NEN 7510-1 and NEN 7510-2 provide guidelines and starting points for determining, instituting and enforcing measures that healthcare institutions and other managers of personal health information must take to secure the provision of information. NEN 7510 is not only mandatory for health care institutions but also applies to (supply) vendors who deal with patient data and other managers of personal health information. When (supply) vendors process other types of information, such as financial data, personal data or other company confidential data, they can be certified according to ISO 27001 and NEN 7510 is not directly required. The NEN 7510 is based on the ISO27001 with specific additions from the healthcare sector.
NEN 7510 and ISO 27001 are both information security standards. The type of information an organization or institution processes determines the scope of certification. NEN 7510 puts the focus entirely on patient data, while ISO 27001 puts the focus on the information an organization designates as valuable.
