English English
Nederlands Nederlands
Naar de homepage

Patient data passes through dozens of hands every day: from GP to specialist, and from pharmacy to insurer. A single weak link in that chain is enough to cause a data breach with serious consequences. Yet, information security in the healthcare sector often falls short. Base27 helps healthcare organizations implement information security in a way that is structural, transparent, and manageable.

Calamiteitenplannen

100% EU based 

Your data is in safe hands. Fully GDPR-compliant with local support. 

Beleid en organisatie

250+ Happy customers

Join a growing network of organisations that trust us to keep them secure. 

Operationele planning

50% time saved

Speed up your workflows and free up yout team to focus on what really matters.

The complex reality of NEN 7510 and GDPR 

As an organization in the healthcare sector, you work with a wide range of departments, systems and external suppliers. In doing so, you must comply with strict legal obligations such as the Cybersecurity Act (NIS2), the GDPR and the healthcare-specific NEN 7510 certification.

In practice, this often leads to unclear and disorganised situations: policies end up buried in some forgotten Word document, risks are tracked in a messy spreadsheet and responsibilities are never formally documented anywhere. Moreover, many organizations underestimate the impact of changes in legislation. NEN 7510, for example, was significantly revised at the end of 2024. If these changes are not actively implemented, you risk becoming noncompliant without even realizing it.

mockup-axxemble2
informatiebeveiliging certificeringen - normenkaders - isms 1

Demonstrably 'in control' with Base27

Base27’s ISMS software brings immediate structure to this complexity. You manage policies, risks, incidents, suppliers and audits from one central environment. If something goes wrong, you have everything you need on hand to act quickly and demonstrably.

On top of that, you don’t need to be an expert to get started with Base27. Thanks to pre-filled structures, clear explanations and logical workflows, anyone can easily get started. Our system guides you step-by-step through identifying potential risks, implementing appropriate measures, and assigning responsibilities. Tailored precisely to your organization’s needs.

Dashboards &
Reports

  • Comprehensive reports giving you insight into the status of your information security at all times;
  • Dashboards for quick and easy insight into the status of your information security;
    • Insight by department, or across the board;
    • Filters and sorting;
    • Exports to Microsoft Excel or Word;
    • Analysis in pivot tables.

 

EXPLORE ALL FEATURES

NL - Dashboard

Planning

  • See at a glance which information security maintenance tasks need to be performed throughout the year and what the status is;
  • Easily assign tasks and monitor progress;
  • The plan can be flexibly expanded and repeated annually.

 

EXPLORE ALL FEATURES

operational-planning-Base27

Processes & KPIs

  • Establish overview of processes and related information systems;
  • Set and manage critical success factors and KPIs (Key Performance Indicators);
  • Compliance with standards is automatically made transparent.

 

EXPLORE ALL FEATURES

process-kpi-base27

Single Sign-on

  • Base27 is excellent for integrating within your organisation, for example by using SAML, to allow your employees to access the application without logging in again;
  • REST interface to link data from other sources. Through this capability, incidents from for example your ITSM can be read in or updates sent.

 

EXPLORE ALL FEATURES

RESTAPI-Base27-Single-Sign-On

Why Base27?

Base27 is developed by a Dutch team and runs entirely on European servers. This is not only relevant for GDPR compliance, but also ensures your digital independence from US tech giants.

From risk analyses and policies to supplier management, incident registration and internal audits, Base27 brings everything together in a single, clear platform.

Automatically up to date with the latest versions of NEN 7510 and GDPR.
Time savings through structured workflows and pre-filled policy framework.
100% European hosting, fully in line with GDPR requirements.
Support in obtaining NEN 7510 certification.
informatiebeveiliging certificeringen - normenkaders - isms 3
SGL
Stichting ZiZ
Vivantes
vcare-logo

Very customer-oriented with a good and quick response to questions

Wim Houben
SGL

Customisation options, patience in guidance, talent to make the impossible possible

Karin van der Han
Stichting ZiZ

Risk management and incident registration  are very useful

Lars Schiltmans
Vivantes

Clear all-in-one package

Frank Schonewille
Vcare

ISMS for your
healthcare institution

Base27 monitors and manages your processes from one central place. It serves as both an information security management system (ISMS) and a privacy management system (PMS), giving you a firm grip on the many complex aspects of information security and privacy protection. 

From policy development and communication to risk analysis, controls and asset registration, Base27 covers it all. 

Try Base27 free for 30 days and discover how information security can finally become clear and organized.

FREE TRIAL

Establishment and communication of policy
Description of processes and procedures
Protection of personal data
Conducting risk assessments and treatment plan
Managing suppliers and partners
Registration of assets
Incident registration and handling
Maintaining calamity plans
Planning improvement activities and internal audits
Monitoring and reporting

Frequently asked questions

What is information security in healthcare?
Information security in healthcare is about protecting patient data and medical information against unauthorised access, data breaches and misuse. Because healthcare organisations work with sensitive personal data on a daily basis that is exchanged between multiple parties, a structured approach to information security is both legally required and crucial for maintaining patient trust.

What are the frameworks for information security in healthcare?
The main frameworks for information security in healthcare are NEN 7510, the Cybersecurity Act (NIS2) and the GDPR. NEN 7510 was specifically developed for the Dutch healthcare sector and is mandatory for all healthcare providers. The GDPR governs the protection of personal data throughout the EU. Finally, NIS2 is a European security law that sets additional requirements for the security of network and information systems. The Cybersecurity Act is the Dutch implementation of this. Healthcare organisations classified as essential or important entities also fall under this law. Together, these frameworks form the basis for a solid information security policy in healthcare.

Is NEN 7510 certification mandatory?
Yes, applying NEN 7510 is a legal requirement for all healthcare providers in the Netherlands. Obtaining an official certificate, however, is not mandatory.

What happens if you do not comply with NEN 7510?
In that case, you risk fines, reputational damage and liability in the event of data breaches.

How do you get started with NEN 7510 implementation?
A good first step is to map out your current information security policy and the risks within your organisation. From there, you work step by step towards a fully implemented ISMS.

Is NIS2 mandatory for healthcare organisations?
That depends on the size and type of organisation. Large healthcare organisations such as hospitals generally fall under the essential entities category and are required to comply with NIS2. Smaller healthcare organisations may fall under the important entities category, which has lighter requirements.

What does a healthcare organisation need to arrange for NIS2?
NIS2 sets requirements in four areas: risk management, supply chain security, incident reporting and business continuity. Many of these obligations overlap with NEN 7510 and the GDPR, meaning that a well organised ISMS helps you comply with multiple frameworks at once.