NEN 7510: More than a Compliance Checkbox in Healthcare
Managing risks in healthcare concerns the entire care chain. From suppliers to healthcare institutions. The NEN 7510 framework provides a focused framework for systematically managing risks, with attention to processes, technology, and human actions.
At uComply, we believe that having NEN 7510 certification is the beginning of active risk management within the healthcare sector. We help not only to obtain certification, but also a management system that truly works in the healthcare-specific environment.
What exactly is NEN 7510?
NEN 7510 is the Dutch standard for information security in healthcare. This standard is based on the international ISO 27001 standard, but tailored to the specific risks, laws and regulations, and measures within healthcare.
This standard is intended for all organizations active in the care chain: hospitals, mental health institutions, general practices, but also healthcare software suppliers, cloud providers, IT managers of medical systems, or organizations that make medical equipment.
Our approach: From Policy to Results
We combine in-depth knowledge of standards with years of practical experience in the healthcare sector. This is how we work:
- Risk Inventory:We identify the risks that are truly relevant to your healthcare situation.
- Workable Measures:We design control measures that are practically feasible and supported by your teams.
- Create Awareness:We build security awareness, so that information security becomes a shared responsibility.
- Continuous Support:We support not only during audits, but especially in daily execution and assurance.
- Smart Tooling:uComply.Cloud provides the tooling to be truly in control of your information security.
For us, the certificate is not central, but the end result: a healthcare organization that knows its risks and proactively and effectively manages them.
What does the uComply approach deliver?
- Control over Risks:You know exactly which patient data to secure and why.
- Patient Data Protection:Show clients that your organization takes patient data seriously.
- Continuous Improvement:Your ISMS grows dynamically with your healthcare organization.
- Audit-ready, Without Stress:Face audits with confidence.
NEN 7510 checklist: the transition to the 2024 version
The transition period to NEN 7510:2024 ends in February 2027. Since July 2025, new certificates have been issued exclusively against the 2024 version. Use these nine items to determine where your organization stands.
- Gap analysis completed against the new standard structure
- New controls identified and assessed for applicability
- Statement of applicability updated and substantiated
- Risk analysis refreshed for new threats and legislation
- Policies and procedures updated to the new standard clauses
- Staff informed and trained, including key roles
- Internal audit against the new standard planned
- Certification body contacted about the transition track
- Transition audit scheduled well before the deadline
Note: certification bodies may apply their own deadlines that fall before February 2027. Align your planning with your certification body.
Frequently asked questions about NEN 7510
What is NEN 7510?
NEN 7510 is the Dutch standard for information security in healthcare. The standard is based on ISO 27001 but specifically tailored to the risks and regulations within healthcare, with extra attention to the protection of patient data.
Is NEN 7510 certification mandatory for healthcare organizations?
NEN 7510 is not legally mandatory, but is increasingly required in tenders and contracts in healthcare. Many health insurers and hospitals require NEN 7510 certification from their suppliers to ensure the security of patient data.
What is the difference between NEN 7510 and ISO 27001?
NEN 7510 is based on ISO 27001 but specific to the Dutch healthcare sector. NEN 7510 contains additional requirements for protection of health data, patient rights, and specific Dutch legislation such as GDPR and Wabvpz.
Which organizations is NEN 7510 intended for?
NEN 7510 is intended for all organizations in the healthcare chain: hospitals, general practices, mental health institutions, but also healthcare software suppliers, cloud providers for healthcare data, IT managers of medical systems, and manufacturers of medical equipment.
How long does a NEN 7510 implementation take?
The implementation time for NEN 7510 varies from 4 to 12 months, depending on the size and complexity of your organization. With uComply, you can accelerate this process thanks to ready-made healthcare-specific templates and AI support.
What is on the NEN 7510 checklist for the transition to the 2024 version?
The transition checklist consists of nine items: gap analysis completed, new controls identified and assessed, statement of applicability updated, risk analysis refreshed, policies and procedures updated, staff informed and trained, internal audit planned, certification body contacted about the transition track, and the transition audit scheduled.
When does the transition period to NEN 7510:2024 end?
The transition period ends in February 2027. Since July 2025, certification bodies have issued new certificates exclusively against the 2024 version. Certification bodies may also apply their own earlier deadlines, so always align your planning with your own certification body.
Which documentation does a NEN 7510 audit require?
An auditor will always review your statement of applicability, the risk analysis, your policies and procedures, the records of awareness and training, and the report of your internal audit. A transition audit additionally checks whether the new controls from NEN 7510:2024 have actually been implemented and not just updated on paper.
Which new controls does NEN 7510:2024 introduce?
NEN 7510:2024 is aligned with ISO/IEC 27001:2022 and adds healthcare-specific controls, including 5.38 analysis and specification of information security requirements, 5.39 uniquely identifying care recipients, 5.42 communication in emergency situations, and 6.9 management training. All new controls must be assessed for applicability.
Ready for real information security in healthcare?
Our experts are ready to offer you advice, internal audits, outsource services, or tooling.
uComply thinks with you: practical, thoughtful, and always focused on results.