Skip to content
Log in
NLENDE
Request accessAccess Menu

Secure email with health data

NTA 7516 explained:
what the standard asks.

NTA 7516 is an agreement from NEN on secure email and chat with health data. If you email about patients or clients, this standard describes how to do that securely. Below you can read what the requirements are, who certifies and what Noveu covers for your mail today.

Schedule an introduction →Who certifies?

Why this standard
exists.

Healthcare providers email colleagues, partners in the care chain and patients every day. Those messages often contain health information, and that is special category personal data under the GDPR. Emailing is allowed, but it has to be secure.

NTA 7516 makes that concrete. NEN calls the standard a clarification of the GDPR: an overview of the technical and organisational measures you take when you exchange medical data by email or chat.

The standard in brief
IN FULLNederlandse Technische Afspraak 7516
VERSIONNTA 7516:2019, published on 20 May 2020
MANAGED BYNEN
SCOPEAd hoc exchange of health information by email and chat
FOR WHOMHealthcare professionals, their organisations and suppliers of secure email and chat
REVISIONSince early 2024, commissioned by VWS. Becomes NEN 7516 part 1 (email) and part 2 (chat)

Source: NEN, Veilig mailen met NTA 7516 and the standard page NTA 7516:2019, consulted on 29 September 2026.

What NTA 7516
asks for in practice.

The standard builds on NEN 7510, the standard for information security in healthcare, and translates it into six types of requirements for email and chat.

Confidentiality
The standard requires health information to travel encrypted in transit and to be kept encrypted, so that only the intended recipient can read the message.
Two-factor authentication
The recipient proves with at least two factors who they are, before they can open health information.
Verifying sender and recipient
You know who sends a message and who reads it. No health information to an address that has not been checked.
Availability and continuity
Messages arrive, even if a system briefly falters. The service must be demonstrably available and reliable.
Interoperability
Secure email works between different suppliers. The standard prevents every provider from becoming an island of its own.
Logging and auditability
You can show who sent and received what and when. Without logging you have no evidence for a supervisor or auditor.

Who certifies
for NTA 7516?

01
NEN manages the standard
NEN writes and publishes the agreement. You can order the full text from NEN free of charge; this page is a summary, not a replacement.
02
A certification body assesses
The rules for the assessment are in a certification scheme. A certification body carries out the audit and issues the certificate. NEN works with certification bodies for this; the list is on the NTA 7516 page of NEN. So a supplier cannot certify itself.
03
Suppliers can obtain a quality mark
According to NEN, there is an NTA 7516 quality mark for suppliers of secure email. Even with such a quality mark, your organisation remains responsible for policy, agreements and use.

Source: NEN on NTA 7516 and NEN on obtaining a certificate or quality mark, consulted on 29 September 2026. That the full text can be ordered free of charge is stated on the standard page NTA 7516:2019, consulted on 12 October 2026.

Technical evidence for your own audit.

We set up Noveu Werkplek according to the principles of NTA 7516.

For your own audit or supplier assessment, we provide technical and organisational evidence on request.

View NIS2, BIO and GDPR on the compliance page →

Noveu Werkplek

What Noveu covers today,
for your mail.

Below you see the available measures for your mail. How this fits with NIS2, BIO and the GDPR you can read on the compliance page.

Mail traffic on European infrastructure
Your email runs on our own mail server at Hetzner in Falkenstein (Germany), not on the platform of an American hyperscaler. The backups are also stored in that Hetzner data centre in Falkenstein. Cloudflare (US) sits at the edge of the network, for DNS and secure connections.
Available
Encrypted transport (TLS enforcement)
Traffic to Noveu is encrypted with TLS 1.2 or 1.3. The site sends HSTS with a validity of one year. For noveu.eu there are SPF (-all), DMARC (p=reject) and an MTA-STS record.
Available

Frequently asked questions
about NTA 7516.

What is NTA 7516?

NTA 7516 is a Dutch Technical Agreement from NEN with requirements for the secure exchange of health information by email and chat. The current version is NTA 7516:2019, published on 20 May 2020. The requirements cover encryption, the right recipient, an extra step when opening, availability, exchange between suppliers and logging.

Is NTA 7516 mandatory?

No, not at the moment. NEN writes that introducing the standard is not (yet) mandatory. The standard is based on the GDPR and eIDAS, and those do apply to everyone. If you email health data, NTA 7516 shows how to do that securely. NEN puts it this way itself: you may choose not to meet the standard, but then you do not email or chat that data either.

How does NTA 7516 certification work?

NEN manages the standard. The assessment is done by a certification body, according to the rules in a certification scheme. Which bodies these are is in the list on the NTA 7516 page of NEN. According to NEN, there is an NTA 7516 quality mark for suppliers of secure email. A supplier cannot certify itself, and a service with a quality mark does not relieve your organisation of its own policy and agreements.

What does NTA 7516 compliant mean?

That a supplier says it works to the requirements of the standard or meets them. It is not an official label. So ask further: is there a certificate or quality mark, from which body, and which requirements does the service not cover? NEN asks suppliers to be open about that.

Are nta7516 and nta-7516 the same as NTA 7516?

Yes. NTA 7516, nta7516 and nta-7516 are spellings of the same standard. The official name is NTA 7516, with a space. In full, the current version is called NTA 7516:2019.

Is there an NTA 7516 from 2025?

The NEN page does not list a version from 2025 (consulted on 29 September 2026). The current version is NTA 7516:2019. Since early 2024, NEN has been working on a revision, commissioned by the Ministry of VWS. It will become a NEN standard in two parts: part 1 for email and part 2 for chat.

What is the difference between NTA 7516 and NEN 7510?

NEN 7510 is the broad standard for information security in healthcare and describes a management system for the whole organisation. NTA 7516 is specific: requirements for secure email and chat with health information. The two complement each other.

Can I email securely according to NTA 7516 with an ordinary email service?

Usually not without extra measures. Ordinary email does not guarantee encryption all the way to the recipient, no second step when opening and no check of the sender. For that you need a service that technically enforces these safeguards.

Want to read more? Secure email in the GP practice covers the choices for a small practice and the mistakes that are easy to avoid.

Read more

Secure email in healthcare?
We will look at it with you.

We look at your current email with you, name what is needed and show what Noveu Werkplek arranges today.

Schedule an introduction →Noveu for healthcare

This page is for information purposes and is not legal advice.