This article was published in 2020. Laws, case law and regulatory guidance may have changed since then. Contact us for up to date advice.
When must my healthcare institution comply with NEN 7510?
Healthcare institutions are faced with more and more laws and regulations in order to meet quality standards. It is no longer sufficient to write a standard quality manual. Healthcare institutions must comply with the NEN 7510 standard . NEN 7510 provides a framework for information security in healthcare. NEN 7510 is important for the way in which you organise information security within your organisation.
Healthcare institutions must comply with NEN 7510
The Regulation on the use of the citizen service number in healthcare (Regeling gebruik burgerservicenummer in de zorg) stipulates that data processing must comply with the NEN 7510 standard. This regulation is a further elaboration of the Decree on the use of the citizen service number in healthcare (Besluit gebruik burgerservicenummer in de zorg). In other words, healthcare institutions must make efforts to secure the personal data of their clients. The obligations under the NEN 7510 standard apply to all processing of patients’ personal data. Because data exchange between healthcare providers increasingly takes place electronically, this standard also covers data exchange between healthcare providers. The security requirements included in NEN 7510 relate to all available information. NEN 7510 also covers patient information in an electronic client record (ECD).
Does NEN 7510 apply only to healthcare institutions?
NEN 7510 applies to all organisations within healthcare. This means that NEN 7510 applies both to the individual healthcare provider and to healthcare institutions operating in an organised setting. NEN 7510 also applies to organisations focused on information provision in healthcare. For example, a hosting company or online marketing agency with healthcare organisations as clients must comply with the provisions of NEN 7510.
For suppliers to healthcare institutions, such as organisations that process patient information, the standard is in principle not mandatory. The provisions of NEN 7510 relate primarily to healthcare institutions. In practice, we see that many healthcare institutions also expect their suppliers to comply with NEN 7510, just as they do.
Additional requirements for suppliers
As a healthcare institution, you can impose additional requirements on a supplier when purchasing services from that supplier. Not meeting (or being unable to meet) the requirements you set may lead to the supplier being excluded. Your suppliers can, however, prevent this by voluntarily obtaining certification for the NEN 7510 standard.
NEN 7510 in relation to NEN 7512 and NEN 7513
In addition to the provisions of the NEN 7510 standard, as a healthcare institution you also have to deal with NEN 7512 and NEN 7513. As a healthcare institution, regardless of your organisational form, size and the care provided, you must also comply with these standards. NEN 7512 contains provisions on the measures you must take as a healthcare institution when exchanging patient data. NEN 7513 contains specific provisions on recording actions in electronic patient records. Both the legislator and trade associations in healthcare refer to this as ‘logging’.
Supervision of compliance with the NEN standards
Healthcare institutions must therefore comply with the provisions of the NEN 7510 standard. Adequate protection of personal data and information security in healthcare are important issues. The Health and Youth Care Inspectorate (Inspectie Gezondheidszorg en Jeugd, IGJ) supervises the safeguarding of quality within healthcare institutions. The IGJ is therefore the competent supervisory authority in this respect. This does not alter the fact that the Dutch Data Protection Authority (AP) is the competent supervisory authority for relevant issues related to the General Data Protection Regulation (GDPR) and data breaches. In practice, you may therefore have to deal with both the IGJ and the Dutch Data Protection Authority, which can lead to confusing situations.
Support with implementing NEN 7510
At Privacy Direct, we can support your organisation with the implementation of NEN 7510. Would you like to know more about the options? Please feel free to contact us.