NEN 7510 is the Dutch standard for information security in healthcare. It is based on ISO 27001 and sets specific requirements for the way healthcare providers, and their suppliers, handle medical and personal data.
Medical data belongs to the most heavily protected category of personal data under the GDPR. A security incident in healthcare can literally put lives at risk. NEN 7510 provides the framework to manage that risk structurally.
NEN 7510
NEN 7510 is mandatory for, or relevant to:
This is a Dutch standard, but it does not stop at the border: supply the Dutch healthcare sector from abroad and your customer will ask you to meet it. Even when your role is relatively small, as a software supplier or IT support provider for a GP practice for instance, you can be obliged to comply with NEN 7510 or to demonstrably contribute to it.
The obligations
NEN 7510 follows the structure of ISO 27001 but adds healthcare-specific requirements. The most relevant ones for smaller suppliers are:
Our contribution
The Sentinel package offers the broad set of technical measures NEN 7510 requires of suppliers to the healthcare sector.
01
The password manager limits system access to authorised people and replaces weak passwords with strong, unique ones per account. Combined with monitoring for leaked passwords, you detect compromised logins immediately.
02
Uptime monitoring and website and domain protection watch over the reachability of your systems. DDoS protection keeps attacks meant to disrupt your service outside the door.
03
The automated quarterly scans in Sentinel detect known weaknesses in your network and infrastructure before they are exploited. NEN 7510 requires regular technical testing of security measures.
04
DMARC, SPF and DKIM stop email being forged in your organisation’s name. In healthcare, email fraud is a particular risk because staff exchange sensitive information by email.
05
Security awareness training and phishing simulations train staff to recognise threats. NEN 7510 requires demonstrable security awareness at every level of the organisation.
Please note
Orange Warriors delivers technical security measures that contribute to compliance. We do not issue certification and we are not a legal adviser. Whether you fully meet a guideline also depends on organisational measures, policy and documentation that fall outside our services.
The official NEN 7510 standard (nen.nl)FAQ
NEN 7510 is not written into law directly, but the GDPR requires healthcare providers to secure special categories of personal data appropriately (medical data is a special category under art. 9 GDPR). NEN 7510 is the recognised Dutch standard for what counts as "appropriate" in the healthcare sector.
Certification is not always mandatory, but demonstrable compliance is. Larger healthcare providers and insurers increasingly require suppliers to show they meet the standard. We help you take the technical measures and document them.
NEN 7510 is based on ISO 27001 but adds healthcare-specific requirements for protecting medical data. If you meet NEN 7510, you largely meet the security ISO 27001 requires as well.
Free scan
Sentinel bundles the technical measures NEN 7510 asks of healthcare suppliers. We look at where your organisation stands, free of charge.
