ISO 27001 and NEN 7510: when do you need both?
You have ISO 27001 , or you are working towards it, and you supply services to healthcare. Then the question arises: do you also need NEN 7510 ? This page is written from your position as an IT or SaaS supplier. The short answer: increasingly, yes. Large healthcare providers require NEN 7510 from suppliers that process patient data, because the IGJ (Dutch Health and Youth Care Inspectorate) and the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) use the healthcare standard as a testing framework.
This is the comparison from an ISO 27001 starting point. Are you a healthcare organisation that still has to choose between the standards? Then read the main comparison NEN 7510 vs. ISO 27001 for healthcare.
When do you need NEN 7510 alongside ISO 27001?
NEN 7510 is the Dutch standard for information security in healthcare. It is based on ISO 27001, but adds healthcare-specific requirements for patient data. If your ISO 27001 certificate gives you a sufficient foundation depends on your clients and on what you process, and whether you must also demonstrate NEN 7510.
| Your situation | ISO 27001 | NEN 7510 too? |
|---|---|---|
| SaaS for healthcare, processes patient data | Foundation | Yes, often required |
| Hosting or management of healthcare systems | Foundation | Yes, often required |
| Tooling without access to patient data | Usually sufficient | Usually not |
| Clients outside healthcare | Sufficient | No |
The core point: as soon as you have access to patient data or process it, healthcare clients expect the healthcare-specific additions of NEN 7510 on top of your ISO 27001.
What is NEN 7510?
NEN 7510 was developed by the Netherlands Standardisation Institute (NEN) specifically for the healthcare sector. The standard describes how healthcare organisations must handle the security of health information.
NEN 7510 consists of several parts:
- NEN 7510-1: the management system (comparable to ISO 27001)
- NEN 7510-2: controls (comparable to ISO 27002)
- NEN 7512: trust framework for data exchange
- NEN 7513: logging of access to patient records
Legal status
NEN 7510 has a special status in the Netherlands. The Supplementary Provisions for Processing Personal Data in Healthcare Act (Wet aanvullende bepalingen verwerking persoonsgegevens in de zorg) refers to NEN 7510 as the standard that healthcare providers must meet.
This does not mean certification is legally mandatory. It does mean that the content of the standard applies as a benchmark. The IGJ and the Autoriteit Persoonsgegevens can use NEN 7510 as a testing framework.
For healthcare organisations, NEN 7510 is not optional. The standard is seen as the “state of the art” for information security in healthcare. If you do not comply and something goes wrong, that can have legal consequences.
The relationship between ISO 27001 and NEN 7510
NEN 7510 is not a separate standard. It is built on ISO 27001. The structure is identical, the terminology is largely the same, and many requirements match.
What NEN 7510 adds
NEN 7510 takes ISO 27001 as its base and adds healthcare-specific requirements:
Patient data as the starting point Where ISO 27001 speaks of “information” in general, NEN 7510 focuses specifically on health information. The risk assessment must take into account the particular sensitivity of medical data.
Specific controls NEN 7510 adds controls that are specific to healthcare:
- Logging of access to patient records (elaborated in NEN 7513)
- Identification and authentication of healthcare professionals
- Access management based on the treatment relationship
- Security of medical equipment
Chain collaboration Healthcare has complex chains: general practitioners, hospitals, pharmacists, insurers. NEN 7510 pays extra attention to the security of data exchange within this chain.
Patient rights Patients have the right to inspect their file and to information about who has viewed their data. NEN 7510 ensures that these rights are supported.
The overlap
Around 80 percent of NEN 7510 overlaps with ISO 27001. If you meet ISO 27001, you have a solid foundation for NEN 7510. The reverse also holds: whoever has NEN 7510 largely meets ISO 27001.
The management requirements are almost identical:
- Determining context and scope
- Leadership and policy
- Risk assessment and treatment
- Support and competence
- Operation
- Evaluation and improvement
As an IT supplier: adding NEN 7510 to your ISO 27001?
You already have ISO 27001. The question then is not “which one do I choose?”, but “do I need to add NEN 7510?”. Three signals point to yes:
- You process patient data or have access to healthcare systems (EPD, HIS, picture archive).
- A healthcare client asks in the tender or the contract explicitly for NEN 7510.
- You want to get ahead of future requirements and strengthen your position in the healthcare market.
Do you see none of these signals and mainly serve clients outside healthcare? Then your ISO 27001 is usually sufficient. Are you unsure about the standard as a healthcare organisation yourself? The choice is worked out on the page NEN 7510 vs. ISO 27001.
Holding both ISO 27001 and NEN 7510
The good news: if you want both, they can be combined efficiently. Because of the large overlap, you can meet both standards with one integrated system.
Combined approach
- Start with ISO 27001: this gives you the international foundation
- Add NEN 7510-specific requirements: the healthcare-specific additions
- Combine the audit: many certification bodies offer combined audits
Costs and time
A combined certification does not cost double:
- The audit days largely overlap
- Your documentation is integrated
- The preparation time is more efficient
Expect roughly 30 to 50 percent extra costs and time on top of a single certification, not 100 percent.
Certification bodies
Not every certification body is allowed to certify NEN 7510. Choose a body that offers both standards and has experience in the healthcare sector:
Tip: ask about the auditor’s experience in the healthcare sector. An auditor who understands the healthcare context can add more value than someone who simply works through the checklist.
Frequently asked questions about ISO 27001 vs NEN 7510
Is NEN 7510 mandatory?
The standard itself is not legally mandatory, but its content is seen as the benchmark for information security in healthcare. Certification is voluntary, but it can be requested by clients or supervisory bodies.
Can I use ISO 27001 to show that I meet NEN 7510?
Partly. ISO 27001 covers much of NEN 7510, but not the healthcare-specific additions. An auditor or supervisor who expects NEN 7510 may accept ISO 27001 as a foundation, but can ask for additional evidence.
As an IT supplier to healthcare, do I need NEN 7510?
Increasingly, yes. Large healthcare providers require NEN 7510 from their suppliers, especially if you process patient data or have access to healthcare systems. Check the requirements of your clients.
What is Z-CERT?
Z-CERT is the Computer Emergency Response Team for the healthcare sector. They provide support for cybersecurity incidents and share threat information. Joining is not mandatory, but it is recommended for healthcare organisations.
How does this relate to the AVG?
Both ISO 27001 and NEN 7510 help you meet the security requirements of the AVG (the Dutch name for the GDPR). NEN 7510 goes further by also addressing the healthcare-specific privacy aspects. Neither is enough on its own for full AVG compliance: you also need policies on lawfulness, transparency and retention periods.
Summary: do you need NEN 7510 alongside ISO 27001?
| Your situation as an ISO 27001 holder | Advice |
|---|---|
| Supplier with access to patient data | Add NEN 7510 |
| Healthcare client requires NEN 7510 in the contract | Add NEN 7510 |
| Tooling without patient data | ISO 27001 is usually sufficient |
| No healthcare clients | ISO 27001 is sufficient |
| Unsure as a healthcare organisation yourself | Read NEN 7510 vs. ISO 27001 |
More information
- What is ISO 27001?: introduction to the standard
- Requirements of the standard: what does ISO 27001 require?
- NEN 7510 vs. ISO 27001: the main comparison from a healthcare perspective
- NEN 7510 at NEN : the official standard
- Z-CERT : cybersecurity for healthcare