What's the WDO and how will it affect the care sector?
Giving patients control over their data is the future
The future of the care sector is digital. The introduction of electronic medical records will mean a huge volume of digital transactions, for example. In the Netherlands, the most common medium for authenticating such transactions is currently DigiD. However, reliance on DigiD presents challenges where convenience, affordability and data availability are concerned. A further complication is that some care sector actors can't use DigiD, because they don't have a legitimate legal basis for processing Public Service Numbers (BSNs). New authentication models are therefore needed, and the government has the job of enabling provision. That's what the Digital Government Act, currently before parliament, is intended to do.
What does 'WDO' stand for?'
WDO' stands for 'Digital Government Act' in Dutch. The WDO sets out the rules on digital security, control and the standards to be followed. It's intended to ensure that Dutch citizens and businesses have secure and reliable electronic access to public and semi-public services. The WDO is relevant to hospitals, health insurers and other care sector organisations in connection with electronic medical records, for example.
New arrangements for secure and reliable electronic access
Under the WDO, citizens will have access to electronic identity media (eIDs) that offer a higher level of assurance than the existing DigiD. The new IDs will have to enable public service providers to identify clients with greater certainty. The WDO has major implications for the care sector, because it will require that citizens, clients and patients have secure electronic access to public, semi-public and care services. The big change compared with the current situation is that the WDO will open the way for private eID media to be authorised for use. At the moment, DigiD is the only ID system that can use BSNs. What remains to be clarified is who the Dutch government will allow to offer authentication solutions, and on what conditions. Consideration will probably be given to issues such as what the data storage arrangements are (central or local storage) and what kind of organisation is responsible for the service (non-profit or commercial).
The solution: self-sovereign identity (SSI)
One way of putting the WDO's provisions into practice is to use 'self-sovereign identity' (SSI) applications. An SSI application is a decentralised solution, where the patient has secure control over all their data. It's like a digital wallet carried on a smartphone. The user keeps trustworthy information in it, which can be 'shown' to service providers, in the same way you show your passport in the real world. Like a physical wallet, the digital wallet can be used to carry whatever ID information the patient happens to need. Another plus point of SSI is that the patient never has to share more information than is actually required. Only those items of data ('attributes') necessary for access to the relevant service are shared,
Four advantages of SSI
As well as giving patients control of their data, SSI brings important security, privacy and convenience benefits. The four main advantages of an SSI solution are described below.
1. SSI cuts the risk of data breaches
An SSI solution minimises all risks relating to security, transparency and the improper use of personal data and behavioural information. That's because, with decentral data storage, a problem can only affect a single patient's user account, not a central database. So it's very hard for a hacker to get at the data of numerous patients.
2. Decentralisation ensures privacy by design
SSI is the best way of implementing the principle of 'privacy by design'. That's a design principle where technical and organisational provisions are made to ensure the responsible use of personal data, right from the start of the development process. Privacy by design prevents the creation of central honeypots that might attract hackers and other malicious internet users. It also addresses the risk of improper data exploitation, because appropriate safeguards are built into the SSI solution. With SSI, privacy is no longer a procedural matter, but is technically enforced.
3. Security is achieved by open-sourcing
Security is further enhanced if an SSI solution is open source. Anyone can then view the code, meaning that vulnerabilities are quickly identified, and no secret 'back doors' can be left in the software. An open-source approach is fully consistent with the WDO as well. With open-sourcing, it's clear what the software does and where processed personal data flows lead. Open-source solutions also facilitate reuse, extension and improvement. Last but not least, open-source solutions are available to use for free, or at cost price.
4. SSI cuts transaction costs
Financial considerations naturally play a part in decision-making. The use of SSI enables data from a source or register to be issued once, then reused for as long as it remains valid. That significantly reduces the cost per transaction, promoting use of the system.
More information
Want to know more about SSI and the benefits it offers? Drop us a line or give us a call – we're happy to help, with no strings attached. Curious about the future of authentication media and SSI? Read our blog 'What's the future of authentication media in the care sector', explaining what we expect for SSI. It's available from 6 February.
