Cloud and IT for Hospitals and Healthcare

Yes, there is no legal ban. However, you must comply with the GDPR, NEN 7510, and the duty of care under the Cybersecurity Act, and you must manage the risks associated with your cloud provider: in which region is the data stored, who has access to it, and which jurisdiction governs the provider. Many hospitals deliberately choose to host their systems in the Netherlands; in 2025, Bernhoven opted for a Dutch healthcare cloud for its EHR. Using a Data Sovereignty Assessment, SUE determines for each application which data may be stored where.

If you have a NEN 7510 certificate, you must transition to NEN 7510:2024 by February 20, 2027. After that date, certificates based on the old standard will expire. The new version follows the structure of ISO 27001 and 27002 from 2022, with new and restructured controls, including those for cloud services and suppliers.

Since August 15, 2026, the healthcare sector has also been subject to the Dutch Cybersecurity Act. This Act imposes a duty of care on the boards of medium-sized and large healthcare providers. NEN 7510:2024 is the most logical way for the healthcare sector to demonstrably fulfill this duty of care.

Start by conducting an assessment for each application. Is it already running in containers? Does the vendor support Kubernetes? And which integrations with the EPD are critical? Applications with medical certification or strict vendor agreements often remain on virtual machines initially. Next, migrate each application to a single platform where logging, backups, access management, and network segmentation are configured according to NEN 7510 from the start. That way, you won’t have to set these up again for each application. SUE builds such Kubernetes platforms—both on-premises and in the cloud—and manages them with Managed Kubernetes.

A Landing Zone is the solid foundation for your cloud applications: account structure, network, identities, logging, and policies. For a hospital, you define within it which region data may be stored in, ensure that all access is routed through your own identity management system with MFA, and that logging is stored centrally and immutably. Define these rules as Infrastructure as Code. Then, every new application automatically receives the same security, and the evidence for your NEN 7510 audit comes directly from the platform itself. SUE builds Landing Zones for AWS and Microsoft Azure in this way.

Yes, but as a healthcare provider, you remain responsible under the Dutch Cybersecurity Act and NEN 7510. Your managed service provider must therefore demonstrably meet the same requirements. Specify in the contract who is responsible for patching and monitoring, how quickly an incident must be reported to you so that you can meet your own reporting obligations, and where your data and the administrators are located.

If the supplier handles personal data, you’ll also need to enter into a data processing agreement. With Managed Services, SUE takes over the management of Linux, Kubernetes, and the cloud, with terms and conditions that you can include in your own audit. For more details on what to include in the contract, see the guide on outsourcing IT management.