcare compliance (MDR, accreditation).
• Risk management and GRC – ERM, ISO 31000, COSO, operational, IT and clinical risk, ESG risk, antifragility and organisational resilience.
• Quality and healthcare – ISO 9001, ISO 13485, ISO 22301, MDR, hospital accreditation (JCI, CMJ), clinical risk management.
• IT governance – CGEIT/COBIT, process management, IT procurement, digital transformation and change management.
• Digital accessibility – WCAG 2.1/2.2, accessibility declarations, automated and manual testing, European Accessibility Act compliance.

Related pages

• Medical Tourism at Healthcare Poland
• Cyber Coalition CyberC4HE – NIS2 and hospital cybersecurity
• Value Streams – all HCPL competence centres
• Contact Healthcare Poland Foundation
• Polish Hospital Federation (PFSz)