IGJ says care providers that process data in a care information system must arrange information security according to NEN 7510 under the Wabvpz, even when they fall outside the Dutch Cyberbeveiligingswet. Other parties handling personal health information, including suppliers, should assess their role, contracts and applicable duties. Jeugdhulp organizations have a distinct Jeugdwet route that IGJ describes through ISO 27001.
Sector standards / Dutch healthcare standard with legal relevance
NEN 7510Information security for Dutch healthcare
NEN 7510 adapts information security management to Dutch healthcare and the protection of personal health information. Part 1 frames the management system; Part 2 addresses controls and healthcare-specific application. Dutch healthcare law and the IGJ's supervision make demonstrable use of the norm important for care providers.
Start with applicability
What it actually covers
A healthcare incident can make sensitive records unavailable during treatment or expose intimate details. The standard gives care organizations a repeatable management and control approach that accounts for both confidentiality and continuity of care.
NEN 7510 is a standard, not the GDPR or Cbw itself. Certification is optional even when demonstrable conformance is required; an independent assessment can also provide evidence. Its alignment with ISO/IEC 27001 and 27002 is helpful, but a generic ISO certificate does not automatically cover healthcare-specific risks, legal duties or the right certification scope. Check the current Part 2 amendment and any applicable certification transition.
The substance
Key areas to understand
An original operational reading of the official framework or legal text. Check the source for the authoritative wording.
A healthcare-scoped management system
Define the people, locations, services, systems and health information in scope; assign ownership and objectives; assess risk; select and maintain safeguards; review results and improve.
Controls in clinical context
Apply access, identity, logging, supplier, continuity and incident measures to real care workflows and patient information, including times when safety and availability are urgent.
Two current parts
NEN 7510-1:2024 covers the management system. The current consolidated control publication is NEN 7510-2:2024+A1:2026, which supersedes the unamended 2024 Part 2 in NEN's catalogue.
Assurance and supervision
Show that the management cycle and selected controls work through risk decisions, audits, independent review and corrective action. A certificate is a possible assurance route, not a universal legal prerequisite.
Overlap with Cbw and privacy
The IGJ says NEN 7510 meets much of the Dutch Cbw duty of care for covered healthcare entities, but Cbw registration and significant-incident rules still need separate attention. GDPR adds lawful-processing and personal-data rights duties.
From reference to work
A practical starting sequence
These steps organize work; they are not a claim that a short checklist completes the requirement.
Set a defensible health-information scope
Trace patient data through clinical systems, devices, exchanges, remote access and outsourced services, then name owners and boundaries.
Run risk reviews with care delivery
Include clinicians and operations in assessing confidentiality, record integrity, availability, downtime and patient-safety consequences.
Test access, logging and recovery
Confirm who can view a patient record, whether access is reviewable, and whether critical information can be restored within care-safe times.
Plan independent assurance
Use internal audit, independent assessment or certification as appropriate, resolve findings, and track the NEN 7510-1:2024/Part 2 amendment and certification transition.
Make it inspectable
Evidence to look for
The right records depend on the entity, scope and chosen assessment route.
- Healthcare ISMS scope and risk decisions
A defined health-information scope, service map, risk assessment, approved objectives, safeguard decisions and review cycle.
- Care-control operation
Access and logging reviews, secure exchange and supplier evidence, backup restore tests, downtime procedures and incident exercises.
- Assessment and improvement record
Audit plans, independent-review findings, corrective actions, effectiveness checks and management decisions.
- Current-edition and legal map
The editions used, amendment status, applicable Wabvpz/Cbw/GDPR duties, assurance scope and any certification transition plan.
Illustrative situation
What this could look like
A clinic introduces a cloud patient portal. It maps the health data and vendor, checks role-based access and record logging, tests how clinicians work during an outage, assesses the processor and transfer arrangements, and records residual risk and independent review. The same evidence helps with NEN 7510, while GDPR and any Cbw reporting duties are assessed separately.
Keep the role clear
NEN 7510 is a standard, not the GDPR or Cbw itself. Certification is optional even when demonstrable conformance is required; an independent assessment can also provide evidence. Its alignment with ISO/IEC 27001 and 27002 is helpful, but a generic ISO certificate does not automatically cover healthcare-specific risks, legal duties or the right certification scope. Check the current Part 2 amendment and any applicable certification transition.
Related, not equivalent
Where ISO/IEC can help
NEN 7510 follows the management-system approach of ISO/IEC 27001 and draws on the control guidance of 27002 with healthcare-specific additions. ISO/IEC 27701 can help privacy management; none of these connections removes Dutch healthcare law or a provider's own scope and risk decisions.
Common distinctions
Questions worth asking
Is a NEN 7510 certificate mandatory?
No. Dutch care providers must be able to demonstrate that they work according to the norm, and the IGJ expects independent assessment and evidence that the ISMS and controls function. Certification is one way to show this.
Which Part 2 edition is current?
NEN's catalogue lists NEN 7510-2:2024+A1:2026 as current, replacing the unamended Part 2:2024. Part 1 remains NEN 7510-1:2024.
Does meeting NEN 7510 settle NIS2 or GDPR?
No. It can cover much of the Dutch Cbw duty of care, but Cbw scope, registration and reporting still need checking. GDPR separately governs lawful use, transparency, rights and personal-data breach duties.
Primary-source trail
Read the official material
Research checked 2026-10-20. Edition, applicability and implementation rules can change. The links below take you to the responsible publisher or authority.