You supply Dutch healthcare and get NEN 7510 questions
NEN 7510 is the Dutch standard for information security in healthcare. Healthcare providers must comply with it, so they ask their suppliers to show that they have things arranged too. You get questions on certification, access to patient data, logging under NEN 7513, secure exchange under NEN 7512 and where data is stored. A certificate is not always required; evidence is.
Do you supply software, hosting or IT services to a Dutch hospital, mental health institution, GP practice or other healthcare organisation? Then sooner or later you will get questions about NEN 7510. According to NEN, tenders regularly require suppliers to meet this standard.
Why you get these questions
Under the Dutch decree on electronic data processing by healthcare providers (Besluit elektronische gegevensverwerking door zorgaanbieders), healthcare providers must comply with NEN 7510, NEN 7512 and NEN 7513. If they work with your software or services, they must be able to show that this part is also well arranged. NEN puts it this way: the organisation using the software sets requirements, and the supplier must show that the software meets them.
The three standards in brief
| Standard | What it covers | What you are asked as a supplier |
|---|---|---|
| NEN 7510 | Information security in healthcare, based on ISO 27001 | Are you certified? If not, how have you arranged the controls? |
| NEN 7512 | The basis of trust for data exchange | How do you establish who logs in and with whom data is exchanged? |
| NEN 7513 | Logging of actions on electronic patient records | Do you record who viewed or changed which record and when, and can the customer see that? |
NEN 7512 and NEN 7513 supplement NEN 7510. According to NEN, you cannot be certified against them separately.
The new version: NEN 7510:2024
A revised NEN 7510 was published at the end of 2024. According to Kiwa it aligns better with ISO 27001:2022, its structure changed to four themes (people, physical, technological and organisational), and the guidance in NEN 7510-2 is no longer optional. According to Kiwa, holders of a certificate on the old version must have transitioned before 20 February 2027. A customer may therefore ask which version you work to.
Questions to expect
- Are you NEN 7510 or ISO 27001 certified, and what is in scope?
- Where is the data stored, and which sub-processors do you use?
- How do you log access to patient data, how long do you keep the logs and can the customer request them?
- How strong is authentication for healthcare professionals and for your own administrators?
- Do you use real patient data in test or development environments?
- How fast do you report a data breach or incident to the healthcare organisation?
- How are backups, failover and continuity arranged?
How to approach it
- Be clear about your certification. If you have no NEN 7510 certificate, say so and show which controls you do have. See questionnaire without a certificate.
- Make logging demonstrable. An example log entry and your retention period say more than “we log everything”.
- Map your chain. Hosting, backup, email, monitoring: which parties see patient data?
- Align with the data processing agreement. Notification and retention periods must be the same in both.
- Name open items with a plan. Healthcare organisations often work with action plans. An honest plan helps more than an answer that is too good to be true.
How Holdvero helps
We complete your healthcare customer's NEN 7510 or security questionnaire based on your own documentation, with a source for every answer and open items where evidence is missing. Up to 150 questions: Questionnaire Rescue, €695. A tender or large portal falls under the complex questionnaire. Holdvero does not provide NEN 7510 certification or legal advice.
Frequently asked questions
Do I need NEN 7510 certification as a supplier?
Not always. It depends on your customer and the tender. A certificate is the strongest evidence, but many healthcare organisations also accept ISO 27001 or well-evidenced answers with a plan.
Is ISO 27001 enough for healthcare?
It is a good basis, as NEN 7510 is built on it. NEN 7510 adds healthcare-specific requirements. Show how you have arranged those, for example logging under NEN 7513.
What is NEN 7513?
The standard for logging actions on electronic patient records: who viewed or changed which record and when. If your software processes patient data, you will almost certainly get questions on it.
Does this apply to Belgian healthcare organisations?
NEN 7510 is a Dutch standard. Belgian healthcare organisations ask similar questions, often based on NIS2 and CyberFundamentals.
Need help with a NEN 7510 questionnaire?
Within 1 working day you'll hear the price and when you get it back. You only pay after agreeing the price.
Get a fixed price