NEN 7510 What the standard asks of your healthcare organisation, and what you must demonstrate

Dutch healthcare providers have had to work according to NEN 7510 since 2008, from hospitals to sole practitioners; since 1 June 2026 the 2024 version applies. A certificate is not mandatory. An independent assessment is: according to the inspectorate at least once every three years.

By Edward Hasekamp, founder of Exposentry · Published on October 28, 2026

In brief

  1. NEN 7510 is the Dutch standard for information security in healthcare. The Decree on electronic data processing by healthcare providers requires every provider with a healthcare information system to work according to it. The inspectorate stresses that this also applies to sole practitioners.
  2. You must have your information security independently assessed on a regular basis, according to the inspectorate at least once every three years. A certificate is one possible form of that.
  3. If you also fall under the Dutch Cybersecurity Act, NEN 7510 lets you demonstrate that you meet the duty of care. The healthcare cybersecurity regulation recognises it as one of three routes.

What is NEN 7510?

NEN 7510 is the standard "Medical informatics: information security in healthcare". Part 1 describes the information security management system (ISMS): risk assessment, policy, roles, evaluation and improvement. Part 2 contains the controls you select based on that risk assessment, from access control to backups and vulnerability management.

The standard was revised in December 2024 and now follows the structure of ISO/IEC 27001:2022 and 27002:2022. Part 2 combines the 93 controls of ISO 27002 with eight healthcare-specific controls from ISO 27799, such as emergency communication (5.42), external incident reporting (5.43), management training (6.9) and zero trust (8.35). In March 2026 an amendment to part 2 (A1:2026) aligned it with the final ISO 27799 and set out the link with the Cybersecurity Act in annex E; part 1 was unchanged.

Alongside NEN 7510 there are NEN 7512 (secure data exchange between parties in healthcare) and NEN 7513 (logging actions on electronic patient records). The decree refers to all three. They can be viewed free of charge through NEN Connect, under an agreement between the Ministry of Health and NEN; you only need an account.

Is NEN 7510 mandatory?

Yes. Article 3(2) of the Decree on electronic data processing by healthcare providers requires a provider to ensure secure and careful use of its healthcare information system and of the exchange system it is connected to "in accordance with NEN 7510 and NEN 7512". Article 5 requires logging to meet NEN 7513. The decree is based on the Act on additional provisions for processing personal data in healthcare (Wabvpz); according to the inspectorate, the duty has been in the law since 2008.

Healthcare provider here means a provider as defined in the Healthcare Quality, Complaints and Disputes Act (Wkkgz): an institution or a sole practitioner. The Health and Youth Care Inspectorate (IGJ) writes that the standard applies to every provider that processes personal data in a healthcare information system, smaller providers and sole practitioners included. Youth care providers fall under the Youth Act; according to the IGJ, ISO 27001 applies to them.

The decree refers to the latest edition of the standard, and the minister announces in the Government Gazette from when a new edition applies. For the 2024 version that is 1 June 2026 (Staatscourant 2026, 17743). A certificate against the 2017 version may remain in place until 20 February 2027; that is an arrangement in the certification scheme. The statutory standard has been the 2024 version since 1 June 2026.

Who does NEN 7510 apply to?

The law names no professions; they are covered through the Wkkgz definition of healthcare provider. The IGJ has examined or is examining these groups, among others.

Hospitals and clinics
Also independent clinics and GP out-of-hours services. The IGJ has already assessed them.
General practitioners
Including the solo practice. In 2026 the IGJ started supervision through a digital questionnaire at fifty randomly selected GP practices.
Pharmacies
Pharmacies must demonstrably comply with NEN 7510; the Dutch pharmacists' association KNMP published a roadmap in March 2026.
Mental health care
In May 2026, 6 of 87 larger mental health organisations could demonstrate that they work according to NEN 7510.
Elderly care and home care
This is also care within the meaning of the Wkkgz; elderly care has already been assessed by the IGJ.
Physiotherapy, laboratories and other primary care
Count as healthcare providers; the IGJ announced investigations at laboratories and in primary care.

And the supplier of healthcare software, hosting or IT?

The decree imposes duties of its own around electronic exchange systems. Whoever is responsible for such a system must itself work according to NEN 7510, NEN 7512 and NEN 7513 (article 3(1) and article 5). If a legal entity that is not a healthcare provider manages such a system, an independent organisation must establish in an audit report that it complies with NEN 7510 and NEN 7512; that finding may be at most five years old (article 3(4)). . For other suppliers the standard comes through the customer: the IGJ writes that the provider remains responsible itself, must include the requirements in its supplier contracts and must assess their services. In addition, hosting, cloud and managed-service providers can themselves fall under the Cybersecurity Act (annex 1: digital infrastructure and ICT service management), and VECOZO's connection requirements also apply to software suppliers and intermediaries.

