NEN 7513 logging: mandatory recording alongside NEN 7510

Every time someone opens a patient record, that access must be recorded. NEN 7513 is the Dutch standard that sets out how logging works in healthcare. It elaborates on a measure in NEN 7510 and is anchored in law in the Besluit elektronische gegevensverwerking door zorgaanbieders (Dutch Decree on electronic data processing by healthcare providers), under the Wabvpz (Dutch Act supplementary provisions for processing personal data in healthcare) . For certification, you must be able to demonstrate that your logging is in order.

Why is logging mandatory in healthcare?

Imagine a well-known Dutch public figure is admitted to hospital. Journalists want to know what is wrong. A curious employee looks at the record “just to see”. Without logging, nobody would ever find out.

Or closer to home: an ex-partner works at the GP practice. She looks at your record to see whether you have a new relationship. Without logging, there is no evidence.

Logging is the basis for accountability. It makes it possible to check who had access to which patient data, and when. That matters for privacy, for trust, and for investigations when something goes wrong.

The legal basis of NEN 7513 logging

Since 1 July 2020, patients have had the right to know who has viewed their record. This is set out in the Wabvpz (Dutch Act supplementary provisions for processing personal data in healthcare) . If a patient asks who has looked at their record, you must be able to tell them.

NEN 7513 describes how to arrange this technically and organisationally. The standard is not optional. The inspectorate can ask about it. And after a data breach or complaint, you need the logs to find out what happened.

NEN 7513 requirements: what must you log?

The core is simple: record who did what with patient data, and when. The standard makes this concrete. The table below is a simplified practical example. Check the exact fields and event types for your systems against the current standard.

Element	What you record	Example
Who	The employee or system, traceable to a person	J. de Vries (user ID 4471)
When	Date and time, precise enough for a timeline	2026-03-12 09:14:07
What	The action: opening, changing, exporting, printing	Record opened
Which patient	Traceable through BSN or patient number	Patient 100245
Why	The basis for access, for example the treatment relationship	Treatment relationship, cardiology outpatient clinic

“User at workstation 3” is not enough: you must be able to find out which employee was logged in. You also log more than reading. Changing, exporting and printing are logged too. The basis (“why”) is the hardest to capture. Some systems ask for it explicitly when a record is opened.

Example of a log entry

A fictional example of one logged action:


2026-03-12 09:14:07 | user 4471 (J. de Vries, nurse)
| action: record opened | patient 100245 | department: cardiology
| basis: active treatment relationship | workstation: PC-CARD-07

From this one line, you can later work out who opened the record, when, from which place and for what reason. That is exactly what you need when a patient asks who looked at their record.

Logging must happen automatically. You cannot rely on employees keeping a manual logbook. The system records the access, and the employee cannot bypass it.

Retention period and access to the logs

Two requirements raise most questions in practice: how long do you keep logs, and who may access them? The standard gives direction, and you record the choices you make.

Aspect	Requirement	In practice
Retention period	At least 5 years from when the log entry was written	Record any longer period and the reasons for it
Access to logs	Limited, and access is itself logged	Name the authorised roles and the purpose of their access
Integrity	Logs cannot be changed or deleted without a trace	Append-only storage or hashing
Retrievability	Filterable by patient	Reporting function in the EHR

In the Netherlands, there is a statutory minimum: you keep logs for at least five years, counted from the moment the log entry is written. This was set in the Staatscourant 2019, no. 38007 , based on the Besluit elektronische gegevensverwerking door zorgaanbieders.

Five years is a lower limit. A longer retention period for the medical record does not automatically mean that every log entry must be kept just as long. According to the explanatory notes to the decree, the controller may choose a longer log retention period, but it must be limited and justified. Weigh the interests of patients and employees and record the choice in your logging policy. To see how the log retention period relates to the 20 years for the record itself, read retention period for the medical record.

The logs themselves contain personal data: they show which employee viewed which record. You therefore restrict access to the logs strictly, and that access is logged too. Otherwise a blind spot appears.

The organisational side of NEN 7513 logging

Logging is not only a technical matter. You also need organisational measures.

A log controller. Someone in your organisation is responsible for the logging policy. This does not have to be a full-time role, but someone must be in charge.

A log administrator. Someone manages the logs: makes sure they are stored and protected, and available when needed. This can be the same person as the log controller, or an IT employee.

Agreements with suppliers. If your system runs in the cloud or is managed by an external party, who keeps the logs? What happens when the contract ends? This must be arranged contractually.

