NEN 7510 for small practices

You run a GP practice, physiotherapy practice or dental practice. You know you need to do something about information security, but NEN 7510 sounds like a monster. The IGJ (Dutch Health and Youth Care Inspectorate) supervises healthcare providers, and the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) can enforce action after data breaches. Do you really have to set up an entire management system? This article gives you a realistic picture.

NEN 7510 for small practices: the good news first

As a small practice, you do not have to do what a hospital does. NEN 7510 scales. The effort matches the risks and the size of your practice. And most importantly, you do not have to do everything yourself.

Most information security risks in a small practice can be covered by choosing the right suppliers. Your HIS supplier (practice information system), your hosting provider and your IT manager: if they are NEN 7510 certified, a large part of the work is done. You take care of the rest: the human side, the policies and the awareness.

Does a small practice have to certify under NEN 7510?

The honest answer: probably not. Certification is not legally required. What is required is meeting the content of the standard. That is an important difference.

The Inspectie Gezondheidszorg en Jeugd (IGJ, Dutch Health and Youth Care Inspectorate) checks whether healthcare providers have their information security in order. They do not primarily look for a certificate. They look at whether you have taken the right measures. A certificate is one way to prove that, but not the only way.

For a small practice, certification is often disproportionate. The costs and effort do not outweigh the benefits. What you do need is to demonstrate that you meet the most important requirements. That is possible without a formal certificate.

The LHV (Landelijke Huisartsen Vereniging, the Dutch GP association) and other professional associations are working on simplified routes for their members. Check with your association whether there are collective solutions.

What should a small practice do for NEN 7510 then?

Information security comes down to three things: your patient data must be available when you need it, it must be accurate (integrity), and only authorised people may access it (confidentiality). Everything you do should serve these three goals.

1. Choose certified suppliers

This is the most important step. Most technical risks lie in your systems, and you do not manage those yourself. Make sure your suppliers have their affairs in order.

Your HIS supplier (Medicom, Promedico, CGM, etc.) must be NEN 7510 certified. The large players are. Check it and ask for proof. The same goes for your hosting provider if you work in the cloud, your IT manager if you have one, and your supplier of online services that process patient data.

Do not just ask for the certificate. Also ask for an explanation of what they arrange for you. What is included in their service, and what remains your responsibility?

2. Arrange the basics yourself

Some things you cannot outsource. You need to arrange these yourself.

Access management: Who can access which data? Make sure staff only have access to what they need. Do not share passwords. Use strong, unique passwords. Enable two-factor authentication where possible.

Physical security: Lock up your practice. Lock computers when you step away. Do not leave files open on desks. Destroy paper with patient data securely.

Awareness: You and your staff need to know what is and is not allowed. What do you do with a suspicious email? What if someone calls claiming to be from IT? How do you handle USB sticks? This does not have to be extensive training, but make sure the basics are known.

Backups: If you store data locally, make backups. Test regularly whether you can restore them. In the cloud your supplier often arranges this, but check it.

3. Put it in writing

You do not have to write a thick manual, but do record the most important matters. Who is responsible for information security in your practice? What are the house rules? What do you do in the event of an incident?

A few pages are enough for a small practice. What matters is that it is clear, not that it is impressive.

4. Know what to do in an incident

Suppose something goes wrong. A laptop is stolen. You are hit by ransomware. You discover that someone has looked at records without authorisation. What do you do then?

You need to know how to report a data breach to the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) . You need to know who to call: your IT supplier, your professional association, or Z-CERT (the Dutch healthcare cyber incident response team) for support with cyber incidents in healthcare.

Write this down in advance. In a crisis you do not have time to work it out.

The reality of NEN 7510 in the GP practice

In 2024 the IGJ carried out research among out-of-hours GP care organisations. Of the 49 organisations, 43 did not fully comply with NEN 7510. The inspectorate takes this seriously.

But the message was not: everyone must certify. The message was: make sure the basics are in order. That means certified suppliers, aware staff and clear agreements. No bureaucracy, but attention.

For an average GP practice this is achievable. You do not need a full-time officer. You do not need consultants walking through your practice for months. You do need an afternoon to think about the risks, choose the right suppliers and make the basic agreements.

Collective solutions

You do not have to do everything alone. There are collective initiatives that make life easier.

Some regional GP organisations offer a shared information security system. If you join, you benefit from their expertise and certification. Check with your ROHA, RHO or other regional organisation.

Industry associations develop guidelines and tools for their members. The LHV provides information on information security. The KNMT (Royal Dutch Dental Association) and the KNGF (Royal Dutch Society for Physiotherapy) do too. Make use of them. For how this works per profession, read NEN 7510 for dental practices and NEN 7510 for physiotherapy practices.

NEN also offers free e-learning and tools to test your current situation. These are low-threshold starting points.

When is NEN 7510 certification worthwhile for small practices?

There are situations in which certification is worthwhile even for a small practice.

If you provide services to large healthcare institutions that require it. If you are part of a chain in which certification is the agreed standard. If you want to expand and certification gives you a competitive advantage. If you simply want confirmation that you are doing things right.

In those cases certification is an investment that pays for itself. But for the average GP, physiotherapist or dentist, it is not a necessity.

Doing it yourself or hiring help? See implementing it yourself or with a consultant.

Getting started practically with NEN 7510 as a small practice

Start simply. Make a list of your suppliers and check whether they are certified. Take a critical look at your passwords and access rights. Agree with your team what the basic rules are. Write down what you do in an incident.

Once you have done that, you are already a long way along. You do not need to strive for perfection. You need to show that you have thought about it and taken reasonable measures.

And if you are unsure whether it is enough: ask your IT supplier or professional association. They know the context and can help you judge where you stand.

NEN 7510 for small practices