NEN 7510 for dental practices

A dental practice must meet the content of NEN 7510 , but it does not have to be certified. According to the KNMT guideline on patient records (KNMT-richtlijn Patiëntendossier) , NEN 7510 is the standard for information security in oral healthcare, and you must comply once you process the citizen service number (BSN). In practice this means: a well-secured dental information system, your own access and backup arrangements, and safe sharing of X-ray images and referrals.

This page works out the general approach in NEN 7510 for small practices for oral healthcare. You will read what your supplier arranges, what you must do yourself, and when you need a data protection officer (functionaris gegevensbescherming, FG).

Does a dental practice have to certify under NEN 7510?

No. Certification is not legally required. What is required is appropriate security under the GDPR (AVG) and the Wabvpz (Dutch Supplementary Provisions for Processing Personal Data in Healthcare Act) , and that law refers to NEN 7510. The IGJ (Dutch Health and Youth Care Inspectorate) expects you to be able to show that you work according to the standard.

A certificate is one way to prove that. For most practices, demonstrably working according to the standard is enough, possibly with an independent assessment. Read the difference at independent assessment or certification.

The KNMT has an information security checklist for oral healthcare that lets you assess how your practice is doing. Members can find it via Mijn KNMT. It is a good starting point for your NEN 7510 risk analysis.

When does a dental practice need an FG and a DPIA?

That depends on size. The Autoriteit Persoonsgegevens (AP, Dutch Data Protection Authority) considers processing by a healthcare provider to be large-scale if the practice has more than 10,000 registered patients, or treats more than 10,000 patients a year on average, and that data is held in one information system (AP explanation ).

Practice	Registered patients in one system	FG required?	DPIA required?
Solo practice	2,500	No, but recommended	No
Group practice with 4 dentists	9,000	No, but recommended	No
Group practice with dental hygienists and an orthodontist	14,000	Yes	Yes, for the patient administration
Chain with a central database	60,000	Yes	Yes

You may share an FG with other practices or hire one externally. The AP also recommends that smaller healthcare providers have one. For how a DPIA works, read carrying out a DPIA.

Your dental information system: what does the supplier arrange?

The dental information system (TIS, tandheelkundig informatiesysteem), such as Exquise, Simplex or Novadent, holds the core of your patient data. If it runs in the cloud, the supplier arranges much of the technical side. If it runs on a server in the practice, more of it falls to you or your IT partner.

Topic	Usually arranged by supplier	Always your responsibility
Hosting and server security	Yes, with a cloud service	With a server in the practice
Logging of record access (NEN 7513)	The function in the software	Switching logging on and checking the logs
Backups	With a cloud service	Checking that restoring works
Accounts and rights	Options in the software	Who gets which rights, and revoking them in time
Processing agreement	Offering it	Signing, reviewing and storing it

Ask your supplier for the NEN 7510 certificate and check the scope. Then record what you must do yourself. The KNMT advice is that the practice must always be able to access a good backup, for example in the cloud or on a data carrier owned by the practice.

X-ray images and scans: the forgotten part of the record

X-rays, CBCT scans and intraoral scans are often stored in separate imaging software or on a standalone workstation next to the X-ray unit. These systems fall under NEN 7510 just as much. They are part of the patient record.

Check three things. Does every user have their own account on the imaging software? Is the workstation next to the X-ray unit kept up to date with security updates? And are the images included in the backup?

X-ray images are often shared with an oral surgeon, orthodontist or dental laboratory. Ordinary email or WeTransfer is not secure enough for that. Use a service that works according to NTA 7516 for secure email, or a secure connection. With the laboratory, sign a processing agreement if it processes scans on your behalf.

Example: a NEN 7510 action list for a dental practice

Fictional example. Dental practice Molenzicht has three dentists, two dental hygienists, five assistants and 7,500 registered patients. After the KNMT checklist, the practice manager makes this action list. Adapt the set-up for your own practice.

Risk	Measure	Owner	Done by
Assistants share one account on the X-ray workstation	Personal accounts, automatic lock after 5 minutes	Practice manager	March
Treatment room screen visible to the next patient	Lock the screen when switching, adjust screen position	All treating staff	Immediately
Referrals to the oral surgeon sent by ordinary email	Secure email service in line with NTA 7516	Practice manager	April
Former staff still have access to the TIS	Leaving procedure with a checklist, quarterly account review	Practice manager	Immediately
Backup never restored	Annual restore test with IT partner	IT partner	June
No data breach procedure	One A4 with steps, contact details for the AP and Z-CERT	Practice owner	March

An assistant who sends an X-ray to the wrong email address causes a data breach involving health data. Read reporting a data breach to learn what you must do within 72 hours.

Retention period for the dental record

Dentists are also bound by the WGBO (Dutch Medical Treatment Contracts Act): you keep the record for 20 years from the last change. The KNMT says it is defensible to keep dental data longer, because it may be relevant for forensic odontology (identifying people). Record that choice in your policy.

The TIS must allow you to delete data permanently, for example after a patient requests erasure. For all the details on retention periods, read retention period for the medical record.

Approach per type of dental practice

Solo practice

You are responsible for information security yourself. Start with the KNMT checklist and a short risk analysis. Make sure you have a certified TIS supplier, personal accounts and a tested backup restore.

A few pages of policy are enough: who may do what, how you handle email and what you do in the event of an incident.

Frequently asked questions about NEN 7510 in oral healthcare

Does NEN 7510 also apply to dental hygienists and orthodontists?

Yes. Anyone who processes patient data and uses the BSN must take appropriate security measures under NEN 7510. If they work in your practice, they fall under your measures.

Is a dental laboratory a processor?

That depends on the agreements. If the laboratory processes scans and patient data only to carry out your order, record the arrangements in a processing agreement. If you are unsure about the role, read processors and controllers.