NEN 7510 for IT suppliers

You supply software or IT services to healthcare. In your latest tender, NEN 7510 was a requirement. Your existing clients are starting to ask about it too. The IGJ (Dutch Health and Youth Care Inspectorate) and large healthcare organisations increasingly set requirements for suppliers. Do you really need NEN 7510 certification, or can you get by with ISO 27001 ?

This question concerns more and more IT companies. The honest answer: it depends. That nuance is not always understood, not even by the healthcare buyers who set the requirement.

The key question for NEN 7510: do you process medical personal data?

NEN 7510 is aimed specifically at organisations that process medical personal data. The standard focuses on protecting patient information. If you never come into contact with patient data, NEN 7510 does not formally apply to you.

But what exactly does “processing medical personal data” mean? This is where it gets tricky.

If you develop an EPD (electronic patient record) system that holds patient records, you process medical data. If you host a practice information system that stores patient data, you process medical data. If you manage systems to which you have access to patient information, you process medical data.

But what if you supply infrastructure without access to the data running over it? What if you supply office software that has nothing to do with patients? What if you offer a generic cloud service that healthcare organisations also use? Then you do not process medical data, even if your client is a healthcare institution.

When to choose NEN 7510 or ISO 27001 as an IT supplier

Here is a rule of thumb that works well in practice.

Choose NEN 7510 if you actually process medical personal data. That means you have access to patient information, you store it, or you process it. Under the GDPR (AVG, Dutch: Algemene verordening gegevensbescherming), you are a “processor” of health data.

Choose ISO 27001 if you provide IT services without access to medical data. You supply infrastructure, networks, generic software or advice. Your client is a healthcare institution, but you never touch patient data.

Most IT suppliers that serve both healthcare and other sectors are better off with ISO 27001. It is recognised internationally, it covers information security broadly, and it is enough for most situations.

Be aware that some healthcare buyers require NEN 7510 by default without checking whether it applies. You can push back. Explain that NEN 7510 is meant for processors of medical data, and that ISO 27001 is the right standard for your services.

The grey areas of NEN 7510 for IT suppliers

In practice there are grey areas. Suppose you manage the servers of a hospital. You technically have access to the data, even if you never look at it. Are you then a processor of medical data?

Or you supply a cloud platform. Healthcare organisations can run on it. You cannot see what they put on it. Do you process medical data?

Lawyers could argue about these questions. In practice you need to make a pragmatic judgement. If you structurally have access to patient data or store it, NEN 7510 is the sensible choice. If you supply pure infrastructure without access to the content, ISO 27001 is defensible.

Discuss it with your clients. Explain how your service works and why you choose a particular certification. Document this. Then you stand on firm ground if questions come up.

If your client requires NEN 7510

You increasingly receive this requirement from clients. Here is how to handle it.

Understand the question behind the question. What does your client actually want to know? Usually: can we trust that our data is safe with you? A certificate is one answer, but not the only one.

Explain what you already have. If you are ISO 27001 certified, explain what that means. ISO 27001 is the international foundation on which NEN 7510 is built. It covers the large majority of the requirements. Show your certificate, explain which measures you have in place, and ask whether that is sufficient.

Offer transparency. Some clients want to see what you do. Offer to share your security policy, complete a questionnaire, or hold a conversation with your CISO. This builds trust, sometimes more than a certificate does.

Be honest about the limits. If you really do not have NEN 7510 and the client really needs it, say so. An honest refusal is better than a contract you cannot meet.

Getting NEN 7510 certified as an IT supplier

Still deciding to go for NEN 7510? This is the route.

The good news: if you already have ISO 27001, the step is limited. NEN 7510 is about 80% the same. You add the healthcare-specific parts and adjust your scope. Expect 2 to 4 months of extra work and 20-30% extra costs.

The less good news: if you have nothing yet, it is a substantial project. You build an information security management system, carry out a risk analysis, implement measures and go through an audit. Expect 6 to 12 months, with costs that depend on your size.

The process itself does not differ fundamentally from ISO 27001 certification. The method is the same. You only need to include the healthcare-specific requirements: logging access to patient data, protecting medical data, and attention to the healthcare chain.

The commercial considerations of NEN 7510 for IT suppliers

Certification costs money and time. Does it pay off?

Access to the healthcare market. More and more healthcare organisations require suppliers to be certified. Without a certificate you miss out on contracts. This is a hard commercial reality.

Competitive advantage. If your competitor is not certified and you are, you have an edge. Especially in tenders where certification carries heavy weight.

Trust. A certificate gives clients certainty. You have less to explain and get fewer questions.

Internal improvement. The process forces you to look critically at your security. Most organisations find improvement points that are worth acting on regardless of certification.

Weigh this against the costs. For a small IT provider with a handful of healthcare clients, certification may not be worth it. For a company that has healthcare as its core market, it is almost unavoidable.

Defining the scope for NEN 7510 as an IT supplier

When you certify, you first define the scope. What falls within the certification, and what does not?

You do not have to certify your entire company. You can choose specific services or departments. This limits the effort and costs.

But note: the scope must be logical. You cannot certify only your best process and ignore the rest if that rest is relevant to your healthcare clients. The auditor looks critically at how you have drawn the boundaries.

A common approach is to certify the services you provide to healthcare. Your administration and HR fall outside, while your cloud services for healthcare clients fall inside.

Practical first steps with NEN 7510 as an IT supplier

Want to explore whether NEN 7510 is right for you? Start here.

Make a list of your healthcare clients and what you do for them. Which services bring you into real contact with patient data? That is your scope.

Carry out a gap analysis. Where do you stand against the standard? If you already have ISO 27001, the gap is small. If you have nothing yet, there is more work to do.

Talk to your clients. What exactly do they expect? Sometimes the requirement is less strict than you think. Sometimes you can work with an alternative form of evidence.

Request quotes. From a consultant for guidance, and from a certification body for the audit. That gives you a realistic picture of costs and lead times.