Netherlands — ANX-NL: Netherlands Annex (NEN 7510, 7512 and 7513)
Document ID: ANX-NL · Version: 1.0 · Effective date: [[TO CONFIRM: publication date]]
Status: special. The Netherlands opens only when the access-log export in clause 3 is available.
Language: English, with a Dutch courtesy copy [[TO CONFIRM: Dutch translation]]. English controls.
Applies to: Clinics established in the Netherlands, together with the MDPA and the EEA Transfer Module (TM-EEA). Terms defined in the MDPA have the same meaning here.
1. Legal framework
Under the Decree on electronic data processing by care providers (Besluit elektronische gegevensverwerking door zorgaanbieders), the Clinic as care provider must comply with:
- NEN 7510 (information security in healthcare);
- NEN 7512 (the basis of trust for data exchange); and
- NEN 7513 (logging of access to electronic patient files).
VstreamX supports the Clinic in meeting these duties as this Annex provides.
2. NEN 7510: statement of controls
2.1 Not yet certified. VstreamX does not hold NEN 7510 certification (nor ISO/IEC 27001 certification) at the Effective Date. It discloses this at signup.
2.2 What VstreamX provides. It provides the Clinic with:
- (a) a NEN 7510 controls statement: a statement of applicability mapping MDPA Schedule 2 to the NEN 7510 controls, with any controls not implemented and the reason; and
- (b) the certifications of its hosting Sub-processor (MDPA Schedule 2, G.25).
[[TO CONFIRM: the NEN 7510 statement of applicability, and VstreamX's certification roadmap and target date]]
3. NEN 7513: logging
3.1 What DentalX logs. For Dutch Clinics, DentalX logs each access to a patient's electronic file as NEN 7513 requires:
- who (the User and their role);
- which patient;
- when;
- what action (view, create, change, delete, export or print); and
- from where (the device or network context available to the Service).
3.2 Retention and export. The logs are:
- kept for the period the Clinic sets, at least 5 years;
- protected against alteration; and
- exportable by the Clinic.
3.3 Opening condition. The Netherlands is opened at signup only when this logging and its export are available. [[TO CONFIRM: release date of NEN 7513-conformant logging, including reads and "from where"]]
4. Citizen service number (BSN)
4.1 The field. DentalX provides a BSN field with validation (the eleven-test) for Dutch Clinics. The BSN is processed only as the Act on Additional Provisions for the Processing of Personal Data in Healthcare (Wabvpz) allows.
4.2 Verification. DentalX does not connect to SBV-Z. The Clinic verifies the BSN through the channels available to it. [[TO CONFIRM: whether SBV-Z verification is expected of a non-Dutch SaaS]]
5. Supplier audit
In addition to MDPA clause 12, VstreamX cooperates with any supplier assessment the Clinic must perform under NEN 7510. This includes completing the Clinic's supplier questionnaire once a year.
6. Retention
6.1 The Clinic's duty. The Clinic keeps the medical file for 20 years from the time of the last change, or longer where needed for good care (Civil Code, Art. 7:454(3)).
6.2 DentalX's default. DentalX applies 20 years as the default for Dutch Clinics, and does not auto-delete clinical records.
7. Security breaches
VstreamX's notice within 24 hours (MDPA clause 9) allows the Clinic to notify the Autoriteit Persoonsgegevens within 72 hours.
Items to confirm before publication (Netherlands)
- Publication date.
- The Dutch courtesy translation.
- The NEN 7510 statement of applicability, and the certification roadmap and target date (§2.2).
- Release date of NEN 7513-conformant logging, including reads and "from where" (§3.3).
- Whether SBV-Z verification is expected of a non-Dutch SaaS (§4.2).