NEN 7510 for healthcare businesses: a step beyond ISO 27001

Do you work in or with healthcare? Then NEN 7510 — alongside or instead of ISO 27001 — is a real requirement. The overlap is significant; the differences lie in patient data and specific Annex controls.

NEN 7510 is the Dutch standard for information security in healthcare. If you process customer data that can be traced back to patients — EHR developers, healthcare SaaS providers, consultancies working with care organisations — certification is often a contractual requirement.

Relationship with ISO 27001

NEN 7510 is built on ISO 27001 + ISO 27002 but adds requirements specific to patient data. If you already hold ISO 27001 certification, NEN 7510 is an incremental step. If you're starting from scratch, you can pursue both certifications in a single audit.

What are the additional requirements?

• Separate classification of patient data.
• Stricter access logging for patient records — who viewed which file and when.
• Specific data processing agreements with healthcare providers.
• Retention and destruction policies for patient data (longer retention periods than the GDPR baseline).
• Incident escalation with mandatory reporting to the healthcare inspectorate in certain cases.

Audits

Many healthcare suppliers choose an auditor that can certify both ISO 27001 and NEN 7510 (Kiwa, DEKRA, Brand Compliance). A combined audit means a single process and lower costs than running two separate ones.

See also: ISO 27001 pillar article, certification costs.