NEN 7512: trust basis for data exchange in healthcare

NEN 7512 is the Dutch standard for secure data exchange in healthcare. The current version is NEN 7512:2022 , published by the Nederlands Normalisatie-instituut (Netherlands Standardisation Institute, NEN) . The standard describes the assurances that exchanging parties must give each other before they may share patient data. Think of it as the complement to NEN 7510 for everything that goes beyond your own organisation’s walls.

What is NEN 7512?

Every time a GP sends a referral letter to a specialist, or a pharmacy receives a prescription from a prescriber, patient data is exchanged. That exchange introduces risks: how do you know for certain that you are communicating with the right party? How do you ensure the data is not altered on the way?

NEN 7512 answers those questions. The standard sets requirements for the identity of the exchanging parties, the reliability of the connection, and the integrity of the data during transport. It works with five levels of assurance, from low to high. The more sensitive the data, the higher the required level.

Like NEN 7510 and NEN 7513, NEN 7512:2022 is available free of charge via NEN Connect . The Ministry of Health, Welfare and Sport (VWS) made this possible so that all healthcare organisations can consult the standard.

The five levels of NEN 7512

NEN 7512 defines five levels for the reliability of data exchange. The requirements increase per level.

Level	Assurance	Typical area of application
1	Lowest assurance	Public information, not traceable to a person
2	Limited assurance	Administrative data, less sensitive
3	Substantial assurance	Regular patient data for referrals
4	High assurance	Sensitive medical data, specialist care
5	Highest assurance	Maximum security, critical applications

Level 3 applies to most regular healthcare communication. The exact requirements per level are set out in the standard itself.

What exactly does NEN 7512 regulate?

NEN 7512 focuses on the assurances that parties must give each other during an exchange. There are four main topics.

Authenticity: Is the other party who they claim to be? The standard sets requirements for the identification and authentication of healthcare professionals, systems and organisations. This prevents data being sent to the wrong party.

Integrity: Has the data been altered on the way? NEN 7512 sets requirements for signing and checking messages, so that a recipient can be certain they receive what the sender sent.

Confidentiality: Can third parties read the data? The standard sets requirements for encrypting the transport and, at higher levels, for encrypting the content too.

Availability: Can the exchange take place when needed? NEN 7512 sets requirements for the reliability of the exchange infrastructure.

The relationship between NEN 7510, NEN 7512 and NEN 7513

Together, the three standards form the complete framework for information security in Dutch healthcare. They are complementary, not alternatives.

Standard	Full name	What it regulates
NEN 7510	Information security in healthcare	The management system: policy, risks, measures, audits
NEN 7512	Trust basis for data exchange	Secure communication between healthcare parties
NEN 7513	Logging	Recording who viewed which record, and when

NEN 7510 is the roof: the overarching standard you certify against. NEN 7512 and NEN 7513 elaborate on a number of specific control measures named in NEN 7510-2. NEN 7510 says “arrange data exchange securely”, NEN 7512 says “and this is exactly how to do it”.

If you want to be certified against NEN 7510, you do not need to certify separately against NEN 7512. However, you must be able to demonstrate that your data exchange meets the reliability requirements set out in NEN 7510-2. NEN 7512 is the elaboration for that purpose.

NEN 7512 uses the word “must” (normative) for agreements between exchanging parties, whereas NEN 7510 uses “should” for internal measures. This sharper tone is deliberate: between parties exchanging data, voluntary compliance is not acceptable.

Who does NEN 7512 apply to?

NEN 7512 applies to every healthcare organisation that exchanges electronic patient data with other parties.

Healthcare providers that send referral letters, receive results or exchange medication information with pharmacies. GP practices, hospitals, mental health institutions and home care: all of them exchange data on a structural basis.

Chain partners such as laboratories, pharmacists and diagnostic centres that supply data to healthcare professionals.

IT suppliers that build or manage the exchange infrastructure. EHR suppliers, GP information system suppliers, and message brokers in healthcare. They must technically meet the NEN 7512 requirements in their systems.

Healthcare infrastructure parties such as organisations that participate in the Landelijk Schakelpunt (LSP, National Switchpoint) or other national exchange platforms. These platforms make NEN 7512 conformity a condition.

NEN 7512 and the Landelijk Schakelpunt (LSP)

The LSP is the national infrastructure for exchanging patient data in primary and secondary care. Participation in the LSP requires systems and organisations to meet the requirements of NEN 7512. The Vereniging van Zorgaanbieders voor Zorgcommunicatie (Association of Healthcare Providers for Healthcare Communication, VZVZ), which manages the LSP, uses NEN 7512 as the technical standard for reliable exchange.

For GP practices and other small healthcare providers, this is in practice largely arranged through their GP information system supplier. That supplier is responsible for the technical NEN 7512 conformity of the system. Your responsibility lies in using the system and in the organisational part.

NEN 7512:2022: what has changed compared with 2015?

The 2022 version replaces NEN 7512:2015. The main changes are closer alignment with NEN 7510:2022 and a better elaboration of the risk-based approach. The five levels have been tightened and the requirements per level are described more concretely.

The standard also aligns better with modern exchange standards such as FHIR (Fast Healthcare Interoperability Resources), which is increasingly used for electronic data exchange in healthcare.

Practical implications for your organisation

If you implement or certify NEN 7510, include data exchange explicitly in your risk analysis. Ask the question: with which parties do we exchange patient data? Through which channels? At which level of assurance? Is that level appropriate for the sensitivity of the data?

Then check whether your exchange infrastructure meets the requirements. This is often a question for your IT supplier. Ask for evidence: does their system meet NEN 7512:2022? Do they have documentation on this?

Record the outcome in your mandatory documents: in the risk analysis, in the Statement of Applicability and in the processing agreements with your IT suppliers.