What's the future of authentication media in the care sector?

Put patient privacy centre stage

Vrouwelijke arts zit aan haar bureau en praat met een oudere vrouwelijke patiënt terwijl ze naar haar testresultaten kijkt

In the care sector, it's important to have secure and workable arrangements for handling patient data. DigiD is currently the most widely used authentication medium for controlling patient access. However, reliance on DigiD does involve certain challenges. The Dutch government is therefore preparing to introduce the Digital Government Act (WDO), with the intention of improving the authentication landscape. Against that backdrop, self-sovereign identity (SSI) applications are being developed to give patients and other citizens a reliable way to identify themselves online while keeping control of what data they share with whom. This blog considers how SSI will shape the future of electronic authentication, introduces the IRMA authentication system, and explains how the care sector can benefit from using IRMA.

The future of electronic IDs

The current eID landscape offers private individuals various ways of identifying themselves: itsme, iDIN and DigiD to name but three. All of them have a common feature: they can be used to access public services (e.g. health care) or private services, but not both. As a result, it's not always easy for patients and care professionals to exchange important data. The WDO will change that by paving the way for reliable and convenient ID systems to be made available for the public, including patients, to use when accessing both public and private services. Before long, we'll hopefully see an SSI medium that makes it easy to use various types of personal data, including information from the National Personal Records Database (BRP), banking data and personal contact details to access online care services.

IRMA: I Reveal My Attributes

One promising initiative within the SSI domain is IRMA ('I Reveal My Attributes'): IRMA enables people to easily and securely log in, identify themselves and give authorisation online. The free IRMA app lets patients fetch their own identity 'attributes' using their smartphones, and then reveal or share only the necessary attributes with online service providers and others who request their details. No personal data is saved centrally or anywhere except on the patient's phone. Every user decides what electronic identification (eID) medium or combination of media they want to use, minimising potential obstacles to acceptance. It's possible to increase digital assurance by using multiple media simultaneously, for example. When the WDO comes into effect, the approval criteria for authentication media will be defined in subordinate legislation. We are currently working to secure IRMA's approval under the WDO.

IRMA and VGZ

Health insurer VGZ uses IRMA to enable patients' representatives to submit claims for their clients. Using IRMA, the insured patient authorises a trusted person to make claims on their behalf. Authorisation can also be given using DigiD. However, because it's now mandatory to go through a two-factor authentication process, usually involving use of the client's phone, DigiD is no longer a practical option. Other players in the care sector working with IRMA include ChipSoft, Ivido and HINQ.

How does IRMA work?

With IRMA, the patient brings together data from various sources to build a personal 'passport' on their mobile phone. The passport includes various pieces of information about the user, known as 'attributes', such as name, address, date of birth, e-mail address, mobile phone number, Public Service Number (BSN), professional registration details, IBAN, student status, qualifications, club membership status, discount entitlements and age.

A digital signature from an authoritative organisation is attached to each attribute to confirm its authenticity. So, for example, the patient's address might be signed by their local authority. An expiry date is also specified for the validity of each attribute. Another option open to the patient is to use a selection of attributes for digitally signing legal documents. A user's signature will usually be based on their name attribute, but IRMA also allows the user to sign in a professional capacity, e.g. as a doctor. In that case, the signature is linked to user attributes recorded in the national register of health care professionals.

Having compiled a 'passport' made up of validated attributes, the patient can release appropriate items of personal data to 'verifiers'. Verifiers use special cryptographic techniques to check the authenticity of the data and are therefore not really dependent on third parties. That's in contrast to most current ID systems, which do require third-party involvement, making the system more complex and more vulnerable. Not to mention more expensive.

Try IRMA with your mobile phone and the website of Gemeente Amsterdam

The advantages of IRMA

IRMA has various advantages:

  • Better patient data security than with central data storage

  • Easier client journey, because the chain is optimised, and the client only needs one eID and decides what data to share

  • IoT-based innovations facilitated, because the security of the IoT application is not a limiting factor

  • Public-private collaboration encouraged by removal of the distinction between public and private ID media

Read more about the advantages of IRMA.

Innovation manager that logs in with Yivi

About IRMA

IRMA is a spinoff of academic research into attribute-based authentication. A Radboud University team led by Professor Bart Jacobs has been working in the field since 2008. In October 2016, the task of securing IRMA's large-scale rollout was handed over to a non-profit foundation called Privacy by Design. IRMA powered by SIDN is a collaboration between SIDN and Privacy by Design. The two organisations have teamed up to take forward development of the privacy-friendly IRMA identity platform. As operator of the .nl internet domain, SIDN has been working for many years to maximise the security and accessibility of the internet in the Netherlands. We're now using the knowledge and experience we've gained to provide IRMA with an equally solid base. Secure and convenient digital identities for individuals and organisations are a matter of communal interest. The IRMA software is therefore open source, and we operate on a non-profit basis. We firmly believe that IRMA is the most ethical and trustworthy public and private identity solution available; a solution that truly puts user privacy first. Read more about IRMA.

About IRMAconnect

IRMAconnect makes it possible to use IRMA as a turnkey verification service for attribute handling. IRMAconnect then acts as a hub linking your online services, your customers and IRMA. It's easy to interface with IRMAconnect using the SAML 2.0, OAuth or OpenID Connect protocol. So your customers can use IRMA as a safe and straightforward login and authentication medium for accessing your website, client portal or other online service. IRMAconnect's reliability also provides a basis for making assurances in a service level agreement. Read more about IRMAconnect.

More information

Want to know more about IRMA and the benefits it offers? Drop us a line or give us a call – we're happy to help, with no strings attached. Curious about the WDO? Read our blog 'What's the WDO and how will it affect the care sector?', which explains what the WDO is all about. Want to know more about the challenges of authentication? Read our blog 'What challenges does care sector authentication present?'