What to attach as a supplier to a customer's questionnaire →

Is NEN 7510 certification mandatory?

No. The law, the Cybersecurity Act and the standard do not require a certificate, the IGJ writes. The inspectorate asks for a regular independent assessment, at least once every three years, referring to controls 5.35 and 5.36 of NEN 7510-2:2024. The assessor is not involved in your information security policy: an internal auditor who stands outside it, an external specialist or someone from another healthcare organisation. A small practice without such an internal function therefore turns to an external assessor or a fellow practice.

Some parties ask for more. Since 9 March 2026, for example, VECOZO no longer accepts the shortened TPM (Third Party Statement) as a connection requirement for new parties. The new connection requirements ask for NEN 7510 or ISO 27001 certification, or an assurance report under NOREA guideline 3000A. Parties already connected will hear more later, according to VECOZO. Which party submits which evidence is set out in the connection requirements.

Certification is carried out by a certification body licensed by NEN, under the NCS 7510 scheme. The Dutch Accreditation Council supervises those bodies. Only part 1 can be certified; NEN 7512 and NEN 7513 cannot. Certified organisations are listed in the NEN 7510 register.

If you want to certify: how it works

The certification body assesses your management system in two steps: first the documentation, then an on-site audit in which the auditor looks at your processes in practice. While the certificate is valid, the body returns regularly for surveillance; in the usual certification cycle a certificate is valid for three years, with an annual surveillance audit. Nonconformities can lead to further investigation, suspension or withdrawal.

NEN publishes no indicative prices or lead times. Costs depend mainly on the number of audit days, which follows from the man-day table in the scheme (size, complexity, other certificates). In addition, the certification body pays NEN a contribution once every three years, based on the number of FTEs; it appears on the quote. NEN advises requesting quotes from several bodies. Existing certificates must be converted to the 2024 version before 20 February 2027.

Supervision and sanctions

The IGJ supervises NEN 7510 through the Wabvpz (article 15k). In case of a breach the minister can issue an instruction or impose an order subject to a penalty (article 15l). In case of acute danger an inspector can issue a written order (article 15m). The IGJ cannot impose a fine under the Wabvpz. The inspectorate said so itself in May 2026, when the laboratory Clinical Diagnostics turned out not to meet the statutory standard.

Fines come from the Dutch Data Protection Authority (AP), under the GDPR. Article 32 requires appropriate security, and a breach of it carries a maximum of EUR 10 million or 2 percent of worldwide annual turnover. The AP fined HagaZiekenhuis in 2019 for insufficient log review and missing two-factor authentication; a court later reduced the fine to EUR 350,000. OLVG was fined EUR 440,000 in 2021 because unauthorised staff could view medical records. The IGJ and the AP have cooperation arrangements: the AP looks at personal data, the IGJ at quality of care.

If you fall under the Cybersecurity Act, the Minister of Health, as the competent authority, can impose a fine; the IGJ supervises. A breach of the duty of care or the reporting duty carries at most EUR 10 million or, if higher, 2 percent of worldwide annual turnover for an essential entity (article 80), and EUR 7 million or 1.4 percent for an important entity (article 87).

NEN 7510 and the Dutch Cybersecurity Act

Healthcare providers are listed in annex 1 of the Cybersecurity Act, in force since 15 August 2026. Providers of medium size and above are directly covered, with the duty of care of article 21 and the reporting duty. Medium means 50 employees or more, or turnover and balance sheet total above EUR 10 million, counted including linked enterprises. The healthcare cybersecurity regulation (article 2.1) recognises three ways to demonstrate the duty-of-care measures: with NEN 7510, with ISO 27001 and 27002, or with an equivalent level of protection.

The IGJ is also the supervisor for healthcare under the Cybersecurity Act, and Z-CERT is the designated CSIRT for the sector. According to the IGJ, complying with NEN 7510 already covers a large part of the duty of care. Smaller providers outside the Cybersecurity Act remain obliged to work according to NEN 7510.

The Dutch Cybersecurity Act article by article →Is your organisation covered by the act? →

NEN 7510 checklist: how to approach it

The standard prescribes no fixed order; these steps follow the structure of part 1 and the references in the law, with for each step the evidence an assessor wants to see.

The standard is risk-based: for a small practice, scope, documentation and controls are correspondingly smaller. Pharmacies can find a worked-out plan in the KNMP roadmap.

