NEN 7510 for hospitals: what does a hospital need to arrange?
A hospital should see NEN 7510 as a management system for the whole care process, not as an IT checklist. You set a scope for locations, systems and care flows, carry out a risk analysis, and justify in the Statement of Applicability (VvT, Verklaring van Toepasselijkheid) which measures you choose and which you do not. The focus lies on interfaces (laboratory, imaging, pharmacy, referring parties), medical equipment and the large number of staff with access to the electronic patient record (EPD, elektronisch patiëntdossier). You must log that access, see NEN 7513 logging. More about certification is on the NEN website, which mentions hospitals as an example of care providers that can certify.
Why a hospital approaches it differently from a practice
A GP practice has one EPD, a few dozen staff and a manageable set of interfaces. A hospital has dozens of systems, thousands of users, several locations and often a mix of in-house and outsourced IT. This mainly changes three things.
- The scope becomes more demanding. You must record which locations, departments and systems fall under the management system and which do not. You must justify any excluded part.
- The risk analysis becomes a programme. Each system and each care process has its own threat picture. See the risk analysis for NEN 7510.
- Ownership becomes visible. For many systems, one employee or department is the owner. You must be able to show these ownerships to the auditor.
The six areas that often weigh heaviest in a hospital
| Area | Why it is harder in a hospital | What to watch for |
|---|---|---|
| Access management for the EPD | Many roles, many changes, urgent access | An authorisation matrix per role and a logged process for break-glass access (for example during an emergency admission) |
| Logging (NEN 7513) | Thousands of users and interfaces | Logs per system and a report per patient, see NEN 7513 logging |
| Medical equipment | Devices with their own software, often managed outside the IT department | Inventory, maintenance contracts and patch policy |
| Interfaces and data exchange | Many parties, different standards | An overview of all interfaces with the related processing agreements |
| Suppliers | Large numbers of suppliers with remote access | Contracts, processing agreements and an annual check |
| Incidents and data breaches | High volumes and several reporting routes | An incident process that links reports to the data protection officer and to notification to the Autoriteit Persoonsgegevens (AP, Dutch Data Protection Authority) within 72 hours, see GDPR (AVG) and NEN 7510 |
Step 1: set the scope per location and system
Start with a list of all locations and of all systems that process patient data. Then make a choice and record it. Many hospitals choose a scope that covers the whole hospital, but you can also work in phases: first the EPD and the central interfaces, then the satellite locations. A phased scope must be justified, and the Statement of Applicability must make clear what still falls outside it.
Example of a scope decision
Fictional example of a medium-sized hospital with three locations:
| Part | In scope | Reason |
|---|---|---|
| Main location, all clinical departments | Yes | Processes patient data in the EPD |
| Outpatient clinics at location B | Yes | Same EPD, same access management |
| External dialysis unit (outsourced) | Yes, via supplier | Processing on its own system, arranged by contract |
| Hospital restaurant | No | No patient data, but checked as part of the network scope |
Excluding the restaurant is only defensible if the network it runs on is separated from the care network. You must demonstrate that separation.
Step 2: create the ownership matrix
For each chosen measure from NEN 7510-2, you appoint an owner. The standard does not require this matrix, but without an owner you cannot show the auditor who monitors what. In a hospital that is rarely the IT department alone. A workable matrix contains, per measure, a name or role, a deputy and a monitoring frequency.
Name the owner per domain
Access management belongs to the functional administrator of the EPD. Medical equipment belongs to the clinical technology department. Incidents belong to the information security officer or the security officer.
Record the deputy
If someone is ill or leaves, another person must be able to take over. A hospital that does not arrange this may receive a question about staffing during the audit.
Link the matrix to the VvT
Each chosen measure refers to the owner and to the evidence. This stops the auditor from having to ask who is responsible for every measure.
Step 3: access and logging as the first closed chain
In hospitals, the chain of access, authorisation and logging is where most questions arise. Start here with a coherent story: who may see which type of data, how that access is granted, how it is logged and how it is checked. The technical details of logging are on NEN 7513 logging. To check access, you can use the internal audit: spot checks of logs for records of known patients are a good way to test whether it works.
Spot-checking the logs of staff who recently changed roles is a useful control. For example: a nurse moves from the children’s ward to dialysis. Can she still open records from the children’s ward? If so, the authorisation has not been updated.
Step 4: governance across several layers
A hospital often has an executive board, an information security committee and a medical or nursing staff, all of which have a role. You do not need to change that structure, but you must be able to show how decisions about information security reach these bodies. Record this in a policy document and in the committee’s minutes. See also the mandatory documents.
Common mistakes in hospitals
- An overly broad exclusion. Locations or systems are excluded without justification, and the auditor checks them anyway.
- Medical equipment out of view. Devices with their own operating system do not appear in the risk analysis.
- Suppliers without an annual check. The contract exists, but nobody checks whether the supplier still meets the agreements.
- Documentation of the information security management system (ISMS) that does not match practice. The policy describes a process that does not exist on the work floor.
- Incidents that are not linked. A patient complaint does not lead to an improvement in the risk register.
How large is the project?
The lead time depends strongly on the scope and the maturity of the organisation. A hospital that already has ISO 27001 or a comparable management system often starts further along than one without. For an indication of costs and lead time, see costs and timeline. A hospital falls into the largest category (more than 100 FTE, full-time equivalents): the indication is 9 to 18 months and more than 1,000 internal hours. So plan for a dedicated project plan and a project leader who has enough time for it.
What the auditor may look at in a hospital
- The scope decision and the justification for exclusions.
- The list of interfaces with the related processing agreements.
- A sample of logs and authorisations for a recently changed role.
- The ownership matrix and the deputies in it.
- Evidence of the annual check of suppliers.
Next step
Start with a scope decision and an ownership matrix for the EPD. Only then move on to the remaining measures. If you already follow the step-by-step plan, you can fit this in as a second phase. Comparable choices for smaller care providers are on NEN 7510 for small practices, and for mental healthcare (GGZ) organisations on NEN 7510 for mental healthcare organisations.
Additional notes
- The examples in the tables are fictional and serve as a working method, not as a standard. The six areas are a practical choice, not a classification from the standard.
- By law, a care provider, including a hospital, must ensure safe and careful use of its systems “in accordance with the provisions of NEN 7510 and NEN 7512” (article 3, paragraph 2 of the Decree on electronic data processing by care providers ). For logging, article 5 refers to NEN 7513. The decree requires compliance with the standard. Whether a certificate is needed follows from requirements set by clients or health insurers. Check this in each situation.
- According to the explanatory notes, supervision of this decree lies with the Autoriteit Persoonsgegevens (AP). The Inspectie Gezondheidszorg en Jeugd (IGJ, Dutch Health and Youth Care Inspectorate) supervises responsible care.
- For the current version and transition periods, see transition to NEN 7510:2024.