NEN 7510 is the Dutch standard for information security specifically for the healthcare sector. The standard describes requirements for an Information Security Management System (ISMS) with additional measures relevant to the processing of health information.
Healthcare providers, hospitals, GP practices, mental healthcare institutions, and ICT suppliers serving the healthcare sector.
Small practice (GP, physiotherapist)
Rule of thumb: Small practice €5,000-€8,000 first year, medium-sized institution €8,000-€15,000 first year.
Prices indicative, excl. VAT, excl. consultant and internal hours.
Full cost breakdown- Which locations, systems and processes are covered by the ISMS? In most healthcare organisations this is the entire organisation.
- Identify risks to patient data and healthcare information. What threats are there? What are the consequences? This is the heart of NEN 7510.
- Implement controls, establish policies, train employees, document processes.
- Work under your ISMS for a minimum of three months. Auditors want proof that the system works in practice.
- Check yourself whether everything is working and have management formally assess the ISMS.
- The certification body carries out the audit in two phases. If successful you will receive the certificate.
Your certificate remains valid during and after the switch. The new certification body takes over the certification for the same standard and within your existing certification cycle. There is no interruption in your certificate status.
SwitchingA surveillance audit every year. A full recertification every three years. Your certificate is valid for three years, provided you pass the annual audits.
Recertification
“Thanks to CertificeerWijzer we switched to a certification body that fits our organisation much better. We save €1,500 a year and the audits are at least as good.”
Working in line with NEN 7510 is a legal requirement for all Dutch healthcare providers (Decree on electronic data processing by healthcare providers). Certification itself is not mandatory, but it is the most common way to demonstrate compliance to supervisors and partners in the care chain.
NEN 7510 is based on ISO 27001 but contains additional requirements specific to the healthcare sector, such as protecting patient data and medical equipment. ISO 27001 is international, NEN 7510 is Dutch and healthcare-specific. Many organisations combine both standards.
NEN 7510:2024 was published in December 2024. The standard now aligns better with ISO 27001:2022 and NIS2. Existing certificate holders must transition to the new version before 20 February 2027.
Yes, and that is often efficient. Both standards share the same structure. The certification audit can be combined, which saves time and costs. This is especially relevant for IT service providers that also serve healthcare clients.
Only accredited certification bodies may certify NEN 7510. In the Netherlands, these include Brand Compliance, BSI, DEKRA, DNV, Kiwa, LRQA and TÜV NORD.
NEN 7512 covers secure data exchange between healthcare providers. NEN 7513 sets requirements for logging access to patient records. Both build on NEN 7510 and cannot be certified separately.
Completed in 5 minutes. Then tailored quotations from certification bodies that suit you.
