Mail flow guide: secure email in healthcare

Overview

This guide shows how a secure mail flow in healthcare works technically: from sender via the mail server to the recipient, with the measures and logging per phase. The requirements come from NTA 7516, the Dutch Technical Agreement of NEN for the secure exchange of health information by email and chat.

What the standard asks, who certifies and which technical measures Noveu applies, you read on our page about NTA 7516.

Scope

According to NEN, introducing NTA 7516 is not (yet) mandatory. The standard is based on the GDPR and eIDAS, and those do apply. The standard is intended for anyone who exchanges health information by email or chat, such as:

• Hospitals and healthcare institutions
• GPs and specialists
• Pharmacies
• Health insurers
• Any party that exchanges patient data

Core principles

1. Confidentiality

Requirements:

• Unauthorised persons cannot access encrypted messages or the keys
• Access only for authorised recipients
• No unauthorised access during transport

Status at Noveu:

• Enforced TLS for transport (available)

2. Integrity

Requirements:

• Messages must not be changed unnoticed
• Digital signatures where required

3. Availability

Requirements:

• Messages must arrive on time
• Systems must function reliably

Status at Noveu:

• Availability follows the SLA at noveu.eu/legal/sla: 99.5% per month as a target
• Backups in the Hetzner data centre in Falkenstein (Germany), on a separate disk and VM
• Every night an encrypted copy of the databases and the mail goes to separate object storage at Hetzner, outside this server and also in Falkenstein

4. Auditability

Requirements:

• Complete audit trail of message traffic
• Logging of access and actions

At Noveu:

• Audit log per organisation with a hash chain, exportable as CSV

Setting up your own logging

Use the following fields and checklist to agree on logging with your supplier and within your organisation.

Minimum log fields

{
  "timestamp": "2026-01-15T10:30:00Z",
  "messageId": "msg-uuid-123",
  "sender": "arts@ziekenhuis-a.nl",
  "recipient": "specialist@kliniek-b.nl",
  "action": "DELIVERED",
  "encryptionLevel": "TLS",
  "sourceIP": "10.0.0.1",
  "userAgent": "Outlook/365",
  "classification": "MEDISCH_VERTROUWELIJK"
}

Retention

Record per type of log and per type of message content how long you keep it, who can access it and what the policy of your organisation prescribes for it.

Compliance Checklist

Technical

• TLS 1.3 activated
• S/MIME or PGP certificates rolled out
• DLP policies configured
• Audit logging active
• Backup and recovery tested

Organisational

• Data processing agreement with your supplier
• Privacy-by-design assessment
• Staff trained in the safe use of email
• Incident response plan for data breaches

Audit

• External audit every year
• Penetration test on the mail infrastructure
• Log review by a security team

Noveu Support

You receive technical and organisational evidence on request. For a question or incident, open a ticket in the customer portal or email support@noveu.eu. Response times are in the SLA.