  1. 0. Appoint someone responsible and secure commitment

    Someone drives it, and the board or practice owner backs it. Without that, the rest stalls.

    Evidence: decision by the board or practice owner, with the assigned role

  2. 1. Define the scope and carry out a risk assessment

    Which processes, systems and locations are covered, and what risks do the data of patients and clients face? You cannot exclude chapters 4 to 10 of part 1 (the management system) if you claim conformity.

    Evidence: scope document and risk assessment

  3. 2. Select your controls and record it

    In the statement of applicability you indicate for each control in annex A whether it applies, why or why not, and whether it has been implemented. Part 2 describes how to implement each control.

    Evidence: statement of applicability

  4. 3. Secure data exchange (NEN 7512)

    For every exchange with other parties in healthcare: who exchanges what, by which route, and how do you ensure identity and confidentiality?

    Evidence: agreements and technical set-up per exchange

  5. 4. Log actions on patient records (NEN 7513)

    The decree requires logging to meet NEN 7513. In addition, regularly review who viewed which record; the AP fined HagaZiekenhuis partly for the absence of that review, and at OLVG the logging was reviewed too rarely.

    Evidence: log report with a record of the review

  6. 5. Manage technical vulnerabilities

    Control 8.8 asks that you know which systems you have and which are reachable from the internet, follow vulnerability information, assess your exposure and remediate in time. This is where the standard comes closest to what an attacker sees from outside.

    Evidence: overview of vulnerabilities found, with remediation and date

  7. 6. Have it independently assessed

    At least once every three years, according to the IGJ, by someone not involved in your information security.

    Evidence: assessment report

  8. 7. Register and set up reporting (under the Cybersecurity Act)

    Register your organisation with the NCSC and have the board approve the measures. Set up reporting of significant incidents: early warning within 24 hours, notification within 72 hours.

    Evidence: NCSC registration and the reporting protocol

Paper and measurement for control 8.8

A management system is largely on paper: policy, risk assessment, statement of applicability. For control 8.8 an assessor wants to see that you know what is reachable from outside, and that you pick up vulnerabilities in time. You partly demonstrate the first with a dated measurement of your external attack surface; that you remediate in time shows from successive measurements alongside your own remediation records. Such a measurement does not see internal systems and medical devices. If you use a cloud-hosted EHR, your supplier manages much of that outside; ask them for their evidence.

Exposentry measures the external attack surface continuously with OpenKAT, the open-source scanner that originated in the Dutch government, and in a subscription delivers a sealed report monthly and on request. That is one part of the evidence for 8.8. The assessment looks at the whole management system, and a scan does not replace a NEN 7510 assessment.

Control 8.8 worked out for healthcare →Free first impression of your domain (passive) →

Frequently asked questions about NEN 7510

Is NEN 7510 mandatory?

Yes, for every healthcare provider that processes personal data in a healthcare information system. The Decree on electronic data processing by healthcare providers (article 3) refers to it, and the IGJ stresses that this also applies to smaller providers and sole practitioners.

Is NEN 7510 certification mandatory?

No. The standard asks for a regular independent assessment (controls 5.35 and 5.36); the IGJ says at least once every three years. Some parties ask for more, such as VECOZO for new connections since March 2026.

Which version of NEN 7510 applies now?

NEN 7510-1:2024 and NEN 7510-2:2024+A1:2026. The minister announced in the Government Gazette (2026, 17743) that this version applies from 1 June 2026.

What is the difference between NEN 7510 and ISO 27001?

NEN 7510-1 follows the structure of ISO 27001; NEN 7510-2 combines ISO 27002 with eight healthcare-specific controls from ISO 27799. For the statutory duty of healthcare providers, NEN 7510 applies. For youth care ISO 27001 applies, and for the Cybersecurity Act the healthcare regulation recognises both.

What does the standard cost?

Nothing. NEN 7510, NEN 7512 and NEN 7513 can be viewed free of charge through NEN Connect, under an agreement between the Ministry of Health and NEN. You only need an account.

Who supervises NEN 7510?

The IGJ supervises through the Wabvpz and is also the healthcare supervisor under the Cybersecurity Act. The Dutch Data Protection Authority oversees the security of personal data and can impose fines under the GDPR. Z-CERT is the CSIRT for healthcare.

Does NEN 7510 also apply to suppliers of healthcare software?

The decree imposes duties of its own only around electronic exchange systems (the responsible party and the manager). For other suppliers the healthcare provider remains responsible: it must include the requirements in the contract and assess the supplier, which is why it asks. Hosting, cloud and managed-service providers can also fall under the Cybersecurity Act themselves.

Sources

Further reading