NEN 7510 vs ISO 27001: the difference for healthcare

Both NEN 7510  and ISO 27001  cover information security. The short answer: NEN 7510 is ISO 27001 plus healthcare-specific requirements for patient data. The IGJ (Dutch Health and Youth Care Inspectorate)  and the Autoriteit Persoonsgegevens (Dutch Data Protection Authority)  look primarily at NEN 7510 in healthcare. Which standard suits your organisation? And can you combine them?

This page looks at the choice from the perspective of a healthcare organisation. Are you an IT supplier serving healthcare and unsure which of the two standards to choose? Then read the comparison from the ISO 27001 perspective.

What is the difference between NEN 7510 and ISO 27001?

NEN 7510 is the Dutch standard for information security specifically in healthcare. It is based on ISO 27001, but tailored to patient data.

ISO 27001 is the international standard for information security, applicable in every sector. It provides a broad framework without sector-specific requirements.

In short: ISO 27001 is the foundation, and NEN 7510 adds the healthcare-specific depth. If you serve healthcare with only ISO 27001, you miss some requirements that supervisors and healthcare clients do expect.

What is the overlap between NEN 7510 and ISO 27001?

NEN 7510 is not a standalone standard. It is built on ISO 27001. The structure is identical: the same clauses, the same terminology and largely the same requirements. About 80% overlaps.

The overlap is mainly in the management system. Both standards ask you to determine context and scope, establish policy, carry out a risk analysis, choose measures, train people, monitor and improve. That whole machinery is identical.

Many control measures also overlap. Access management, encryption, back-ups, incident management and supplier agreements appear in both standards. A GP practice that has already set up ISO 27001 properly therefore already has most of NEN 7510 in place.

The remaining 20% is the healthcare-specific depth. That is what makes the difference between “securing information” and “securing patient data”.

What does NEN 7510 add to ISO 27001?

The foundation of ISO 27001 is supplemented with rules that are specifically relevant to protecting patient data.

Logging of access to patient data NEN 7513 specifies that you must record who viewed or changed which patient data, and when. This goes further than the general logging requirements of ISO 27001.

Access based on treatment relationship In healthcare, only someone with a treatment relationship may access patient data. This principle must be built into your access management.

Medical equipment Medical equipment with a network connection also falls under information security. NEN 7510 requires specific attention to this.

Patient rights Patients have the right to access and information about who has viewed their data. Your system must support this.

Data exchange within the care chain Healthcare works in chains. NEN 7512 specifies the basis of trust for exchanging data with other healthcare parties.

Is ISO 27001 enough for healthcare, or do you need NEN 7510?

This is the question on which many healthcare organisations get stuck. The honest answer: ISO 27001 is a strong basis, but for healthcare it is usually not sufficient.

Supervisors and large healthcare clients expect NEN 7510. The Wabvpz (Dutch Act on Supplementary Provisions for Processing Personal Data in Healthcare)  and the IGJ use NEN 7510 as the benchmark for “appropriate measures”. With ISO 27001 alone, you miss logging of access to patient records (via NEN 7513), access based on treatment relationship and patient rights. These are exactly the points that weigh most heavily in a healthcare data breach.

An example: a software supplier for GPs held ISO 27001. A large healthcare group nevertheless asked for NEN 7510, because their processing agreement required healthcare-specific logging requirements. ISO 27001 did not demonstrably cover that.

When do you choose NEN 7510 and when ISO 27001?

The choice depends on your clients and your market. Below is the advice per situation.

Choose NEN 7510 if you are a healthcare provider: hospital, GP, pharmacy, mental health, nursing home, home care. The standard is specific to your sector and is expected by supervisors and partners. Also choose NEN 7510 if you provide services to healthcare and your clients require it, or if you fall under Dutch healthcare legislation.

Choose ISO 27001 if you operate outside healthcare or healthcare makes up only a small part of your clients. ISO 27001 is more broadly applicable and does not carry unnecessary healthcare-specific requirements. Also choose ISO 27001 if you have international clients, because NEN 7510 is only known in the Netherlands. And choose ISO 27001 if you already hold other ISO standards: it fits seamlessly into a management system with ISO 9001 or ISO 14001.

Can you combine NEN 7510 and ISO 27001?

Yes, and for many organisations this is the smartest route. It makes sense if you are a healthcare organisation that also provides services outside healthcare, an IT supplier with both healthcare and non-healthcare clients, or if you need international recognition and must also comply with Dutch healthcare legislation.

