NEN 7510: the information security standard for health care

Any organisation that processes patient data in the Netherlands must comply with NEN 7510, the Dutch standard for information security in health care. Hospitals, GP practices and care homes know this standard well. For software companies, cloud providers and international scale-ups entering the Dutch market, it often comes as a surprise. This article explains what NEN 7510 is, who it applies to and how it relates to ISO 27001. We then describe a practical approach for implementing it, based on our experience helping health tech companies extend their existing ISMS. This page is part of our series on ISO 27001 controls and our free ISO 27001 and GDPR templates.

What is NEN 7510?

NEN 7510 is the Dutch standard for information security in health care, published by the Royal Netherlands Standardisation Institute (NEN). It is based on ISO 27001 and ISO 27002 and adds health care-specific requirements. The idea behind it is simple: in health care, a security problem quickly becomes a patient safety problem. Patient data must be kept confidential, but it must also be available and correct when a doctor needs it.

The current version consists of two parts:

• NEN 7510-1:2024 contains the requirements for an information security management system (ISMS) in health care. This is the part you can be certified against.
• NEN 7510-2:2024 contains the controls and implementation guidance, including health care-specific guidelines for many controls.

The 2024 version was published on 16 December 2024 and is aligned with ISO 27001:2022 in both structure and content. Like ISO 27001, it follows the Harmonised Structure and the Plan-Do-Check-Act cycle: you analyse your risks, decide on measures, implement them, check whether they work and improve where needed.

Who needs to comply with NEN 7510?

Since 2008, Dutch health care providers have been legally required to work according to NEN 7510. This follows from the “Wet aanvullende bepalingen verwerking persoonsgegevens in de zorg (Wabvpz)” and the underlying “Besluit elektronische gegevensverwerking door zorgaanbieders”, on top of the GDPR. The Health and Youth Care Inspectorate (IGJ) supervises compliance and sees information security as part of patient safety. Working according to the standard is mandatory; certification is not. The law requires that you comply. A certificate is the most convincing way to show that you do, but it is not a legal requirement. Suppliers are affected too. The legal duty rests with the care provider, but providers can only comply if their software, hosting and service suppliers do as well. Dutch health care customers therefore ask for evidence of NEN 7510 compliance in contracts and tenders. So if you sell a health care app, an electronic patient record or an AI tool to Dutch doctors, you should treat NEN 7510 as a requirement for entering the market, even though no law names your company directly.

NEN 7510 and ISO 27001

If you already have ISO 27001, you have done most of the work. NEN 7510 uses the same chapters 4 to 10 (context, leadership, planning, support, operation, evaluation and improvement) and the same Annex A controls. You do not need to rebuild your management system. You do need to use it: update the context analysis, add new risks, and implement new controls. NEN 7510 adds three things to ISO 27001:

• Patient safety as an explicit risk. Your context analysis, stakeholders and risk register must reflect that unavailable or incorrect patient data can harm patients.
• Health care-specific controls. Several controls are sharpened (marked “HLT” in the standard), and a few new ones are added. Examples are uniform classification of health data as confidential, unique identification of patients in your system, two-factor authentication for systems with health data and management training. See our overview of the extra controls (article in Dutch).
• Health care guidelines. Many controls include additional implementation guidance, for instance, screening staff for valid professional registration. These guidelines are not mandatory, but an auditor will expect you to have considered them.

Implementing NEN 7510

For an organisation with an ISO 27001 ISMS, implementing NEN 7510 is mostly a matter of extending and sharpening what is already there. If you do not have an ISMS yet, start with ISO 27001 and include the steps below in that project. In our experience, the following order works well:

1. Involve the right people. Include the key ISMS roles and the staff who work for Dutch health care customers. Check that at least one person is formally responsible for information security.
2. Create awareness. Start with a workshop on what NEN 7510 requires and why. For international teams, explain that the standard is mandatory in the Netherlands and how it relates to patient safety.
3. Update the context analysis. Add NEN 7510 compliance as an issue. Add stakeholders such as the IGJ, the Dutch Data Protection Authority (AP), patients and medical staff, and record that they expect patient safety and thus available, accurate patient data.
4. Update the risk register. Add patient safety-related risks explicitly. Link each new NEN 7510 control to one or more risks, so it is clear that the control is applied based on risk analysis. Our risk management method can help here.
5. Make an implementation decision for every control. Go through all controls and guidelines and decide how you meet each one. Some controls will not apply to you; exclude them with a short motivation.
6. Update your documentation. Write the documents the new controls require, such as an architecture overview of all external interfaces, an off-boarding checklist and a short design note on patient identification. Then make a new Statement of Applicability that shows which NEN 7510 controls you apply. A compliance platform such as Vanta can generate this, but Excel or Word works fine too.
7. Update your communication. State publicly that you are committed to NEN 7510, either in your existing security statement or in a separate statement for the Dutch market. Make it findable on your website or refer to it in contracts.
8. Train your people. Give staff working for Dutch customers specific training on NEN 7510 and patient safety, and arrange role-specific training for management. You can combine the latter with NIS2 training.
9. Audit and improve. Add a NEN 7510 round to your internal audit programme, which is a requirement in itself. Once everything is implemented, plan a formal review and then decide whether to pursue certification.

In the short term, most of the work is in a correct, clear and demonstrable implementation of the controls. In the long term, the value comes from actually using and improving your ISMS.

Certification

NEN 7510 certification is done by independent certification bodies accredited by the Dutch Accreditation Council (RvA), under the certification scheme NCS 7510. The process is similar to ISO 27001: a two-stage initial audit, yearly surveillance audits and a recertification audit every three years. Many organisations combine NEN 7510 and ISO 27001 in one audit – ISO 27001 certification plus the NEN 7510 controls, without a separate NEN 7510 audit. This is a good first goal, especially for companies that already have ISO 27001. Full NEN 7510 certification takes more effort, but it is the strongest signal of commitment to the Dutch health care sector, and some tenders require it. If you already hold a NEN 7510 certificate based on the 2017 version, keep an eye on the deadline. The two-year transition period started on 20 February 2025, so certificates must be transitioned to NEN 7510-1:2024 by 20 February 2027. New certifications are already done against the 2024 version.

NEN 7510 is not an extra on top of ISO 27001. It is the principles of ISO 27001 applied to a setting where information security directly affects patient safety. For care providers, it is a legal obligation; for their suppliers, it is a practical condition for doing business in Dutch health care. If you already have a working ISMS, the gap is usually small. Focus on updating your context and risk analysis, implement the health care-specific controls and document your choices.

Related standards: NEN 7512 and NEN 7513

NEN 7510 is part of a family of health informatics standards. Two of them are worth knowing, although you cannot be certified against them separately:

• NEN 7512 covers trust in the electronic exchange of health data between parties, such as authentication and the reliability of communication.
• NEN 7513 covers logging of access to electronic patient records. It prescribes which fields to log and how to report on them. If your system contains patient records, ask yourself whether you could answer a patient who wants to know who has viewed their data.

Learn more

ISO 27001 and NEN7510 support: our workshop-based approach for organisations that want to set up their own ISMS and keep control.

Keurmerk 7510: a practical approach to information security for health care in the Netherlands (page in Dutch).

Free templates: ISO 27001 and GDPR templates you can use as a starting point for your NEN 7510 documentation.

SieuwertExplains on YouTube: free, detailed video courses on ISO 27001 implementation.

Training: classroom and online courses on implementing and auditing ISO 27001.
If you have questions about NEN 7510 or want to know what it means for your organisation, feel free to email us.

Image credit: Sasun Bughdaryan via unsplash