NTA 7516 checklist: how to get secure email in healthcare right

You want to know whether your practice is ready for secure email. You look for a list to tick off and mainly find suppliers who put 'NTA 7516 compliant' on their website. That does not tell you what you need to check.

This is a checklist with fourteen points in six groups. For each point you read what it is, how to check it and where it goes wrong. If a supplier's website carries such a label, ask further; what it does and does not say, you can read in the FAQ on our page about the standard. Where a point says 'according to the standard', it belongs to the requirements on our page about the standard. The rest are checks we recommend to you.

The text of the standard itself is not included here. NEN offers the pdf of NTA 7516:2019 free of charge, available for direct download after ordering and only for your own use (NEN, NTA 7516:2019 nl, accessed 12 October 2026). NEN writes that complying with NTA 7516 is not (yet) mandatory and that the standard is based on the GDPR and eIDAS (NEN, Veilig mailen met NTA 7516, accessed 12 October 2026). According to NEN, you fill in an important part of the measures by choosing the right supplier, but as a healthcare institution you also take measures yourself (same source). According to NEN, suppliers must be transparent about what their product does not cover (same source).

Do you know who signs in and who opens?

• Second step for the recipient. According to the standard, the recipient proves with at least two factors who they are before they can open health information. Check: ask whether that step is enforced or optional, and test it with a message to a colleague elsewhere. Pitfall: an optional second step only protects those who switch it on.
• Own accounts. A check of ours, not a requirement from the standard. Check: sign in as an ordinary employee and see whether a second step is asked there too. Pitfall: the second step is only switched on for administrators.

Is the email sent encrypted?

• In transit. According to the standard, health information travels encrypted over the line. Check: ask your supplier whether encryption between mail servers is enforced. Pitfall: encryption that is only used if the other side supports it.
• What you store. According to the standard, encryption also applies to what you store. Check: ask your supplier what is encrypted in their storage and since when, and record the answer. Pitfall: an answer about the connection when you asked about the storage.
• The rest of the route. According to the standard, only the intended recipient can read a message. Check: ask whether external mail servers that the message passes through also cannot read the content. Pitfall: a supplier who only describes their own servers.

Does the email reach the right person?

• Check the address before you send. According to the standard, you know who sends a message and who reads it, and no health information goes to an address that has not been checked. Check: record how you check a new address, for example with a phone call to the recipient. Pitfall: an address copied from an old email.
• Recognisable sender. For sender identification, our page about the standard names PKIoverheid certificates and the Zorg-e-mail protocol. Check: ask your supplier how a recipient can see that a message really comes from your practice. Pitfall: a sender name that anyone can type in.
• Does it work with other suppliers. According to NEN, messages between products of different suppliers that meet the standard must be able to be sent, received and read without restriction (NEN, accessed 12 October 2026). Check: send a test message to a care partner with a different service and ask what they see. Pitfall: a service that only works between people who use the same service.

Can you show what was sent?

• Logging per message. According to the standard, you can show who sent and received what and when. Without logging you have no evidence for a supervisory authority or auditor (our page about the standard). Check: request last month's log and see whether time, sender and recipient are in it. Pitfall: you only notice that nothing was recorded when an auditor asks.
• Keeping and retrieving. This is a check of ours. Agree how long you keep the log, who has access to it and how you find a message in it. Pitfall: a log that only the supplier can access.

What is on paper?

• Data processing agreement. An email supplier processes health data for you. The GDPR then requires an agreement that states what the processor may do (Article 28(3), EUR-Lex, accessed 12 October 2026). Check: read the annexes with sub-processors and measures, and see where your data is stored. See what a data processing agreement is and what it must contain. Pitfall: clicking agree without opening the annexes.
• Availability and backups. According to the standard, messages arrive even if a system briefly falters, and the service is demonstrably available and reliable. Check: ask whether the agreement on availability is a guarantee or a target, and how often backups are made and restored. Pitfall: a percentage in the SLA that turns out to be a target.

Does your team know what to do?

• Agreements within the team. Write down which messages always go via the secure route and who the point of contact is. The GDPR requires measures to ensure that anyone acting under your authority who has access to personal data only processes it on your instructions (Article 32(4), EUR-Lex, accessed 12 October 2026). Check: ask a colleague which messages must go via the secure route. Pitfall: a rule that only exists in the head of the practice manager.
• When it goes wrong. A message with health data sent to the wrong address can be a personal data breach (Article 4(12)). The controller reports it to the supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless a risk is unlikely (Article 33(1), same source). Check: does everyone know who reports it and how? Pitfall: leaving a misdirected message for a week.

Where Noveu stands, per measure

Noveu Werkplek brings your mail, calendar and files together under one login. On our NTA 7516 page you can read which technical measures Noveu applies.

• Email traffic on European infrastructure: your email runs on our own mail server at Hetzner in Falkenstein (Germany), and the backups are in that same Hetzner data centre. Cloudflare (US) sits at the edge of the network.
• Encrypted transport: traffic to Noveu is encrypted with TLS 1.2 or 1.3.
• Signing in: one Noveu login via OpenID Connect, with TOTP and passkeys.
• The backups are encrypted.
• Transparency: all sub-processors are published on the sub-processors page.

For your own audit, we provide technical and organisational evidence on request. Who certifies the standard and what a quality mark does and does not cover, you can read on the page about the standard and who certifies. How a small practice approaches this is described in secure email in the GP practice. What Noveu Werkplek costs, you can see on the pricing page.