NEN 7510 in Healthcare: Which Technical Tests Are Mandatory?
NEN 7510 is the Dutch standard for information security in healthcare. Healthcare institutions that process patient data — from GP practices to hospitals — must demonstrably comply with this standard. But what does this mean concretely for technical security testing?
What is NEN 7510?
NEN 7510 is based on the international ISO 27001/27002 standard, but specifically tailored for the Dutch healthcare sector. The standard describes measures for protecting the confidentiality, integrity and availability of patient data.
In addition, NEN 7513 applies to logging of access to patient records, and NEN 7512 to secure data exchange.
Which technical tests are mandatory?
NEN 7510 requires active monitoring and testing of security measures. This includes technical tests such as:
- Vulnerability scans — regular automated scans for known vulnerabilities in systems, networks and applications
- Penetration tests — periodic tests in which an ethical hacker attempts to breach systems that process patient data
- Access control verification — verifying that only authorised users have access to patient records
- Log analysis — testing whether logging is correctly set up in accordance with NEN 7513
How often must tests be carried out?
NEN 7510 doesn’t prescribe a fixed frequency, but states that tests must take place “periodically” and after significant changes to systems. In practice, many healthcare institutions apply annual penetration tests as a minimum, supplemented with quarterly scans.
What are the risks of non-compliance?
- Fines from the Dutch Data Protection Authority (GDPR violations)
- Loss of certification (NEN 7510 certificate)
- Reputational damage following a data breach
- Liability for harm to patients
How does MonkeysICT help healthcare institutions?
MonkeysICT carries out pentests and vulnerability scans aligned with NEN 7510 requirements. Our reports are drawn up with compliance in mind: clear findings, risk classes and remediation advice — ready for auditors and the board.
More information on our page pentest for the healthcare sector.