IT for Healthcare: NEN 7510 for GPs, Dentists and Pharmacies

If you work in a GP practice, a dental practice or a pharmacy, IT is no longer a side issue. Patient data is the most sensitive category of personal data there is, and healthcare is a priority target for ransomware. In this article you will learn how to set up IT and information security for a small healthcare organisation, what NEN 7510 actually requires of you, how to get in line with the Wegiz and what you need to budget for.

Why healthcare IT is different from the average SME

An average SME can survive a cyber incident with some lost productivity and an insurance claim. Healthcare is different. If the patient record system or the GP information system (HIS) goes down, surgery hours or the flow of prescriptions can literally grind to a halt. If data leaks, it involves special category personal data, which GDPR subjects to a stricter regime. And if you use shared infrastructure (the national exchange point LSP, healthcare networks, supply chains to pharmacies or hospitals), your incident directly affects others too.

The figures bear this out. Z-CERT, the Dutch cybersecurity expertise centre for healthcare, rates the threat level from ransomware and data-leak extortion as 'high'. European healthcare organisations saw a 25 per cent rise in ransomware incidents in 2024. In 2025, at least ten major Dutch healthcare organisations were hit by a cyberattack, including a large-scale incident at supply-chain provider Clinical Diagnostics Nederland in which the data of 485,000 participants was leaked.

In short: healthcare IT is a discipline of its own, with its own standard, its own legislation and its own approach.

NEN 7510: what it is and who it applies to

NEN 7510 is the Dutch standard for information security in healthcare. It translates the ISO 27001 approach to the healthcare context, with additional controls suited to processing medical data.

NEN 7510 is mandatory for all healthcare organisations that process (electronic) patient data. That net is wider than many practices think:

• Hospitals and clinics.
• GP practices and out-of-hours GP services.
• Dental practices and dental chains.
• Pharmacies and dispensing GP practices.
• Mental health services, youth care and home care.
• Self-employed healthcare professionals who process patient data independently.

The legal basis comes from the Wabvpz (the Dutch Act on Additional Provisions for the Processing of Personal Data in Healthcare) and the Wkkgz (the Dutch Healthcare Quality, Complaints and Disputes Act). Since 2024, organisations have been audited against the new version, NEN 7510-1:2024.

An important detail: IT suppliers serving these healthcare organisations are often drawn in indirectly as well. Health insurers and regional partnerships increasingly make NEN 7510 certification a condition for receiving services or funding. In practice, that makes NEN 7510 unavoidable for virtually every professional healthcare provider in 2026.

What NEN 7510 actually requires of you

The standard is built around an Information Security Management System (ISMS). That sounds heavier than it needs to be: it is a set of policies, procedures and records that you maintain consistently.

For a small healthcare practice, it comes down to:

• Information security policy. A document setting out who is responsible, what you protect and how.
• Risk assessment. What risks does your practice face (ransomware, a lost device, insiders, a supplier outage) and what are you doing about them?
• Access management. Who may see which patient data? Distinguish between doctor, assistant, mental health practice nurse and administrative staff. Review access annually.
• Incident procedures. What do you do in a security incident, who reports to whom, and how do you record it?
• Awareness. All staff receive periodic training on phishing, password hygiene and handling patient data.
• Backup and recovery. Demonstrable backups, with periodic tests showing you can restore a patient record.
• Supplier management. HIS supplier, pharmacy information system, dental practice management system, email hosting: all covered by a data processing agreement and reviewed periodically.

For a small healthcare practice, the ISMS can be simple in design, as long as it is proportionate and effective. You do not need to build a hospital-grade ISMS. For more background, see our article the complete guide to ISO 27001 for SMEs; the approach is closely related.

What NEN 7510 certification costs

For small healthcare organisations, the total cost of NEN 7510 certification in the first year is roughly €3,000 to €8,000. That covers audit fees, preparation time and any external support in setting up the ISMS. Surveillance audits in the following years typically cost small practices €1,500 to €2,500 a year.

A certification process at a small healthcare organisation usually takes 4 to 8 months from the start of implementation. That includes drawing up policies, carrying out the risk assessment, awareness training and building the documentation file.

Be critical of anyone promising 'full NEN 7510 compliance' for a few hundred euros a month. The content of your ISMS is your own responsibility, not that of a tool or a supplier.

The Wegiz: standardising data exchange

Alongside NEN 7510, the Wegiz (the Dutch Electronic Data Exchange in Healthcare Act) has been in force since 1 July 2023. It is a framework act: it does not itself specify what must be exchanged digitally, but gives the minister the power to make specific data exchanges mandatory through individual orders in council (AMvBs).

The first order covers medication transfer. An order for nursing handovers is expected in 2026. For GPs, the Wegiz means that in time, data sent to pharmacies and hospitals must flow through standardised profiles (Nictiz standards). The same goes for pharmacies. For dentists the act is less directly relevant, but it still affects them indirectly through their partners in the care chain.

In practical terms: check whether your HIS, pharmacy system or practice management system is keeping pace with the Wegiz standards. Suppliers that fall behind will become a millstone around your neck within a few years.

The secure workplace for healthcare

A modern healthcare practice workplace combines the HIS or practice management system with Microsoft 365 or Google Workspace to support administration and communication. What makes such a workplace NEN 7510-proof?

