Combining HKZ and NEN 7510
HKZ secures the quality of your care, but does not cover information security. That is what NEN 7510 is for: the Dutch standard for information security in healthcare, based on ISO 27001 . Both standards can be combined well in one management system, which saves a considerable amount of duplicated work. You can find more about NEN 7510 at NEN . The HKZ standards are managed by NEN .
As a care organisation, you work daily with sensitive patient data. HKZ tells you how to organise care well. NEN 7510 tells you how to protect that data. You need both; they complement each other.
What does HKZ cover and what does it not?
HKZ focuses on the primary care process and the organisation around it. The requirements of the HKZ standard cover client safety, record keeping, incident reports and the PDCA cycle for quality improvement.
What HKZ does not regulate:
- How you protect patient data against unauthorised access.
- How you deal with a data breach.
- Which technical measures you take for your ICT systems.
- How you manage access rights.
That last set falls under information security, which is the domain of NEN 7510.
What is NEN 7510?
NEN 7510 is the Dutch standard for information security in healthcare. The standard is based on ISO 27001, but is specifically tailored to the healthcare sector. NEN 7510 describes which security measures a care organisation must take to protect patient data.
A useful point: NEN 7510 is available free of charge via NEN Connect, funded by the Ministry of Health, Welfare and Sport (VWS). You do not need to buy the standard to read it.
The GDPR (AVG, the General Data Protection Regulation) states what you must do: protect personal data appropriately. NEN 7510 explains how to set that up. You can read more about this relationship at NEN 7510 and the GDPR.
Why both standards?
Care organisations handle special category personal data: medical records, treatment plans, medication details. The GDPR obliges you to protect that data appropriately. But the GDPR does not give instructions on how.
NEN 7510 fills that gap. The standard gives concrete measures for the confidentiality, integrity and availability of care data.
Practical example: mental health care (GGZ). An outpatient mental health care provider is HKZ-certified. During an internal check, it turns out that employees can view each other’s treatment records, even when they have no treatment relationship with the client. HKZ requires that records are up to date; NEN 7510 ensures that only authorised employees have access to them. Both standards are needed to complete the picture. Read more on the page NEN 7510 for mental health care providers.
Tackling HKZ and NEN 7510 together
The two standards overlap on a number of points. That is an advantage: you build one management system that meets both.
| Aspect | Covered by HKZ | Covered by NEN 7510 |
|---|---|---|
| Quality of the care process | Yes | No |
| Client safety and incidents | Yes | No |
| Record keeping (content) | Yes | No |
| Access to records (security) | No | Yes |
| Confidentiality of patient data | No | Yes |
| Availability of ICT systems | No | Yes |
| PDCA cycle and improvement | Yes | Yes |
| Management review | Yes | Yes |
| Internal audit | Yes | Yes |
| Risk management | Yes | Yes |
The overlapping elements (PDCA, management review, internal audit and risk management) only need to be set up once. Your management system carries both HKZ and NEN 7510.
One integrated management system for HKZ and NEN 7510 saves work. You hold one management review, one internal audit cycle and one risk analysis. Only the specific content differs per standard.