What challenges does care sector authentication present?
Patients are repeatedly asked for the same data
More and more is being done online in the care sector, just as in other fields. Given the rapid growth of e-health, the security of medical records has never been more topical. It's important that the right care providers have access to patient data, without compromising patient privacy. That implies a careful approach to data sharing, storage and access.
The rise of the Internet of Things, where internet-enabled devices communicate with one another, is also driving the need for strong security safeguards. The IoT is used for fall detection, for example. The patient wears a smart wristband, which can tell if a patient has had a fall. When the detection system is triggered, the wristband alerts a care worker over the internet. Another application of the IoT is glucose monitoring devices that diabetics can wear.
Again, a care provider is contacted over the internet if anything is amiss. It's obviously important that patient data sent by IoT devices doesn't get into the wrong hands. But how to you actually prevent that in practice? The key to patient data security is authentication: the process of verifying that a digital service user really is who they say they are. This blog therefore explores the authentication-related problems that insurers, care providers and patients currently face.
How is digital authentication organised in the care sector?
Care provision is always associated with a person: the care user. Authentication is therefore essential: is the user really the person who is entitled to the relevant care? It's also vital to ensure that only authorised people and organisations have access to the care user's medical records. In the Netherlands, authentication in the context of remote care mainly involves the use of DigiD. DigiD is the Dutch national digital authentication system that uses Public Service Numbers (known as BSNs) to confirm service users' identities online. In the Netherlands, people's medical records are linked to their BSNs, meaning that DigiD can be used in the care sector. Since 1 June 2008, the use of BSNs in the care sector has been regulated by a special law known for short as the Wbsn-z.
The two big challenges with DigiD-based authentication
DigiD-based authentication is an old-fashioned, error-prone technology. And the present authentication landscape presents other challenges too. The two main ones are explained below.
The Constamed case
Constamed is an online service that enables patients with non-urgent conditions to consult affiliated GPs over the internet. The system was intended to optimise use of the doctors' capacity.
Users were able to log in using DigiD, until it emerged that enquiries were often being routed to doctors who didn't have access to the clients' BSNs. The system was therefore changed, so that users could only contact their own GPs.
Patients are repeatedly asked for the same data
Organisations involved in the care chain are often unable to exchange data, because they work with different systems that can't communicate. As a result, patients often need to provide the same information over and over again. You might think that the data exchange problem could be solved by everyone using the same systems. However, not all organisations in the chain have access to DigiD, which is reserved for government bodies and organisations with public service responsibilities, such as hospitals and health insurers. Other organisations are not allowed to process clients' BSNs. The situation acts as a deterrent to the development of innovative solutions that would allow care service providers to interact more efficiently.
Representatives face serious obstacles
The current system is inconvenient for patients. However, patients' authorised representatives face even bigger obstacles when doing things such as arranging care and making insurance claims. They have to repeatedly show that they are authorised to act on the patient's behalf. A further complication is that a DigiD login involves two-factor authentication, usually implying use of the client's mobile phone. So the patient still has to be involved, despite having authorised someone else to take care of things for them. That's stressful for the patient and for the partner, relative or professional acting on their behalf. So, what's the answer?
The solution: a new authentication system
Given the challenges described above, it's clear not only that DigiD is reaching the end of its useful life, but also that new authentication models are needed for efficient electronic service delivery. Fortunately, the Dutch government recognises the need for change. It's therefore planning to introduce a new authentication system for regulating access to care services and other public and semi-public services. The framework for that system will be provided by the Digital Government Act, currently before parliament.
More information
Want to know more about DigiD-based authentication in the care sector? Drop us a line or give us a call – we're happy to help, with no strings attached. Curious about the Digital Government Act (WDO)? Read our blog 'What's the WDO and how will it affect the care sector?', which explains what the Digital Government Act is all about.
