Secure email in the GP practice, in plain language

A doctor's assistant wants to email a referral letter to the physiotherapist around the corner. It is one page. Is that simply allowed, or does it have to go through a secure channel? And how do you know that the email reaches the right person?

That is what NTA 7516 is about. In this piece, you read what the standard requires, who it applies to and which choices you have. Without jargon, as far as that is possible.

What is NTA 7516?

NTA 7516 is a Dutch Technical Agreement (Nederlandse Technische Afspraak) of NEN, the Dutch standardisation institute. The standard describes how you send and receive email with medical and other sensitive personal data securely. It aligns with NEN 7510, the standard for information security in healthcare.

The starting point is simple: email with patient data must be just as secure as other secure channels in healthcare. The standard places requirements on the sender and on the recipient.

Who does it apply to?

To every healthcare provider that emails patient data. Think of:

• GP practices and health centres
• hospitals and clinics
• mental healthcare institutions
• nursing homes, care homes and home care
• pharmacies
• physiotherapists, speech therapists and other allied health professionals
• youth care

If you email about patients, NTA 7516 is about you.

What does the standard require?

In plain language, it comes down to five things:

• Encryption. The email travels encrypted from server to server, with at least TLS 1.2. Ordinary email over an unsecured connection is not enough.
• The right recipient. You must be able to trust that the address is correct and that the recipient is who you think.
• A second step when opening. If the recipient cannot receive the email through a trusted mail server, they open the message with two-step verification.
• Recording. You record who sent what to whom, when, and whether it arrived.
• Employees who know. Your team recognises an email with sensitive data and knows how it leaves the building securely.

The exact requirements are in the standard itself, which you can purchase from NEN. This is a summary, not a replacement.

Which choices do you have?

There are roughly three ways to work towards the standard.

A mail platform that already builds in the requirements

The platform handles the technology. Your employees mainly learn when to choose the secure route. For a small practice, this is usually the simplest.

A gateway for your existing mail

An extra service for your current mail server recognises sensitive messages and secures them. You keep your familiar mail program. You do have to set up the recognition properly, because it sometimes gets it wrong.

A separate secure messaging service

You send sensitive messages through a separate service instead of by email. That is secure, but the recipient has to use the same service or sign in via a link.

Which one fits depends on your size and on who you email most.

Mistakes you can easily avoid

A few pitfalls are easy to avoid:

• sending patient data from an ordinary free email address
• seeing a zip file with a password as encryption, because that does not meet the standard
• sending the password through the same channel as the file
• not checking whether the address of the recipient is correct
• not recording what you have sent

How this relates to other rules

Health data is a special category of personal data under the GDPR and requires extra protection. NEN 7510 is the broader framework for information security in healthcare. Since 15 August 2026, larger healthcare providers also fall under the Cybersecurity Act, the Dutch implementation of NIS2 (rijksoverheid.nl).

What you can do this week

1. Ask your mail supplier whether the connection is always encrypted, and with which TLS version.
2. Agree in the team which messages always go through the secure route.
3. Stop using zip files with a password.
4. Appoint someone in the practice as the point of contact for secure email.

Where Noveu stands

Noveu Mail runs on our own mail server in a Hetzner data centre in Falkenstein, Germany. Traffic to Noveu is encrypted with TLS 1.2 or 1.3. Cloudflare (US) sits at the edge of the network. Which technical measures Noveu applies, you can read on our page about NTA 7516.