NEN 7510 for physiotherapy practices

A physiotherapy practice must protect patient data according to NEN 7510 , but it does not have to certify. The KNGF (Royal Dutch Society for Physiotherapy) states this plainly in the conditions for your EPD : healthcare organisations must comply with NEN 7510, you must record who views the record, and everyone has a personal account. For most practices, this comes down to choosing a well-chosen EPD, using secure email and agreeing a few fixed working practices.

This page works out NEN 7510 for small practices for physiotherapy. You will read what the KNGF expects, what your EPD supplier arranges and what you record yourself. There is an action list you can take over.

Must a physiotherapy practice certify under NEN 7510?

No, certification is not mandatory. However, you must take appropriate measures under the GDPR (AVG) and the Wabvpz (Dutch Supplementary Provisions for Processing Personal Data in Healthcare Act) , which refers to NEN 7510. The IGJ (Dutch Health and Youth Care Inspectorate) checks whether you demonstrably work in line with the standard.

A certificate is one way to show that. For an ordinary practice, demonstrably working in line with the standard is usually enough, with an occasional independent review. You can read what that involves at independent assessment or certification.

What does the KNGF expect from your EPD?

Your electronic patient record (EPD), for example Intramed, FysioRoadmap or SpotOnMedics, is the most important system in your practice. The KNGF sets out a number of conditions. This table sets them alongside what you check yourself.

KNGF condition	What you check
Supplier holds a NEN 7510 or ISO 27001 certificate	Request the certificate and check whether the EPD service falls within the scope
Logging of record access in line with NEN 7513	Is logging switched on, and can you produce an overview per patient?
Everyone has a personal account	No shared logins, including for trainees and locums
Record kept for 20 years from the last change	How do you hand over data when switching supplier or closing the practice?

In addition, the KNGF recommends secure login with two-step verification and a one-time identity check, for practitioners and patients alike. This applies, for example, to a patient portal or to booking appointments online.

A certified EPD is only part of the job. The KNGF stresses that information security is much more than a certified EPD. Your workstations, email, exercise apps and staff are part of it too.

Secure email with GPs and patients

Physiotherapists send a lot of email: final reports to the GP, exercise schedules to patients, appointment confirmations. According to the KNGF , you may only email patient data securely if you work in line with NTA 7516.

Two points from the KNGF advice matter in practice. An appointment confirmation already contains health information, because it reveals that someone is in treatment. And until May 2022, suppliers could certify against NTA 7516, so a certificate now says little. Ask your supplier, requirement by requirement, what the service arranges.

For referrals, an alternative to email is coming. The KNGF reports that the KNGF and VECOZO are introducing the Verwijzen (referral) service for physiotherapy in 2026, which will allow practices to receive digital referrals.

Exercise apps, videos and other tools

Many practices use an exercise app, an online agenda, a questionnaire tool or a payment system alongside the EPD. Every tool that processes patient data falls under NEN 7510 and the GDPR.

Tool	What to look at
Exercise app with videos (such as Physitrack)	Data processing agreement, patient login, link with the EPD
Online agenda	Which data does the patient see when booking, does it show a reason for treatment?
Questionnaire tool	Where are answers stored and for how long?
WhatsApp with patients	Do not use for health information; choose a secure chat

For each tool, record who the supplier is and whether there is a data processing agreement. This naturally creates a simple record of processing activities.

When do you need a data protection officer (FG) and a DPIA?

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) states that processing by a healthcare provider is large-scale when it covers more than 10,000 registered patients, or an average of more than 10,000 a year, in one information system (AP explanation ). In that case, a data protection officer (FG, functionaris gegevensbescherming) and a DPIA are mandatory.

An average solo practice is well below that threshold. A practice with several locations using one EPD may reach it. In that case, count all the patients in the system, not per location.

Example: NEN 7510 action list for a physiotherapy practice

Fictional example. Fysiotherapie Het Anker has eight physiotherapists, a manual therapist, two receptionists and 3,200 new patients a year. The practice owner goes through the KNGF conditions and makes this list.

Risk	Measure	Owner	Done by
Receptionists share one EPD account	Personal accounts, rights per role	Practice owner	Immediately
Final reports sent to the GP by ordinary email	Secure mail service under NTA 7516	Practice owner	March
Exercise app without a data processing agreement	Request and record the agreement	Practice owner	February
Laptop for home visits not encrypted	Disk encryption and locking after 5 minutes	IT partner	February
Practitioners texting patients	Agreement: only via the secure chat in the EPD	All practitioners	Immediately
No data breach procedure	One A4 page with steps and contact details for the AP and Z-CERT	Practice owner	March

A stolen unencrypted laptop with treatment reports is a notifiable data breach. On reporting a data breach, you can read what to do within 72 hours.

Retention period for the physiotherapy record

Physiotherapists are also bound by the WGBO (Dutch Medical Treatment Contracts Act): you keep the record for 20 years after the last change. This is also in the KNGF conditions for the EPD. The KNGF guideline on physiotherapy record keeping describes how to handle records.

If you stop your practice or move to another EPD, you take the records with you or keep them accessible. Read more about periods, logs and destruction on retention period for medical records.

Approach per type of physiotherapy practice

Solo practice

Choose an EPD with a NEN 7510 or ISO 27001 certificate and switch logging on. Use a secure mail service and encrypt your laptop. Record in two pages how you work and what you do in the event of an incident.

That is an afternoon’s work and an hour of maintenance a year.

Frequently asked questions about NEN 7510 in physiotherapy

Is a certificate from the EPD supplier enough?

No. The certificate covers the supplier’s service. Your own accounts, workstations, email and apps fall outside it. You arrange and document those rules yourself.

May I use WhatsApp with patients?

For appointments without medical content, some practices use it. However, a message about a treatment can contain health information. For anything about the treatment, use a secure chat or mail service.