You do not have to build two separate systems. The overlap is so large that one integrated system meets both standards. Start with the basis that both share: the management system according to the High Level Structure. Add the ISO 27001 Annex A measures to it. And complete it with the healthcare-specific additions of NEN 7510.

The result is one information security management system with two certificates.

Combined audit

Choose a certification body that offers both standards. You can combine the audits: one auditor assesses your system against both standards. The audit days largely overlap, so you save time and money.

Not all bodies are allowed to certify both standards. Check whether the body is accredited for both ISO 27001 and NEN 7510.

Costs and time

A combined certification does not cost double. Because of the large overlap, you should expect roughly 30-50% extra costs and time on top of a single certification. Your documentation is integrated and preparation is more efficient.

Converting from ISO 27001 to NEN 7510

Do you already have ISO 27001 and want to add NEN 7510? The step is relatively small.

You already have the management system, the risk analysis, the measures and the improvement cycle. What you add are the healthcare-specific additions.

Step 1: Analyse the delta. Which NEN 7510 requirements are not yet covered? Focus on logging (NEN 7513), access based on treatment relationship, medical equipment and patient rights.

Step 2: Adjust your risk analysis. Make sure patient data is explicitly included and the healthcare-specific risks have been assessed.

Step 3: Update your Statement of Applicability with the additional measures from NEN 7510-2.

Step 4: Implement the missing measures. These are typically logging, adjustments to access management and documentation of patient rights.

Step 5: Request the NEN 7510 audit. The auditor can focus on the delta compared with ISO 27001.

Expect 2-4 months of additional lead time and 20-30% extra costs on top of the ISO 27001 certification.

Converting from NEN 7510 to ISO 27001

The other way round works in a similar way. With NEN 7510, you already have a complete information security management system. The structure meets the ISO 27001 requirements.

What you check are the generic ISO 27001 requirements that are not healthcare-specific. In practice there are few gaps. Most organisations with NEN 7510 already largely meet ISO 27001.

The audit can focus on confirming that your generic measures also work outside the healthcare context.

Differences in practice: where do you notice it?

On paper, the standards look very similar. In daily practice, you notice the difference in a few concrete places.

Access management. Under ISO 27001, you regulate access based on risk and function. Under NEN 7510, access to a patient record must be traceable to a treatment relationship. A doctor’s assistant cannot simply open any record, only those of patients in their work process.

Logging. ISO 27001 requires logging in a general sense. NEN 7510 refers to NEN 7513: every time someone opens, changes or prints a record, this is recorded and can be requested by the patient.

The auditor. An ISO 27001 auditor tests your management system. A NEN 7510 auditor probes healthcare-specific points: show us your logging, how do you regulate the treatment relationship, how do you secure infusion pumps or ventilation equipment on the network?

Processing agreements. Healthcare clients refer to NEN 7510 in their contracts, not to ISO 27001. If you supply software or manage IT for healthcare, deals sometimes stall on exactly this point. Read more in NEN 7510 for IT suppliers.

Recognition by clients

In the Netherlands

Dutch healthcare organisations and supervisors expect NEN 7510. The IGJ, health insurers and large healthcare institutions know the standard and accept it as evidence.

ISO 27001 is also accepted, but an auditor or supervisor may ask additional questions about the healthcare-specific aspects that NEN 7510 explicitly covers and ISO 27001 does not.

Internationally

Outside the Netherlands, NEN 7510 is unknown. International clients, including in healthcare, ask for ISO 27001.

If you work internationally, you need ISO 27001 for recognition. NEN 7510 then adds value for your Dutch healthcare clients.

Conclusion: NEN 7510 or ISO 27001?

If you work in or for Dutch healthcare, NEN 7510 is the starting point. ISO 27001 is a strong basis, but does not demonstrably cover the healthcare-specific requirements. If you also serve non-healthcare clients or foreign markets, combine both standards in one system. Start with the step-by-step plan and read what the requirements of NEN 7510 involve.

More information

• What is ISO 27001? - Introduction to the international standard
• ISO 27001 vs NEN 7510 - Comparison from an ISO perspective
• Requirements of NEN 7510 - What does the standard require?
• NEN 7510 step-by-step plan - How do you start?
• NEN 7510 costs and timeline - What does it cost?