NEN 7510 is the Dutch standard for information security in healthcare. The certificate shows that your organisation complies with the statutory provisions on the protection of special categories of personal data and on information security. The standard is based on the international standard ISO 27001 and describes the measures you take to secure patient data properly, both internally and when exchanging data with external parties.
Is NEN 7510 a legal requirement?
NEN 7510 is referred to in the Algemene Maatregel van Bestuur (Order in Council) under the Wet gebruik burgerservicenummer in de zorg (Dutch Act on the use of the citizen service number in healthcare). Because the law refers to NEN 7510, the standard is mandatory for healthcare organisations and their suppliers. Highly sensitive patient data must be adequately secured in order to provide responsible care.
Why a NEN 7510 certificate?
The standard is the ideal way to demonstrate that your organisation complies with the rules on information security and privacy protection. You deal not only with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), but possibly also with the Inspectie Gezondheidszorg en Jeugd (IGJ, Health and Youth Care Inspectorate). Every organisation must meet the content of NEN 7510, but how it does so differs per organisation, depending on its size, the number of locations, the number of clients and the volume of data.
Does NEN 7510 apply only to healthcare organisations?
NEN 7510 applies to all organisations in healthcare, from individual care providers to healthcare institutions. Organisations focused on information provision in healthcare must also comply with it. For example, a hosting company or online marketing agency with healthcare organisations as clients must also comply with NEN 7510.
NEN 7510, NEN 7512 and NEN 7513
As a healthcare organisation, you also deal with NEN 7512 and NEN 7513. NEN 7512 contains measures for exchanging patient data. NEN 7513 concerns recording actions in electronic patient records, also known as logging. The three standards are audited together.
Our approach
- Start: a baseline assessment, giving insight into expected time commitment, division of tasks, roles and costs.
- Setting up the management system: a practical, workable Information Security Management System (ISMS) in line with NEN 7510 and your needs.
- Internal audit: a review against the standard, laws and regulations and your internal procedures.
- Management review: an assessment of effectiveness by the board or management.
- Certification support: guidance during the external audit by a certification body.
- Maintenance: periodic updates, so you continue to comply with the standard and the regulations.
Privacy Direct supports clients in a wide range of sectors, from healthcare to IT and marketing agencies. If you wish, we can also act as your Data Protection Officer (DPO) or quality manager, including after the certification process.
Frequently asked questions
Does Privacy Direct issue the NEN 7510 certificate itself?
No. Privacy Direct is not a certification body. We guide you up to and including the external audit by an accredited certification body.