Care sector innovation means more patient data

"Results of 25,000 Dutch medical scans exposed by leak" was the headline on the RTL News website in September last year. Inevitably the story made everyone concerned about privacy sit up and take note. So, what went wrong? Apparently, medical information about 25,000 Dutch people was stored on servers without being secured. The data included the results of hospital examinations, such as X-rays and MRI scans, plus patients' first names and surnames, dates of birth, treatment information and, in some cases, details of the doctor in charge of the case.

"Shocking" is how security expert Dirk Schrader described the potential data breach. "Information like that could be used for blackmail, or combined with other data for malicious purposes. You really don't want medical information like that getting into the public domain," said Schrader. "Such incidents represent a huge risk for the system operators as well. The information in question is used to prepare medical treatments, and the doctors involved have to know what treatment their patients need. If a patient is due to be treated and suddenly the whole system is unavailable because someone's taken it down, that's a catastrophe."

Data enables innovation

The revelation that medical data isn't always adequately protected is all the more disturbing when one considers the growing role of data in the care sector. Without effective means of keeping medical data secure, innovation is likely to be held back. Many Internet of Things (IoT) applications are now coming on line, which deliver added value by exchanging patient data with third parties. Good examples include:

• A system that alerts lay carers when abnormal or dangerous situations arise

• Smart matrasses that share data with nurses, care providers and other staff

• Applications that monitor variables such as glucose levels or blood pressure, and pass on the data to medical professionals

It would be a crying shame if innovations like those had to be abandoned because the security of the data couldn't be assured. The assurance of client privacy is essential and requires an approach spanning multiple security levels:

• Through whom is data shared?

• Where is the data stored?

• Who has access to the data?

• How can we ensure that appropriate people (e.g. home carers and lay carers) can also gain access to client information when they need it?

The role of authentication

The security of medical data depends on authentication: the process of verifying that a digital service user is who they say they are. One of the best-known authentication systems in the Netherlands is DigiD. However, as explained in our new whitepaper, that system is now approaching the end of its useful life. The Dutch parliament is therefore debating a law that will pave the way for a new system: the Digital Government Act, or WDO. Under the WDO, citizens will be given electronic identities (eIDs) that offer a higher level of assurance. The WDO, whose phased implementation is expected to start in 2021, will open up the market to new authentication systems. When it comes into effect, detailed approval criteria for authentication media will be defined in subordinate legislation. As one of the partners behind the IRMA authentication system, SIDN will be working hard to ensure that this solution secures approval.

What is IRMA?

IRMA enables people to easily and securely log in, identify themselves and give authorisation online. The free IRMA app lets users fetch their own identity 'attributes' using their smartphones, and then reveal or share only the necessary attributes with online service providers and others who request their details. No personal data is saved centrally or anywhere except the user's phone. IRMA has countless potential applications, but several crucial benefits for the care sector in particular:

• It means innovation in fields such as the IoT isn't held back by poor security.

• Having no central data storage increases the general security of medical records.

• Chain optimisation means a smoother customer journey for the patient, who gets to decide what information will be shared with which care provider. The patient also has the option of using IRMA for interaction with private service providers as well.

• Removal of the distinction between public and private ID systems promotes collaboration between government and the business community.

If you'd like to know more about IRMA, we recommend reading our whitepaper. As well as exploring the authentication-related challenges facing the care sector, the whitepaper outlines how IRMA works and how it can help the sector overcome those challenges. Download the whitepaper Self-sovereign identity: giving patients more control over their medical records.

Download the whitepaper

In order to download the whitepaper (in English), we would like to receive a few details from you.