IT for healthcare

What is NEN 7510?

NEN 7510 is the Dutch standard for information security in healthcare. It is derived from the international ISO 27001 and 27002 standards, but translated to healthcare practice: where the general standard speaks of 'information', NEN 7510 specifically covers personal health information and the systems that process it. The standard has two parts. NEN 7510-1 describes the management system (ISMS): policy, risk assessment, management responsibility and an improvement cycle. NEN 7510-2 contains the concrete controls — from access management and logging to backup, physical security and supplier management. Complementary standards are NEN 7512 (secure data exchange between healthcare parties) and NEN 7513 (logging: who accessed which record and when).

Who must comply with NEN 7510?

The standard applies to every organisation that processes personal health information. That includes hospitals and mental health institutions, but equally GP, dental and physiotherapy practices, pharmacies, midwives, home-care organisations and the IT suppliers working for them. Compliance is not optional: the Dutch Decree on electronic data processing by healthcare providers (Begz) explicitly designates NEN 7510, NEN 7512 and NEN 7513 as the standards to apply, and the GDPR requires 'appropriate technical and organisational measures' — in Dutch healthcare the Data Protection Authority and the Health and Youth Care Inspectorate test that requirement against NEN 7510 in practice. Health insurers and regional partnerships also increasingly require demonstrable compliance when contracting. Important: the standard also reaches your suppliers. Any IT party that hosts or manages healthcare data must comply with NEN 7510 itself — a practice working with a non-certified IT supplier has a gap in its own accountability.

How do you demonstrate compliance?

Demonstrable compliance is more than having the technology in order; the core is a working management system you can show. In practice that comes down to five steps. 1. Risk assessment: map where health data lives (EHR/practice software, e-mail, workstations, backups) and which risks apply. 2. Policy and responsibilities: record who is responsible for information security, how authorisations are granted and revoked, and how incidents are handled. 3. Implement controls: multi-factor authentication, encryption, role-based access, logging in line with NEN 7513 and daily tested backups. 4. Document and practise: data processing agreements with all suppliers, a data breach procedure you rehearse periodically, and awareness training for staff — most incidents start with a phishing e-mail, not with technology. 5. Verify: an independent audit by a certification body makes compliance externally demonstrable; for smaller practices a self-declaration with underlying evidence can be an intermediate step, but under supervision or contracting a certificate carries considerably more weight.

What does this mean for your workspace?

In practice, the workspace is where information security succeeds or fails: that is where people log in, e-mail and work in the patient record. By sourcing the workspace from a NEN 7510-certified partner you inherit a large part of the technical controls — encryption, MFA, logging, backups, patch policy and data centre security are already arranged and documented. The organisational side (policy, authorisations, training) remains your own responsibility, but you do not have to build certified infrastructure yourself. Demonstrability becomes a matter of pointing instead of building.