NEN 7510 for general practices

A general practice processes health data from hundreds of patients every day. The IGJ (Dutch Health and Youth Care Inspectorate) and the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) supervise compliance with NEN 7510 as the benchmark for appropriate security. What does a general practice need to arrange in practice, and when does formal certification make sense?

For the wider context on small practices, also read NEN 7510 for small practices. This page looks specifically at the situation of the general practice: the HIS (GP information system), the LSP (National Switching Point), and an approach that suits a small organisation.

Must a general practice certify under NEN 7510?

Probably not. Certification is not legally required. What is required is that you meet the security requirements that the standard describes. That is a fundamental difference.

The Wabvpz (Dutch Supplementary Provisions for Processing Personal Data in Healthcare Act) refers to NEN 7510 through the Besluit elektronische gegevensverwerking (Decree on Electronic Data Processing). You must take appropriate measures to protect patient data. NEN 7510 describes what “appropriate” means. However, a formal certificate is not required.

For most solo practices and small group practices, meeting the content of the standard is the goal, not the certificate. Otherwise the effort would be out of proportion to the size of the organisation.

Are you connected to a regional GP organisation (ROHA/RHO) or to a hagro (GP organisation) that manages a shared information security system? Then you may benefit from their certification. Check with your regional organisation what they offer.

Connection to the LSP and NEN 7510

The Landelijk Schakelpunt (LSP, National Switching Point) is the national infrastructure for exchanging patient data between GPs, pharmacies and other care providers. Taking part in the LSP sets requirements for information security.

To connect to the LSP, your HIS supplier must be certified, and your organisation must meet the security requirements of the VZVZ (Vereniging van Zorgaanbieders voor Zorgcommunicatie, Association of Healthcare Providers for Care Communication). Technical security of LSP communication largely falls under the responsibility of your HIS supplier, who must comply with NEN 7512 for data exchange.

Your own responsibility as a practice remains: ensuring that the system is configured correctly, that only authorised staff have access, and that you know how to act in the event of an incident.

Your HIS supplier: the most critical choice

For a general practice, the choice of HIS supplier is the most significant decision for information security. The large HIS suppliers in the Netherlands (Medicom, Promedico, CGM and others) are NEN 7510 certified or are working towards certification.

Check this with your supplier. Do not only ask for the certificate, but also for an explanation: what does their certification cover, and what is your own responsibility?

Typically, the supplier is responsible for: the security of the system itself, hosting and infrastructure, logging of system actions, and backup management of the application layer.

Typically, your responsibility as a practice is: the organisational measures (policy, training), workstation setup, access rights and passwords, and the physical security of the practice.

What a general practice must arrange itself

The core of NEN 7510 for a general practice is manageable. These are the things you must arrange yourself, whatever your supplier does.

Access management

Every employee has their own login account for the HIS. No shared passwords. Employees who leave the practice have their access withdrawn immediately. Locum GPs and trainees get temporary accounts, which are deleted when they leave.

Set up a screen lock: the computer locks automatically after a few minutes of inactivity. In the consulting room this is essential: your patient must not see the screen of the previous patient.

Employee awareness

Your assistants and staff are the first line of defence. They receive phishing emails, get phone calls from people claiming to be “from IT”, and can accidentally send patient data to the wrong address.

Discuss the basic rules at least once a year. What do we do with suspicious emails? How do we report an incident? What must never happen with patient data?

Incident and data breach procedure

You are required to report a patient data breach to the Autoriteit Persoonsgegevens within 72 hours. To do this, you must know when there is a data breach and whom to call.

Write this down: the name of the first contact person at your HIS supplier, the number of the Autoriteit Persoonsgegevens, and the number of Z-CERT for cyber incidents.

Physical security

Lock up the practice. Make sure unauthorised people have no access to the server room or the computers. Destroy paper with patient data using a shredder or through a certified destruction service.

A stolen laptop holding patient data is a notifiable data breach. Encrypting the laptop (with BitLocker or a similar solution) is a simple measure that greatly reduces this risk. Check that your practice laptops are encrypted.

Logging in the general practice: NEN 7513

NEN 7513 requires that access to patient records is logged. Your HIS usually does this automatically: every time an employee opens a record, it is recorded.

Check with your supplier that logging is switched on and that patients can have their access requests honoured. If a patient asks who has viewed their record, you must be able to tell them.

Approach for solo practices versus group practices

Solo practice

As a solo GP, you are your own information security officer. Make sure you have certified suppliers and know the basic rules. Document in a few pages what you do and how you act in the event of an incident.

Time investment: an afternoon to get it in order, and one hour a year for maintenance.

Cost: mainly your own time. Technical adjustments with your supplier sometimes cost extra.

Collective solutions and LHV support

You do not need to reinvent the wheel. The LHV (Landelijke Huisartsen Vereniging, Dutch National GPs’ Association) provides information and guidelines on information security specifically for GPs. Some regional organisations offer shared solutions.

NEN offers free e-learning and a compliance tool that lets you test where you stand. This is a low-threshold starting point.

When is certification worthwhile?

There are situations in which formal certification is worth it for a general practice:

You provide services to a large care institution that requires NEN 7510 from its suppliers
You work together in a chain (for example a POH-S setup, a practice nurse for physical health) where the main organisation requires certification
You want to expand or merge your practice, and a certificate is evidence of quality
You want the assurance of an external review

In those cases, the costs for a small practice (see the table on costs and timeline) are manageable, especially if you are well prepared by your HIS supplier or a specialist adviser.