NEN 7510 certification & audit

Information security in healthcare is essential. Negligence can have major consequences for the safety of patients and their medical records. How do you show that you handle this data carefully and confidentially? A NEN 7510 certification gives confidence. You demonstrate that you handle this privacy-sensitive data correctly. You show your patients/clients, suppliers, health insurers and other stakeholders that you have taken the right measures to handle the information security risks when processing this data.

Brand Compliance carries out NEN 7510 certification under accreditation.

NEN 7510 meaning

The NEN 7510 provides guidelines and principles for determining, establishing and enforcing measures that healthcare institutions and other managers of personal health information must take to secure the information provision. NEN 7510 consists of a normative framework in the form of an information security management system (ISMS, Information Security Management System). A risk assessment is required to determine the required assurance of availability, integrity and confidentiality of the information. By implementing the information security management system including the control measures for each of the control objectives, an organization can meet the requirements established in a risk assessment. The standard thus provides a basis for confidence in the careful provision of information at and between the various organizations in the healthcare sector.

NEN 7510 certification

With a NEN 7510 certificate you show that you, as an organization, handle the information that is processed within your service provision responsibly. It proves that you have set up a management system that meets the standard. This standard means, among other things, that information security measures have been taken to guarantee the availability, integrity and confidentiality of the (personal health) information. The certificate is issued by an independent party after inspection and testing of your management system. For example, patients, clients, health insurers, MedMij and regulators can rely on you to handle (personal health) information responsibly.

The advantage of a certification is that it shows that your organization has implemented procedures to ensure the information security of patient data. In addition, the management system processes help your organization to better manage and continuously improve information security.

NEN 7510 certification requirements

The requirements of NEN 7510 are described in the standard. A number of requirements are described below so that you get an idea of what kind of requirements you must meet in order to be certified:

1. Information security: taking measures to ensure the availability, integrity and confidentiality of information.
2. Information security policy: a policy containing the obligations for employees with regard to the subject of information security.
3. Security organization: setting up an organizational structure and assigning responsibilities and authorities for the implementation and maintenance of information security measures.
4. Risk management: identifying, assessing, handling, managing and monitoring risks to the availability, integrity and confidentiality of information.
5. Physical access security: putting in place measures to protect physical access and the integrity, confidentiality and availability of information.
6. Logical security: implementing measures to allow only authorized users access to information.
7. Human resources policy: establishing and enforcing measures to ensure the safe use of information.
8. Education and training: providing adequate education and training to all persons involved to achieve a level of information security that meets the requirements of NEN 7510.

How to start with NEN 7510 certification?

Below you will find a NEN 7510 checklist, with the steps that are logically necessary to obtain a NEN 7510 certification:

• Start with the NEN 7510 download (PDF). This can be purchased via, for example, the NEN.
• Schedule a no-obligation introductory meeting with one of our account managers.
• Follow a training to obtain the necessary knowledge about NEN 7510. This is also possible through our BC Academy.
• Implement the NEN 7510 management system in your organization and ensure that it meets the requirements of the standard.
• Carry out an internal audit to check whether the system is working properly and to assess whether your system meets the standard requirements.
• Management must review the results of the internal audit and take any corrective action. You record the conclusion about meeting the requirements in the management review.
• Once you have determined that your organization meets the requirements, a Brand Compliance auditor will independently assess whether your management system meets the requirements of the standard.
• If your organization meets the standard requirements, we provide you with a certificate.

NEN 7510 certification costs

The implementation starts with the purchase of the standard. The costs of the entire process depend on various factors. For example, the complexity of the processes, whether work is done in shifts, the extent to which matters are already in order within the organization, the number of FTEs and locations. The costs for the certification consist of the number of hours that Brand Compliance spends preparing the audit, the audit itself, the reporting and additional costs such as the certificate, administration and travel costs. The fastest way to calculate the costs starts with an introductory meeting.

More information

For more information about everything related to certifications, we have set up our knowledge base, which includes a number of articles under ‘certification process‘.