The technical requirements for NEN 7513 logging

Your information systems must support logging. Most modern hospital information, EHR and EPD systems do this. But check it.

Logging must be reliable. It must not be possible to change or delete logs without this being visible. Integrity is essential.

Logging must be complete. All relevant actions are recorded. No gaps, no blind spots.

Logging must be available. When you need the logs, you must be able to retrieve them. That sounds obvious, but in practice it sometimes goes wrong, especially during system changes or supplier changes.

What if a patient asks who looked at their record?

This happens. Patients have the right to ask, and they do. How do you handle it?

You must be able to meet the request. That means you can search the logs and filter them for that specific patient. You provide an overview of who had access, and when.

In practice, EHR systems offer this through a reporting function. Sometimes the patient can even view it themselves through a portal.

Keep in mind that the logs are factual. They show that someone had access, not whether that access was lawful. If a patient asks why care provider X looked at their record, you must be able to explain it. “Because they were involved in the treatment” is a valid answer. “We don’t know” is not.

The relationship between NEN 7510, NEN 7512 and NEN 7513

NEN 7513 does not stand alone. It is part of a family of standards for information security in healthcare. This is how they connect.

Standard	Covers	Role
NEN 7510	The management system for information security	The overarching standard you certify against
NEN 7512	Trust basis for data exchange	How do you know you are exchanging data with the right party?
NEN 7513	Logging of access to patient data	Who looked at which record, and when?

NEN 7513 elaborates on one control in NEN 7510-2: the control on logging. NEN 7510 says “you must log”, and NEN 7513 says “and this is how you do it”. NEN 7512 covers a different part: the secure exchange of data between healthcare parties.

If you want to become NEN 7510 certified, you must also meet NEN 7513. The auditor checks whether your logging is in order. This is one of the healthcare-specific parts that distinguish NEN 7510 from ISO 27001.

Practical points to watch

Legacy systems. Not all systems can log properly. Legacy systems from the 1990s sometimes have limited capabilities. This is a risk. Consider replacing them or adding separate logging solutions.

Shadow IT. Do you also use Excel lists, Word documents or WhatsApp groups alongside the official systems? Those fall outside the logging. This is a real problem in many healthcare organisations.

Interfaces. Modern healthcare works with connected systems. Data flows between the hospital information system, the laboratory system, the pharmacy and referring doctors. Is logging kept consistently across all those systems? This requires coordination.

Storage costs. Logging generates data. A lot of data. If you record every action for thousands of patients over many years, you need serious storage capacity. Budget for it.

Analysis. Raw logs are not easy to read. You need tools to search, filter and report on them. Some systems offer this built in. Sometimes you need separate software.

NEN 7513:2024 vs 2018: what has changed?

NEN 7513 was revised in December 2024. The official title is “NEN 7513:2024 Medische informatica - Logging - Vastleggen van acties op persoonlijke gezondheidsinformatie” (Medical informatics: logging of actions on personal health information). The new version is based on the international standard NEN-EN-ISO 27789:2021, on audit trails for electronic health records. This improves alignment with international standards.

The core principles stay the same: record who did what, and when. The changes are in the details, especially in how logging connects to the access control in NEN 7510-2.

Topic	NEN 7513:2018	NEN 7513:2024
Basis	Own Dutch design	Based on NEN-EN-ISO 27789:2021
Types of events	Access and search	Access, search and exchange with third parties
New fields	-	Authorisation protocol, treatment relationship protocol, consent profile, checks at event level
Presentation of logging	Present	Retained, important for patient access

The most important practical difference: the exchange of data with other healthcare parties is now logged separately. The new fields also log the access control from NEN 7510-2, such as the treatment relationship and consent. If your systems still run the 2018 version, check whether they need changing. If in doubt, consult NEN about the transition.

Checklist for your organisation

Is every access to patient records logged automatically?
Can you trace which person had the access?
Are changes, exports and prints logged too?
Has a log controller been appointed?
Are the logs protected against unauthorised access and change?
Are there agreements about retention periods?
Can you meet a patient’s request for access to their logs?
Are there agreements with suppliers about logging and handover when a contract ends?

If you can answer “yes” to all of these questions, you are on the right track. If not, you know where to start.

Working on this further

Want to turn these principles into software and supplier agreements? The implementation check for NEN 7513:2024 contains example tests for registration, access and handover.