# Mail flow guide: secure email in healthcare

## Overview

This guide shows how a secure mail flow in healthcare works technically: from sender via the mail server to the recipient, with the measures and logging per phase. The requirements come from NTA 7516, the Dutch Technical Agreement of NEN for the secure exchange of health information by email and chat.

What the standard asks, who certifies and which technical measures Noveu applies, you read on [our page about NTA 7516](https://noveu.eu/en/nta-7516).

## Scope

According to NEN, introducing NTA 7516 is not (yet) mandatory. The standard is based on the GDPR and eIDAS, and those do apply. The standard is intended for anyone who exchanges health information by email or chat, such as:
- Hospitals and healthcare institutions
- GPs and specialists
- Pharmacies
- Health insurers
- Any party that exchanges patient data

## Core principles

### 1. Confidentiality

**Requirements:**
- Unauthorised persons cannot access encrypted messages or the keys
- Access only for authorised recipients
- No unauthorised access during transport

**Status at Noveu:**
- Enforced TLS for transport (available)

### 2. Integrity

**Requirements:**
- Messages must not be changed unnoticed
- Digital signatures where required

### 3. Availability

**Requirements:**
- Messages must arrive on time
- Systems must function reliably

**Status at Noveu:**
- Availability follows the SLA at [noveu.eu/legal/sla](https://noveu.eu/en/legal/sla): 99.5% per month as a target
- Backups in the Hetzner data centre in Falkenstein (Germany), on a separate disk and VM
- Every night an encrypted copy of the databases and the mail goes to separate object storage at Hetzner, outside this server and also in Falkenstein

### 4. Auditability

**Requirements:**
- Complete audit trail of message traffic
- Logging of access and actions

**At Noveu:**
- Audit log per organisation with a hash chain, exportable as CSV

## Setting up your own logging

Use the following fields and checklist to agree on logging with your supplier and within your organisation.

### Minimum log fields

```json
{
  "timestamp": "2026-01-15T10:30:00Z",
  "messageId": "msg-uuid-123",
  "sender": "arts@ziekenhuis-a.nl",
  "recipient": "specialist@kliniek-b.nl",
  "action": "DELIVERED",
  "encryptionLevel": "TLS",
  "sourceIP": "10.0.0.1",
  "userAgent": "Outlook/365",
  "classification": "MEDISCH_VERTROUWELIJK"
}
```

### Retention

Record per type of log and per type of message content how long you keep it, who can access it and what the policy of your organisation prescribes for it.

## Compliance Checklist

### Technical
- [ ] TLS 1.3 activated
- [ ] S/MIME or PGP certificates rolled out
- [ ] DLP policies configured
- [ ] Audit logging active
- [ ] Backup and recovery tested

### Organisational
- [ ] Data processing agreement with your supplier
- [ ] Privacy-by-design assessment
- [ ] Staff trained in the safe use of email
- [ ] Incident response plan for data breaches

### Audit
- [ ] External audit every year
- [ ] Penetration test on the mail infrastructure
- [ ] Log review by a security team

## Noveu Support

You receive technical and organisational evidence on request. For a question or incident, open a ticket in the customer portal or email support@noveu.eu. Response times are in the [SLA](https://noveu.eu/en/legal/sla).