NTA 7516: secure email in healthcare

NTA 7516 is the Dutch technical agreement for sending and chatting securely with personal health information. The current version is NTA 7516:2019, managed by NEN . The standard translates the GDPR and NEN 7510 into concrete requirements for email: availability, integrity, confidentiality, ease of use and interoperability between suppliers.

NTA 7516 is not (yet) legally mandatory. However, if you email about patients without suitable measures, you will not comply with the GDPR. Professional bodies such as the KNGF (Royal Dutch Society for Physiotherapy) therefore advise this: if you ever email health information, work according to NTA 7516. Below you can read what the standard requires and how to put it into practice in a healthcare setting.

What exactly is NTA 7516?

An NTA is a Dutch technical agreement: a document that is produced more quickly than a full NEN standard. NTA 7516 was published in May 2019, at the request of the Informatieberaad Zorg (Healthcare Information Council). More than 50 experts from healthcare providers and suppliers contributed.

The standard covers ad hoc messages. Think of a physiotherapist who emails a report to the GP, or a practice that sends a patient their test result. Structured exchange between systems, such as via the Landelijk Schakelpunt (National Switch Point), falls under NEN 7512.

Feature	NTA 7516
Current version	NTA 7516:2019
Managed by	NEN
Subject	Ad hoc exchange of health information by email and chat
Mandatory?	No, but it is the way to meet the GDPR requirements for email
Cost	Free to order from NEN
Revision	Since early 2024, being split into NEN 7516 part 1 (email) and part 2 (chat)

What does NTA 7516 require?

The standard sets requirements in five groups. Your secure email supplier fills in a large part of these. You arrange the rest yourself, with policy and working agreements. This grouping comes from the secure email toolkit of the KNMP (Royal Dutch Pharmacists Association) , which summarises the criteria in chapter 6 of the standard.

Group	Criteria in the standard	What this means in practice
Availability	Minimum availability, maximum downtime, maximum data loss	Messages arrive, even during an outage
Integrity	Proof of origin, data integrity, non-repudiation, sender authorisation	You know who sent it and that it has not been changed
Confidentiality	Data, access and communication confidentiality, grounds for sending, international traffic	Encrypted, and only the right recipient can open it
Ease of use	Security as convenience, readability, own copy	Secure email is no harder than ordinary email
Interoperability	Record linking	Messages can be added to the record

According to the same toolkit, the standard requires that a recipient signs in with a means at “substantial” eIDAS level before opening a message. In practice, this means two-step verification, for example a password plus an SMS code.

What policy do you need to create yourself?

Alongside the technology, NTA 7516 requires your practice to record working agreements. These are the topics, with an example agreement you can adopt.

Topic	Example agreement
Cover during absence	A colleague from the same discipline is given temporary access, recorded in the EHR
Shared mailboxes	Only assistants and practitioners have access to info@
Address book	Email addresses of referrers come only from the healthcare address book, not from autocomplete
Recalling messages	Recall a wrongly sent message immediately and register it as an incident
Keeping and destroying	Relevant emails go into the record, the rest are deleted after one year
Grounds for sending	Only email when there is a treatment relationship or the patient has consented
Service disruption	In case of an outage, use secure post or telephone, never ordinary email
Informing patients	The website explains how patients can contact the practice securely

An appointment confirmation by email can already contain health information. “Your appointment with the physiotherapist” reveals that someone is in treatment. The KNGF therefore advises sending all your email securely if you ever email health information.

Example: secure email in a physiotherapy practice

Fictional example. Physiotherapy De Linde has six practitioners. They email final reports to GPs and send patients exercise schedules. Until last year, this was done by ordinary email.

The practice chooses a secure email service that works according to NTA 7516 and asks the supplier which parts of the standard the service does not cover. GPs now receive messages directly in their own secure environment. Patients receive a notification and open the message after entering an SMS code.

A patient emails an X-ray report to the practice from Gmail. The standard does not set requirements for patients, but the practice does not reply within the same insecure email chain. It sends its reply through the secure service and points the patient to the contact form on the website.

How do you check whether a supplier meets NTA 7516?

Until May 2022, suppliers could be certified against NTA 7516, the KNGF reports. A certificate is therefore no longer a reliable check. NEN does require suppliers to be transparent about the parts of the standard they do not cover.

So ask your supplier for an overview per requirement: what do they arrange, and what must you arrange? Record this in your processor agreement (verwerkersovereenkomst) and in your NEN 7510 supplier assessment.

NTA 7516 and NEN 7510

NTA 7516 is a specific way of applying NEN 7510 to email and chat. If you work according to NTA 7516 for email, you have arranged that part of NEN 7510. In your risk analysis you name email as a channel, and in your statement of applicability you refer to the measures.

An email sent to the wrong recipient with patient data is a data breach. Read reporting a data breach to see when you must report it to the AP (Dutch Data Protection Authority) within 72 hours.

What is changing with NEN 7516?

Since early 2024, NEN has been revising NTA 7516 on behalf of the Ministry of Health, Welfare and Sport (VWS). The agreement is being converted into a NEN standard for secure email and chat applications, with part 1 for email and part 2 for chat. Technical agreements will be set out in separate documents, such as NTA 7531 for email.

A publication date is not yet known. The NEN standard will go through a public consultation of at least three months. Until the new standard appears, NTA 7516:2019 remains the reference framework.

Frequently asked questions about NTA 7516

Does NTA 7516 set requirements for patients?

No. The standard does not set requirements for patients or their relatives. As a healthcare provider, you are responsible for secure communication, even if a patient emails insecurely themselves.

Does NTA 7516 also cover chat?

Yes. The full title of the standard covers secure email and chat applications. In the revision, email and chat each get their own part.

Do I need to follow NTA 7516 if I never email patient data?

No. According to the KNGF, you do not then need to comply with NTA 7516. Do note that even an appointment confirmation can already contain health information.