IT for healthcare

Our online workspace is ideal for the healthcare sector. Staff get secure access to their applications and patient data from anywhere — at the practice, at home or on the go. EHR hosting — We host your electronic health records in our own data centres. Fast, secure and always available. Exquise, Visiquick, OASE, Simplex and Novadent are already running for peer practices. Dental software — Specialised hosting of Exquise and other dental software. Optimised performance and fully managed. Physiotherapists — Hosting of EHR packages for physiotherapists. See software for physiotherapists for specific support. GDPR compliant — All patient data remains in the Netherlands, in our own data centres. Encrypted at rest and in transit. Managed cybersecurity — 24/7 monitoring, MFA and endpoint protection on top of our ISO 27001 baseline. Standard included in our healthcare packages. 24/7 availability — Healthcare systems cannot go down. Our twin data centres and redundant systems guarantee maximum uptime, and our disaster recovery is tested for the healthcare sector.

What is NEN 7510?

NEN 7510 is the Dutch standard for information security in healthcare. It is derived from the international ISO 27001 and 27002 standards, but translated to healthcare practice: where the general standard speaks of 'information', NEN 7510 specifically covers personal health information and the systems that process it. The standard has two parts. NEN 7510-1 describes the management system (ISMS): policy, risk assessment, management responsibility and an improvement cycle. NEN 7510-2 contains the concrete controls — from access management and logging to backup, physical security and supplier management. Complementary standards are NEN 7512 (secure data exchange between healthcare parties) and NEN 7513 (logging: who accessed which record and when).

Who must comply with NEN 7510?

The standard applies to every organisation that processes personal health information. That includes hospitals and mental health institutions, but equally GP, dental and physiotherapy practices, pharmacies, midwives, home-care organisations. The standard is written for the care provider itself; IT suppliers fall under that provider's supplier policy. Compliance is not optional: the Dutch Decree on electronic data processing by healthcare providers (Begz) explicitly designates NEN 7510, NEN 7512 and NEN 7513 as the standards to apply, and the GDPR requires 'appropriate technical and organisational measures' — in Dutch healthcare the Data Protection Authority and the Health and Youth Care Inspectorate test that requirement against NEN 7510 in practice. Health insurers and regional partnerships also increasingly require demonstrable compliance when contracting. Important: the standard also reaches your suppliers. NEN 7510 requires you, as the care provider, to be able to show that an IT party hosting or managing healthcare data takes appropriate measures, with a data processing agreement and security arrangements. The supplier's ISO 27001 certificate makes that demonstrable; if your supplier cannot show this, you have a gap in your own accountability.

How do you demonstrate compliance?

Demonstrable compliance is more than having the technology in order; the core is a working management system you can show. In practice that comes down to five steps. 1. Risk assessment: map where health data lives (EHR/practice software, e-mail, workstations, backups) and which risks apply. 2. Policy and responsibilities: record who is responsible for information security, how authorisations are granted and revoked, and how incidents are handled. 3. Implement controls: multi-factor authentication, encryption, role-based access, logging in line with NEN 7513 and daily tested backups. 4. Document and practise: data processing agreements with all suppliers, a data breach procedure you rehearse periodically, and awareness training for staff — most incidents start with a phishing e-mail, not with technology. 5. Verify: check periodically whether your controls work, through an internal audit or an independent assessment. The regulations require you to comply with the standard, not to be certified: many smaller practices record their compliance in a self-declaration with underlying evidence, and a certificate is a choice that mainly comes up when a health insurer or regional partnership asks for it.

What does this mean for your workspace?

In practice, the workspace is where information security succeeds or fails: that is where people log in, e-mail and work in the patient record. By sourcing the workspace from an ISO 27001-certified partner you inherit a large part of the technical controls — encryption, MFA, logging, backups, patch policy and data centre security are already arranged and documented. The organisational side (policy, authorisations, training) remains your own responsibility, but you do not have to build certified infrastructure yourself. Demonstrability becomes a matter of pointing instead of building.