NEN 7510 certification
Information security in healthcare is essential. NEN 7510 certification demonstrates
that your organization’s information security management system has been independently
assessed against the requirements of the standard.
Brand Compliance conducts independent NEN 7510 certification
audits under accreditation.
Information security in healthcare
Information security in healthcare is essential. Negligence can have major consequences for the safety of patients and their medical records. How do you show that you handle this data carefully and confidentially? NEN 7510 certification gives confidence. You demonstrate that you handle this privacy-sensitive data correctly. You show your patients, clients, suppliers, health insurers and other stakeholders that you have taken the right measures to manage information security risks when processing this data.
What is NEN 7510 and why is information security in healthcare important?
NEN 7510 provides guidelines and principles for determining, establishing and enforcing measures that healthcare institutions and other organizations managing personal health information must take to secure their information.
NEN 7510 consists of a normative framework in the form of an information security management system (ISMS). A risk assessment is required to determine the necessary assurance of the availability, integrity and confidentiality of information.
By implementing the information security management system, including the controls for each control objective, an organization can meet the requirements established through a risk assessment. The standard thus provides a basis for confidence in the careful handling and exchange of information within and between organizations in the healthcare sector.
What does NEN 7510 certification mean?
With a NEN 7510 certificate, you demonstrate that your organization handles the information processed in the course of providing its services responsibly. It shows that you have established a management system that meets the requirements of the standard.
The standard includes information security measures designed to ensure the availability, integrity and confidentiality of personal health information. The certificate is issued by an independent certification body following an assessment of your management system. This provides assurance to patients, clients, health insurers, MedMij and regulators that your organization handles personal health information responsibly.
Certification demonstrates that your organization has implemented procedures to protect patient information. In addition, the management system processes help your organization manage information security more effectively and continually improve it.
NEN 7510 certification requirements
The requirements of NEN 7510 are described in the standard. Below are several examples to give you an idea of the requirements your organization must meet to obtain certification:
01
Information security
Taking measures to ensure the availability, integrity and confidentiality of information.
02
Information security policy
A policy defining employees’ obligations regarding information security.
03
Security organization
Establishing an organizational structure and assigning responsibilities and authority for implementing and maintaining information security measures.
04
Risk management
Identifying, assessing, treating, managing and monitoring risks to the availability, integrity and confidentiality of information.
05
Physical access security
Implementing measures to protect physical access and the integrity, confidentiality and availability of information.
06
Logical security
Implementing measures to ensure that only authorized users can access information.
07
Human resources policy
Establishing and maintaining measures to ensure the secure use of information.
08
Education and training
Providing adequate education and training to everyone involved to achieve a level of information security that meets the requirements of NEN 7510.
NEN 7510 certification process (step-by-step)
Below you will find a NEN 7510 checklist outlining the steps generally required to obtain NEN 7510 certification:
01
Start by obtaining the NEN 7510 standard (PDF). It can be purchased through NEN, for example.
02
Schedule a no-obligation introductory meeting with one of our account managers.
03
Follow a training course to gain the necessary knowledge of NEN 7510. This is also possible through BC Academy.
04
Implement the NEN 7510 management system in your organization and ensure that it meets the requirements of the standard.
05
Carry out an internal audit to check whether the system is working properly and assess whether it meets the requirements of the standard.
06
Management must review the results of the internal audit and take any necessary corrective action. The conclusion about compliance with the requirements is documented in the management review.
07
Once you have determined that your organization meets the requirements, a Brand Compliance auditor will independently assess whether your management system meets the requirements of the standard.
08
If your organization meets the requirements of the standard, we will issue a certificate.
NEN 7510 certification costs
Implementation starts with purchasing the standard. The total costs of the process depend on several factors, including the complexity of processes, whether employees work in shifts, the extent to which existing measures are already in place, the number of full-time equivalent employees (FTEs) and the number of locations.
Certification costs consist of the time Brand Compliance spends preparing for the audit, conducting the audit and preparing the report, as well as additional costs such as certificate issuance, administration and travel expenses.
For more information about certification, visit our knowledge base, where you will find articles about the certification process.
Request a quote for NEN 7510 certification
Would you like to know what NEN 7510 certification involves for your organization? Discuss your situation with Brand Compliance and request a no-obligation quote for an independent certification audit.
Often a NEN 7510 certification is not mandatory, but an organization has itself certified to prove itself to its stakeholders and to distinguish itself from the market. But there is also a possibility that one of the stakeholders does make the NEN 7510 certification mandatory. For example, it may be that a health insurer makes it mandatory for the affiliated healthcare organizations or that one of the suppliers makes it a requirement. An example of this is MedMij.
NEN 7510 is not explicitly mentioned in the GDPR, but the importance of security standards exists under the applicable regulations, such as the GDPR. It is mandatory within the healthcare sector to comply with NEN 7510 if the citizen service number (BSN) is used. Finally, the Dutch Data Protection Authority (AP) states in the current policy rules ‘Security of personal data’ that organizations are responsible for following security standards, citing NEN 7510 as an example.
NEN 7510 is intended for healthcare institutions and other personal health information managers, as well as security advisors, consultants, auditors, providers and external service providers responsible for overseeing the security of health information. The guidelines in NEN 7510 provide these organizations and individuals with the necessary information on how to securely manage and protect personal health information.
NEN 7510-1 contains the normative requirements for the management system. An information security management system is implemented by an organization as part of a strategic decision. Part 1 of the standard was prepared to provide requirements for establishing, implementing, maintaining and continuously improving an information security management system.
Part 2 of the standard provides an overview of recommended actions healthcare organizations can take to manage risk, including securing personal health information and implementing information systems management procedures. NEN 7510-2 provides healthcare institutions and other managers of personal health information with instructions on how to ensure the availability, integrity and confidentiality of this information.
The General Data Protection Regulation (GDPR) is a European regulation that relates to the protection of personal data. It is designed to give individuals control over their personal data and require organizations to handle this data in a secure and responsible manner.
The GDPR plays an important role within the NEN 7510 standard. Within the context of the NEN 7510 standard, healthcare institutions and other organizations in the health sector are obliged to comply with both the GDPR and the specific requirements of the standard. This means that they must protect the personal data they process in accordance with the GDPR guidelines and the additional requirements of NEN 7510.
The NEN 7510 standard contains specific security measures and guidelines for the processing of personal data in healthcare. These measures include, among other things, performing risk analyses, implementing appropriate technical and organizational measures, ensuring data confidentiality, determining access rights and reporting data breaches.
By complying with both the GDPR and the NEN 7510 standard, healthcare institutions can demonstrate that they respect the privacy of patients and process personal data in a secure manner. Adhering to these standards is vital to maintain the trust of patients and other stakeholders and to mitigate legal and financial risks.
The basis of both standards is the same. NEN 7510 is specific to organizations that process personal health information in the Netherlands.
We wrote an article about the differences and similarities between NEN 7510 and ISO 27001.
The NEN 7512 relates to electronic communication in healthcare between healthcare providers and healthcare institutions, patients and clients, healthcare insurers, and other parties involved in healthcare. These requirements are prescribed by law and regulations and differ per process. NEN 7512 describes, among other things, the process to carry out a risk assessment for the exchange of data.
The NEN 7513 sets requirements for the system with which data relating to access to the electronic patient file is registered. These requirements make it possible to check the lawfulness of access control in the electronic patient file.