"Exchanging patient data can be more secure, efficient and privacy-friendly"

As one of the people behind the initiative, Tim Franssen – Product Developer at Nedap Healthcare and Director General of Nuts – has been involved from the get-go. With a background in informatics, he works in areas such as the technical aspects of standardisation, compliance with privacy legislation and the protection of personal data. Here, he explains how things are going at Nuts, the movement's implementation of IRMA and the importance of organising data exchange in the health care sector on the basis of protocols.

Nuts and the manifesto

"My first experience of standardising data exchange in the health care sector was a MedMij programme, about five years ago," recalls Tim. "What struck me was how many different interwoven discussions a standardisation process involves. That prompted me to ask, how can we do this more efficiently? And then, what things do all care sector data exchanges have in common? If you identify the common elements and devise solutions for them, those solutions can be reused for various applications, speeding up the process of developing successful data exchange arrangements. It was that idea that led to the formation of Nuts in 2018." "Nuts is a combined foundation and community, with a wide range of members, including many health care sector ICT vendors. Together, we are working to build a decentralised infrastructure for the entire sector. We organise technical workshops, develop standards and produce open-source software in which those standards are implemented. As far as possible, everything is based on international standards, in order to maximise the deployability of our products. Nuts is founded on eight core principles, set out in our manifesto. Nuts is fairly unique on the Dutch landscape, because of the fact that, although our members are software vendors, we use open standards and we aren't marketing a product. At Nuts, we're striving for a world where much more is done on the basis of standards. Standardisation reduces the kind of dependency on individual vendors that you currently get when you purchase a product. However, that approach also presents us with a challenge: we don't want to deter vendors from participating in our network or using our standard and open-source software. But we do want to be able to verify that an organisation really is a care-sector ICT vendor and follows certain basic rules. Fortunately, we have been able to secure a grant from SIDN Fund, so that we can investigate ways of reconciling those two goals. And so that we can then implement and operate the solution on our Nuts network."

IRMA privacy-friendly logins

"Any health care provider that wants to exchange medical records needs to be absolutely sure that they are sharing information with the right person," says Tim. "That rules out single sign-on solutions as a means of identifying people. With an SSO solution, all you're doing is passing the problem on to a central identity provider (idP); you're not resolving it. So we looked around for an alternative mechanism for secure and privacy-friendly authentication. Our search led us the IRMA identity platform created by Privacy by Design. IRMA is one of the few applications capable of providing cryptographically secured evidence of a user's identity. Another good thing about IRMA is that the user only has to share the personal attributes that are actually needed in the context of that sign-on. The IRMA app stores the attributes locally for sharing as and when necessary. IRMA satisfies all our secure authentication criteria." "Many care providers make use of the UZI smartcard: an electronic passport that appropriately registered health care professionals can apply for and use. It's a neat solution that we support on our Nuts network as well. However, the UZI smartcard has the drawback that only registered professionals can use it. You also need a computer with a special card reader to view the electronic passport, making it unsuitable for mobile professionals. By contrast, you can login anywhere with the IRMA app, which is easy to install on a smartphone and operate securely. On top of that, IRMA, like Nuts, is constantly being refined on the basis of international open standards."

Looking to the future

"We're currently working with around thirty partners to promote and undertake research into ways for health care sector players to share medical records in a fast and privacy-friendly way," continues Tim. "Over the next year, we'll be busy developing and implementing eOverdracht, an information protocol for use in the context of nursing transfers. We're also working on a midwifery protocol for use in the Babyconnect programme. A number of other projects are in progress as well, addressing things such as quality indicators for health care institutions. I expect that we'll be devoting a lot of the next twelve months to practical implementations, and that in practice more and more people will come across both Nuts and the IRMA app. We have exciting times ahead." "I firmly believe that an organisation should plan for ultimate redundancy. For me, the aim is that working and organising on the basis of standards will ultimately become so well embedded that Nuts is no longer needed. I also hope that national health care programmes encourage everyone to implement standards on their infrastructures, and that care providers come to take for granted the use of digital wallets such as IRMA. That's the ideal that we're working towards at Nuts." Want to join the Nuts community, attend online meetings and help build a decentralised care sector infrastructure? Visit https://nuts.nl/community/ or mail info@nuts.nl.