NEN 7510 Healthcare Information Security Certification

Flow chart of the NEN 7510 engagement, 6 phases in order, each one selectable. Phase 1, Scoping and Gap Assessment. We set the scope for handling Dutch health data and measure you against NEN 7510 and its companion standards. Activities: Define the scope covering Dutch health data flows; Assess controls against NEN 7510 requirements; Compare against the existing ISO 27001 baseline; Rank healthcare-specific gaps by risk. Hands over NEN 7510 Gap Assessment Report. Phase 2, Healthcare Risk Assessment. We assess the risks specific to patient data, including access logging and secure exchange. Activities: Identify risks to patient record confidentiality; Assess access paths to health data; Review secure exchange with care partners; Score risks and agree treatment priorities. Hands over Healthcare Risk Assessment Report. Phase 3, Control Design. We design the sector controls from NEN 7512 for trusted exchange and NEN 7513 for access logging. Activities: Design NEN 7513 access logging for patient records; Specify NEN 7512 trusted exchange controls; Extend ISMS policies with healthcare requirements; Define log review roles and retention. Hands over Sector Control Design and Policy Updates. Phase 4, Implementation Support. We help you roll out the controls and start collecting the evidence auditors expect. Activities: Implement access logging on patient record systems; Roll out exchange controls with care partners; Train staff on health data handling rules; Start collecting audit evidence. Hands over Operating Controls and Evidence Trail. Phase 5, Internal Audit. We audit the management system against NEN 7510 and log findings for management review. Activities: Audit the management system against NEN 7510; Sample access logs and exchange records; Log nonconformities and corrective actions; Prepare management review inputs. Hands over Internal Audit Report. Phase 6, Certification Support. We support you through the certification audit, often alongside ISO 27001. Activities: Prepare the evidence pack for the certification body; Coordinate the audit with ISO 27001 where combined; Support auditor interviews with control owners; Close findings raised during the audit. Hands over NEN 7510 Certificate. Each phase begins from the artefact the phase before it produced.