NEN 7510: independent assessment or certification?
A NEN 7510 certificate is not the same as demonstrating that you work according to NEN 7510. The IGJ (Healthcare and Youth Inspectorate) expects healthcare providers to have their information security management system (ISMS) and measures assessed independently. A certificate is one way to give that assurance, but it is not a legal requirement. Also read the NEN 7510 audit process and the approach for small practices.
The difference lies mainly in the level of evidence and the situation in which it is used. With an independent assessment, an expert writes a report about your organisation. With certification, a contracted certification body assesses you against a certification scheme and, if the outcome is positive, issues a certificate. The RvA (Dutch Accreditation Council) explains that management system certification assesses the organisation’s system, not every product or service automatically (RvA ).
Four concepts compared
| Situation | Who assesses? | Outcome | Mainly suited to |
|---|---|---|---|
| Working according to the standard | Your own organisation | ISMS, measures and improvement actions | Every healthcare provider |
| Independent assessment | An expert outside the implementation | Report with findings and evidence | Demonstrating compliance to the IGJ |
| Certification audit | Certification body under the applicable scheme | Audit report and decision | Formal proof for the market or a contract |
| Certificate | Certification body after a positive decision | Valid certificate with a defined scope | Clients, public tenders, chain agreements |
An internal audit does not automatically replace an independent assessment. The IGJ names knowledge of NEN 7510, auditing an ISMS and the healthcare sector as relevant expertise. The assessor must not be responsible for policy or implementation themselves.
What does the IGJ expect from an independent assessment?
The IGJ expects an assessment of every part of the ISMS and the applicable control measures. In practice, you may justify why a part was not tested. The report describes who assessed, why that person is independent and competent, how the assessment was carried out, who was interviewed and what evidence was used for each element of the standard. It must also distinguish critical findings, non-critical findings and points for improvement.
The assessment therefore goes further than a document check. Show that access control, logging, supplier agreements or backups actually work. The IGJ also states that regular independent assessments are needed, and that the frequency depends on changes, with at least once every three years as the starting point. Plan ahead how you will fund and staff the next assessment.
When does certification make sense?
Certification can be valuable when a public tender, client or chain partner requires a certificate. An organisation with multiple locations may also benefit from a fixed external audit structure. Always check the exact scope: a certificate for one service says nothing about another care location.
A certificate does not take over your own responsibility. You remain responsible for processes, suppliers, access decisions and following up on findings. NEN states that periodic supervision is part of a certificate, and that certified organisations can be included in the register (NEN certification and register ).
Fictional example: physiotherapy practice and EHR supplier
Fictional example. FysioWater has eight employees. The IGJ asks for a recent independent assessment. The practice has an external auditor test its risk analysis, EHR access, supplier assessment, incident process and backup restoration. The report contains interviews, evidence references and three improvement actions. Separately, an EHR supplier in a hospital tender chooses certification, because the contract requires a certificate with a defined scope. Both organisations work on NEN 7510, but their evidence needs differ.
A supplier’s certificate does not prove that your own authorisations, employees and incident process are properly set up. Ask which part of the service falls within the scope, and record your own checks.
Decision guide
First choose the purpose of your evidence. If the goal is supervision and learning, plan an independent assessment with a report that covers all parts. If a contractual certificate is required, discuss the scope and scheme with a suitable certification body. In both cases, start with the NEN 7510 risk analysis, collect evidence that the measures work and plan your improvements.
Frequently asked questions
Is a certificate legally required?
No. According to the IGJ, a certificate is one way to show that you work according to NEN 7510. An independent assessment and demonstrable working practices remain important.
Can someone from another healthcare organisation do the assessment?
Yes, provided the person is competent and operates independently of your policy and implementation. Explain the person’s competence and independence in the report.
How often should I have an assessment?
The IGJ names at least once every three years as the starting point, and expects you to take changes into account. Discuss an appropriate frequency with your assessor and record it.