NEN 7510 for mental health institutions

In mental health care (GGZ, geestelijke gezondheidszorg), patient data is especially sensitive. A data breach involving psychiatric records can directly harm patients: stigma, consequences for work, relationships and insurance. The IGJ (Dutch Health and Youth Care Inspectorate) examined at the end of 2025 whether 87 larger GGZ organisations complied with NEN 7510 . The result: only 6 of them could demonstrate compliance. This page explains what NEN 7510 requires in the GGZ context and how you can start in practice as a mental health institution.

Why NEN 7510 is especially urgent in mental health care

GGZ records contain information about mental health conditions, treatment histories, medication use, trauma and, at times, suicidality. This information is sensitive not only under the GDPR (AVG) and NEN 7510. It also directly affects the safety and wellbeing of patients.

Suppose an employee accidentally sends a record to the wrong email address, or a hacker gains access to the electronic client record (ECD, Elektronisch Cliënten Dossier). The harm goes beyond a privacy breach. Patients may risk losing their job, losing relationships or ending up in dangerous situations.

On top of that, GGZ works within a special legal context: the professional confidentiality of the care provider. That confidentiality protects patients, but it also sets specific requirements on who may access which information.

The IGJ reported in May 2026 that most of the large GGZ organisations it examined did not comply with NEN 7510. Only 6 of the 87 institutions examined could demonstrate compliance. The inspectorate requires organisations to commission an independent assessment.

The challenges specific to GGZ for NEN 7510

GGZ institutions face information security questions that play out less, or differently, in other healthcare sectors.

The ECD as a critical system

Care providers and other care workers record data digitally in the electronic client record (ECD). This ECD is the heart of care delivery and, at the same time, the largest information risk. It holds the most sensitive information about patients.

NEN 7510 sets requirements for securing the ECD: access protection, logging of who viewed which record and when (in line with NEN 7513), and encryption of the stored data.

Ask your ECD supplier for evidence of NEN 7510 certification or conformity. Also ask which security is built into the system and what your own responsibility is.

Professional confidentiality and access rights

In GGZ, the professional confidentiality of the treating practitioner applies. Information a patient shares with their psychiatrist or psychologist may not simply be shared with other care providers or viewed outside the treatment relationship.

NEN 7510 links to this through the principle of access based on the treatment relationship. Only employees with an active treatment relationship may view the record. In GGZ this is sometimes complex: multidisciplinary teams, crisis services and handovers between departments.

Your authorisation matrix (see mandatory documents) must reflect this. Who has access to which type of record, based on which treatment relationship?

Other care sectors: forensic care, addiction care, supervised housing

Large GGZ institutions often offer several types of care: general GGZ, forensic psychiatry, addiction care and supervised housing. Each has its own laws and regulations, its own chain partners and its own security questions.

Forensic care also involves the justice chain. Addiction care has referrers from the social security system. Supervised housing involves municipalities.

This makes defining the NEN 7510 scope complex. You must explicitly describe which parts of your organisation fall under the ISMS, and you must include the chain partners in your risk analysis.

Data breaches in GGZ: what goes wrong?

The most common causes of data breaches in GGZ are: emails or letters with patient information sent to the wrong recipient, unauthorised viewing by employees (whether deliberate or not), ransomware attacks on the ICT infrastructure, and loss or theft of mobile devices holding patient data.

Misdirected correspondence sounds old-fashioned, but it still happens. A letter with a psychiatric report sent to the wrong address is a notifiable data breach.

Unauthorised viewing carries extra risk in GGZ. An employee who looks at the record of an acquaintance out of curiosity, or an ex-partner who gains access to their former partner’s record through their employer: without proper logging and access management, this cannot be detected.

Z-CERT is the Computer Emergency Response Team for healthcare. In the event of a cyber incident, ransomware or a suspicion of unauthorised access, you can contact Z-CERT 24/7 for support and advice. Joining Z-CERT is strongly recommended.

What does the IGJ require from GGZ institutions?

Following the examination at the end of 2025, the IGJ formulated concrete expectations for GGZ institutions that did not comply with NEN 7510.

The inspectorate expects every GGZ institution that is not compliant in 2026 to commission at least one independent and expert assessment. This is not the same as certification, but a first step: an external party tests your information security and indicates what you need to improve.

After that, the IGJ expects a concrete improvement plan with a realistic timeline and a goal of fully meeting the standard.

Approach for GGZ institutions

A practical approach in three steps.

Step 1: Commission an independent assessment. Have an external party with GGZ knowledge carry out a gap analysis. This gives you a clear picture of what is already in order and what is not. It is also what the IGJ expects if you are not yet compliant with NEN 7510.

Step 2: Tackle the critical points first. Logging of ECD access, access rights based on the treatment relationship, and a working incident procedure are the highest-priority points. These are also the points the IGJ discusses most.

Step 3: Build the full ISMS. Work on the complete implementation: risk analysis, policy, management involvement, training and internal audits. This is the route to full NEN 7510 compliance, with or without a formal certificate.

Small GGZ institutions and practices

Smaller GGZ practices (self-employed GZ psychologists, small outpatient institutions) face similar challenges to other small healthcare practices. The security requirements are the same, but the approach can be proportionate.

For small GGZ practices too, the same applies: choose certified suppliers for your ECD, arrange good access protection and logging, and document what you do in the event of an incident. That is the basis, and for most small practices it is enough to handle patient data demonstrably and responsibly.