NEN 7513:2024 implementation for EHR, GP information system and client record suppliers

NEN 7513:2024 helps suppliers of electronic patient records (EPD, in Dutch: elektronisch patiëntendossier), GP information systems (HIS, in Dutch: huisartsinformatiesysteem) and electronic client records (ECD, in Dutch: elektronisch cliëntendossier) to demonstrate the logging of actions on personal health information. The current standard was published on 1 December 2024 and replaces the 2018 edition (NEN 7513:2024 ). This page translates the implementation into acceptance tests and handover to the healthcare provider. For the organisational side, also read NEN 7513 logging and NEN 7510 for IT suppliers.

The standard page describes the data needed for information needs and logging, guidance for healthcare providers and requirements for information systems. Use the full standard as your assessment basis. The test card below is a working method of our own and does not replace the standard text or a contract.

Start with an event model

For each action, make clear what happened, on which personal health information, by which actor and through which channel. Also record which context the healthcare provider needs to understand an event. Align the exact fields with the standard, the system design and the contract. Avoid patient data in development and test environments. The audit trail is the coherent log that lets you trace those actions later.

Test area	Acceptance question	Evidence for release
Viewing	Does a read action appear with the actor, time and the record involved?	Test log and expected versus actual comparison
Changes	Is it visible what a change or correction did?	Audit trail of the before and after situation
Roles	Is the action linked to a real user or a technical account?	Role matrix and account test
Exchange	Is an export, import or chain action recognisable?	Message ID, system log and error scenario
Retrievability	Can an authorised administrator produce a usable report?	Export test with search criteria and response time
Integrity	Can an ordinary user change the audit trail without it being noticed?	Permissions, change and recovery test

The test must also include negative scenarios. For example, test an interrupted session, a refused viewing request, a duplicate action, a clock deviation and a temporary fault in log processing. A green happy flow does not prove that errors remain visible.

Technical acceptance tests

Run tests in an environment with synthetic records. Record the test date, version, configuration, tester and result. Have a second person repeat the critical tests. If logging happens asynchronously, check the maximum delay agreed in the design and the contract.

Then check administrator rights. An application administrator who can export logs does not automatically need the right to delete logs. Test whether a failed change is traceable and whether timestamps are unambiguous. Also check the storage arrangement, back-up and recovery procedure in line with the agreements with the healthcare provider.

An audit trail shows that an account performed an action. It does not prove that the access was lawful. The healthcare provider must be able to assess the reason, the treatment relationship and the authorisation separately.

Handover to the healthcare provider

Before going live, create a responsibility matrix. The supplier describes which events the product logs, how the client requests the logs, which settings the client manages and how incidents are reported. The healthcare provider describes who assigns roles, who checks periodically and how a deviation is followed up.

Fictional example: EPD Nova. EPD Nova adds context to the existing log line “record opened”: user, patient record, action, time, reason field where applicable, and channel. In release acceptance, the team tests three roles, a refused viewing request and an export over one week. At handover, Zorggroep Linde receives a configuration sheet, a test report, a manual for viewing requests, an escalation contact and a list of client settings. The care group repeats the sample check in its own production process.

Handover item	Who provides it?	When to check?
Audit trail data dictionary	Supplier	At release and at each change
Test report and known limitations	Supplier	Before go-live
Role and logging configuration	Jointly	At set-up and at periodic review
Procedure for viewing and export	Healthcare provider with supplier	For incident investigation
Reporting route and response times	Jointly	At contract review

Version management and supplier evidence

Link every change to a release ID and an impact analysis. Note whether field names, export formats, retention periods or rights change. Give healthcare clients enough time to update their risk analysis, Statement of Applicability (SoA) and test set. A product report supports the client, but it does not automatically make the supplier NEN 7510 certified or the client automatically compliant.

Frequently asked questions

Is a logging screenshot enough for acceptance?

No. Also show test cases, roles, error scenarios, export and integrity checks. The evidence must be repeatable.

Must every healthcare client run the same test?

The supplier can provide a product test set. In addition, the healthcare provider must test its own configuration, processes and responsibilities.

Does NEN 7513 replace NEN 7510?

No. NEN 7513 covers logging. NEN 7510 covers the broader management system and measures for healthcare information.