• MFA on everything. Including the HIS itself and all remote access. See implementing MFA in your business.
• Roles and permissions. Distinguish between doctor, assistant, practice nurse and administrative staff. Each gets the minimum permissions their role requires.
• Endpoint security. Every device (office PC, laptop, tablet) is managed, with encryption, patching and central monitoring. More on endpoint management and MDM.
• Secure communication. Regular email is not acceptable for patient data. Use ZorgMail, secure mail solutions or secure portals. For internal communication, no WhatsApp with patient data; use channels that demonstrably meet the requirements.
• Backups and an immutable copy. Daily backups, at least 30 days' retention, an annual restore test, and an immutable or offline copy to protect against ransomware. See the complete backup strategy for SMEs.
• Segregation of patient data. Records belong in the HIS, not as loose copies in email or OneDrive.

For most small healthcare practices, this is achievable without replacing the entire infrastructure; it is mainly a matter of good policy and good management. For more background, see setting up a modern workplace for SMEs.

Ransomware in healthcare: why it hits so often

Ransomware groups pick victims where time is money and where people's lives indirectly depend on systems being available. That makes healthcare a target with a high willingness to pay.

What you can enforce across the attack chain is predictable:

• Entry via phishing: addressed with awareness training and advanced email filtering.
• Movement within the network: addressed with segmentation, least privilege and EDR solutions.
• Encryption of backups: addressed with an immutable copy and offline backup.
• Data exfiltration for extortion: addressed with DLP controls and monitoring.

The crux is that each of these layers is weak if you only implement one of them. For a deeper dive into the approach, see ransomware protection for SMEs.

NIS2 and healthcare

NIS2 (implemented through the Dutch Cybersecurity Act, the Cyberbeveiligingswet) affects healthcare more heavily than many other sectors. Healthcare organisations that qualify as essential or important entities fall within scope, with obligations around risk management, incident reporting and accountability. NEN 7510 is a solid foundation for NIS2, but it does not automatically cover every NIS2 obligation.

For a small GP or dental practice, qualifying as an essential entity is usually not an issue; for pharmacy chains and care groups, it is. Not sure? Read our complete guide to NIS2 for SMEs.

A pragmatic plan for a small healthcare practice

If you cannot yet demonstrate NEN 7510 compliance:

1. Baseline assessment. Work through the standard with an external or internal lead. For each control, record whether you comply, partly comply or do not comply. Every gap becomes an action point.
2. Policy and risk assessment. Document your information security policy, identify the risks and link measures to them.
3. Technical quick wins. MFA on everything, patching under control, a password manager, EDR or managed detection. See the cybersecurity checklist for SMEs.
4. Backup and restore test. Retention, an immutable copy, a documented test you can show.
5. Awareness. Everyone, every year, demonstrably. Phishing simulations are part of it.
6. Supplier audit. HIS supplier, email, practice management system, dental X-ray, pharmacy system: all with an up-to-date data processing agreement and periodic review.
7. Certification process. Choose a certification body and schedule the audit.

It looks like a lot, but most steps are a one-off setup; after that, it becomes an annual cycle.

Frequently asked questions about IT and NEN 7510 in healthcare

Is NEN 7510 mandatory for my GP practice, dental practice or pharmacy? Yes. NEN 7510 is mandatory for all healthcare organisations in the Netherlands that process electronic patient data. That includes GP practices, dental practices, pharmacies, hospitals, mental health services, home care and youth care. Self-employed healthcare professionals who process patient data independently are covered too. In practice, health insurers and partnerships often make certification a condition.

What does NEN 7510 certification cost for a small practice? For a small healthcare organisation, the total cost in the first year is roughly €3,000 to €8,000. That includes the audit, preparation and any external support. After that, an annual surveillance audit typically costs €1,500 to €2,500. The process usually takes 4 to 8 months.

What is the difference between NEN 7510 and ISO 27001? NEN 7510 is the Dutch standard for information security in healthcare, with additional controls specifically suited to processing medical data. ISO 27001 is the international standard for information security in general. For Dutch healthcare, NEN 7510 is the leading standard. If you work internationally or need to align with a parent group, you can combine both.

What is the Wegiz and does it affect my practice? The Dutch Electronic Data Exchange in Healthcare Act (in force since 1 July 2023) is a framework act that allows specific electronic data exchanges to be made mandatory. The first order in council covers medication transfer; an order for nursing handovers is expected in 2026. For GPs, pharmacies and hospitals, this means data must flow through standardised profiles. For dental practices, the impact is more indirect.

Can I send patient data by regular email as a GP or dentist? No, not without additional measures. Regular email is not demonstrably secure enough for special category personal data. Use ZorgMail, another secure email solution that meets the requirements, or a secure patient portal.

What are the biggest IT risks for healthcare in 2026? Ransomware remains the number one threat. Other major risks are supply chain attacks via third-party suppliers (the Clinical Diagnostics incident in 2025 affected 485,000 people), phishing aimed at staff, loss or theft of devices holding local patient data, and weak supplier management that lets vulnerabilities slip in through the HIS or practice management system.

Conclusion

IT in healthcare is not a side issue. NEN 7510 is mandatory and is being enforced more strictly in audits and partnerships, the Wegiz is raising the bar for data exchange, and the ransomware threat remains high. At the same time, most of the setup is very manageable for a small practice if you treat it as an annual cycle rather than a one-off project.

As an IT partner, TRON Group works with GPs, dentists, pharmacies and care groups to strike a workable balance between NEN 7510 compliance and day-to-day practice: baseline assessment, managed workplace, secure communication, EDR monitoring and periodic supplier audits included. Want to know where your practice stands and what the next step is? Take a look at our approach to IT for healthcare or call +31 85 303 5869 for a no-obligation conversation. Moving IT Forward, in primary and secondary care too.