This article was published in 2019. Laws, case law and regulatory guidance may have changed since then. Contact us for up to date advice.
Investigation into the internal security of patient records
The HagaZiekenhuis (Haga Hospital) does not have its internal security of patient data in order. This emerged from an investigation by the Dutch Data Protection Authority (AP). This investigation followed after it emerged that dozens of hospital employees had unnecessarily accessed the medical record of a well-known Dutch person. The AP thus finds that the hospital does not adequately secure its patient records. The AP is therefore imposing a fine of 460,000 euros on Haga for insufficient security of patient records.
In addition to an administrative fine of 460,000 euros, the AP is imposing an order subject to a penalty on the Haga Hospital. The AP is doing this to compel the hospital to improve the internal security of patient records. If the Haga Hospital has not improved its security before 2 October 2019, the hospital must pay 100,000 euros every two weeks, up to a maximum of 300,000 euros. The Haga Hospital has indicated that it is taking measures to guarantee the security of patient records.
Confidential relationship between healthcare provider and patient
There is a confidential relationship between the healthcare provider and the patient. This follows not only from the GDPR, but also from the Dutch Medical Treatment Contracts Act (WGBO). The relationship between a healthcare provider and a patient must therefore be completely confidential. It makes no difference who you are or what your complaints are. The healthcare provider must respect this and therefore also take measures to promote confidentiality.
Security of patient records
The General Data Protection Regulation (GDPR) is not optional. On the contrary: the GDPR entails various obligations for organisations and companies in the healthcare sector. For example, a hospital must take all technical and organisational measures to guarantee the internal security of patient records. This also applies to the Haga Hospital. The regulator states that the Haga Hospital processes special category personal data. According to the AP, the hospital failed to comply on two points:
- The hospital must regularly check who consults which record. In this way, the hospital can identify in good time when someone consults a record without authorisation and take measures against this.
- Good security includes authentication involving at least two factors. The identity of a user seeking access to a patient record is then established, for example, with a code or a password in combination with a staff pass.