Skip to content
IT-Checklist

NEN 7510: checklist and advice

Last updated: · IT-Checklist editorial team

NEN 7510 is the Dutch standard for information security in healthcare. If you work with patient data, Dutch law expects you to follow it. Small practices don't need a certificate, but they must be able to show that they protect the data properly.

This checklist is about daily practice: who can open which record, how you send data securely, what you do when the electronic patient record (EPD) is down and how you report a data breach.

Check where your business stands on nen 7510

The free IT check asks you these questions. Then you see your score per topic and advice for every gap. You don't need an account.

Start the IT check →

Why it matters

The 2024 version replaces the old one. Certified organisations must have switched by 20 February 2027 at the latest.

If you send patient data by regular email or WhatsApp, it will go wrong at some point. Then you have a data breach.

If the EPD goes down and there is no plan, care stops. With a fallback plan you have tested, you can keep working.

The 12 questions in this topic, with advice

Each question describes the situation you want to have. The label shows how much the measure weighs in your score. 'Do first' counts the most.

  1. We work with NEN 7510:2024 or have a plan to move from the old version before 20 February 2027.

    Important

    The standard was revised in 2024 and now aligns with ISO 27001:2022. If you are certified against the old version, plan the transition with your certification body in good time. Without a certificate, the new version is still your starting point.

  2. We have carried out a risk analysis for the health data we process: which data, where it is stored and what can go wrong.

    Do first

    Health data is a special category of personal data under the GDPR. Map which systems hold it (EHR, email, calendar, backups) and who can access it. That is the basis for every other NEN 7510 measure.

  3. Someone has been appointed as responsible for information security, and management has approved the security policy.

    Important

    NEN 7510 requires management to take responsibility. Appoint someone who maintains the security policy and tracks progress. In a small practice that can be the practice owner.

  4. Staff can only access the patient data they need for their work, and we review those rights periodically.

    Do first

    Set up roles in your EHR based on job and treatment relationship. Review the rights at least once a year and revoke them immediately when someone leaves. Do not use shared accounts.

    Applies to: SMEs, larger companies

  5. We record who viewed or changed which patient record (logging in line with NEN 7513) and review those logs.

    Important

    NEN 7513 describes how to log access to electronic health records. Ask your EHR supplier whether logging is enabled and agree who checks the logs on a sample basis, so improper access gets noticed.

  6. We only send patient data through secure channels, such as secure healthcare email, and not via regular email or WhatsApp.

    Do first

    Regular email and chat apps are not suitable for medical data. Use a secure email solution or your EHR's exchange system and check the recipient before you send.

  7. We have a data processing agreement and security agreements with every supplier that processes patient data.

    Important

    Think of your EHR supplier, IT provider, hosting and appointment app. Also ask whether they are NEN 7510 or ISO 27001 certified themselves and keep that evidence.

  8. We know how to continue care when the EHR or network fails, and we test whether backups can be restored.

    Important

    Document how you reach the most important data during an outage, such as medication and appointments, and who you call. Ask your supplier how often backups are made and tested.

  9. We have a procedure for security incidents and data breaches, including notification to the Dutch Data Protection Authority within 72 hours.

    Do first

    A data breach involving health data usually has to be reported to the Dutch Data Protection Authority within 72 hours. Keep a register of all incidents, including small ones, and discuss what you learn. Healthcare organisations may also fall under the Dutch Cybersecurity Act.

  10. Laptops, phones and USB sticks containing patient data are encrypted and protected with a PIN or password.

    Do first

    A stolen laptop without encryption is an immediate data breach. Turn on disk encryption (BitLocker or FileVault), use a screen lock and make sure you can wipe a lost device remotely.

  11. Staff regularly receive guidance on handling patient data securely, such as recognising phishing and locking their screen when they step away.

    Important

    Many data breaches in healthcare are caused by a human error, such as an email sent to the wrong recipient. Discuss security in team meetings, have new staff sign a confidentiality agreement and repeat the guidance every year.

    Applies to: SMEs, larger companies

  12. At least once a year we check whether the agreed measures work, for example with an internal audit, and improve where needed.

    Important

    NEN 7510 is a management system: plan, do, check and improve. Plan a yearly internal audit, discuss the results with management and keep a list of improvements with an owner and deadline.

Where to start

  • Appoint someone responsible for information security and have management approve the policy.
  • Check who can access which records and remove rights that aren't needed.
  • Use secure healthcare email for patient data and agree that WhatsApp is not for this.
  • Check that you have a data processing agreement with every supplier that processes patient data.

Common mistakes

  • Assuming the EPD supplier takes care of everything. The practice remains responsible.
  • Having logging switched on but never checking who opened which record.
  • Not encrypting laptops and phones that hold patient data.

Official sources

Read next

All topics in the checklist