NEN 7510: information security in healthcare
NEN 7510 is the Dutch standard for information security in the healthcare sector. The IGJ (Dutch Health and Youth Care Inspectorate) and the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) use the standard as an assessment framework. If you work with patient data, you must meet this standard. Certification proves that your information security is in order.
What is NEN 7510?
NEN 7510 describes how healthcare organisations must protect health information. The standard was developed by the Nederlands Normalisatie-instituut (Netherlands Standardisation Institute, NEN) and is specifically tailored to the Dutch healthcare sector. The standard is closely linked to GDPR and the processing of health data under Article 9 of the European privacy regulation.
The core idea: make sure patient data is available, accurate and confidential. Available means healthcare providers can access it when needed. Accurate means the data is correct and complete. Confidential means only authorised people have access.
NEN 7510 is based on ISO 27001, the international standard for information security. About 80% overlaps. However, NEN 7510 adds healthcare-specific requirements: logging of access to patient records, protection of medical equipment, and rules for data exchange within the care chain.
NEN 7510 is free to download from NEN Connect . The Ministry of Health, Welfare and Sport (VWS) made this possible so that all healthcare organisations have access.
The parts of NEN 7510
NEN 7510 consists of several parts that together form the complete framework:
NEN 7510-1 describes the management system: how you organise information security, from policy to improvement. This is the part you are certified against.
NEN 7510-2 contains the control measures: concrete measures you can take, from access management to encryption. This is the “menu” you choose from based on your risks.
NEN 7512 covers a basis of trust for data exchange. How do you know for certain that you are exchanging data with the right party?
NEN 7513 specifies the requirements for logging. Who viewed which patient data, and when? This is crucial for accountability and for investigating incidents.
Who is NEN 7510 for?
The standard is relevant to all organisations that work with patient data or health information. In practice, this covers the following organisations.
Healthcare providers such as hospitals, GP practices, pharmacies, mental health institutions, nursing homes, physiotherapy practices and home care organisations must comply with NEN 7510. The same principles apply to small practices, but the approach can be simpler. GP practices and mental health institutions have their own points of attention.
Suppliers to healthcare that process patient data or have access to healthcare systems are increasingly required to hold NEN 7510 certification. Think of EHR suppliers, IT administrators, software developers and hosting providers. Read more about NEN 7510 for IT suppliers.
Supporting services such as health insurers, laboratories, billing providers and administration offices that process health data.
Since 2023, hospitals must be able to demonstrate compliance with NEN 7510. The Dutch Health and Youth Care Inspectorate (IGJ) checks this after incidents involving ICT security.
Is NEN 7510 mandatory?
This is a nuanced story. Certification is not legally required. However, the content of the standard does count as the benchmark for information security in healthcare.
The Dutch Act on Supplementary Provisions for Processing Personal Data in Healthcare (Wet aanvullende bepalingen verwerking persoonsgegevens in de zorg) refers to NEN 7510. Healthcare providers must take “appropriate technical and organisational measures” to protect personal data. NEN 7510 describes what “appropriate” means.
If something goes wrong, for example a data breach or a ransomware attack, supervisors look at NEN 7510. Did you comply with it? Can you demonstrate that? Certification is then the strongest evidence.
In practice, NEN 7510 is often required through other routes:
- Health insurers require it in contracts
- Partners make it a condition
- Municipalities ask for it in tenders for Wmo (Social Support Act) and youth care
- Large healthcare institutions require it from their suppliers
Why certification?
You can comply with NEN 7510 without a certificate. However, certification offers concrete benefits that make it worthwhile.
Demonstrable compliance is the most important argument. A certificate proves to clients, supervisors and partners that your information security is in order. Without a certificate, you have to explain and prove this again and again.
Contractual requirements make certification more and more necessary. Large healthcare institutions require NEN 7510 from suppliers. Without a certificate, you do not get the assignment.
Risk reduction comes from systematically identifying and controlling risks. A certification process forces you to review all aspects of information security.
Less supervision burden is a practical benefit. The IGJ takes a certificate into account in its risk assessment. Certified organisations receive less intensive supervision.
NEN 7510 and ISO 27001
NEN 7510 is based on ISO 27001. The structure is identical and many requirements overlap. If you already have ISO 27001, the step to NEN 7510 is small: you add the healthcare-specific requirements.
The other way around: if you start with NEN 7510, you have a solid basis for ISO 27001. This is useful if you also serve clients outside healthcare or want to become internationally active.
The choice depends on your situation. A purely healthcare organisation in the Netherlands? NEN 7510 is sufficient and the most relevant. An IT supplier to healthcare and other sectors? Consider both. Internationally active? ISO 27001 for international recognition, NEN 7510 for the Dutch healthcare market.
Read more about the differences between NEN 7510 and ISO 27001.
The current version: NEN 7510:2024
In December 2024, the renewed NEN 7510:2024 was published. This version is aligned with the latest versions of ISO 27001 and ISO 27002. A clear mapping to the NIS2 Directive and the Dutch Cybersecurity Act (Cyberbeveiligingswet) has also been added.
Organisations that are already certified must move to the new version before 20 February 2027. This is a transition period of two years. New certifications are issued based on NEN 7510:2024.
How much does NEN 7510 certification cost?
The costs depend on the size and complexity of your organisation. A small GP practice is different from a large hospital.
For an average healthcare organisation, expect:
- Implementation: €10,000 - €50,000 (depending on the current situation)
- Certification audit: €5,000 - €15,000 per year
- Maintenance and annual audits: €3,000 - €10,000 per year
Read more about costs and timeline.
How do you start?
The route to NEN 7510 certification follows a logical path. Start with a gap analysis: where do you stand now compared with the standard? This gives direction to your implementation project.
Next, build an information security management system (ISMS): policies, procedures and measures. You carry out a risk analysis and implement the necessary control measures. After internal audits and improvements, you request the certification audit.
See the step-by-step plan for a detailed explanation.
Important links
Sources
- NEN 7510 at NEN - The official standard and supporting documents
- IGJ on information security - Supervisor for healthcare
- Z-CERT - Computer Emergency Response Team for healthcare
- Autoriteit Persoonsgegevens - Privacy supervisor