In force since 2017, the Processing of Personal Data in Healthcare (Additional Provisions) Act [Wet aanvullende bepalingen verwerking persoonsgegevens in de zorg - “Wabvpz”] lays down the terms for the secure electronic exchange and inspection of medical data.
The legislator has added new provisions to the Act, which will enter into force on 1 July 2020. Where the processing of personal data is concerned, Sections 15d and 15e are relevant.
We will explain the changes to prepare you for a successful implementation.
Section 15d Wabvpz: The right to electronic inspection and copies
The right of citizens to inspect and obtain copies of their electronic medical records is an addition to their right to inspect and obtain copies of their paper records as laid down in Section 7:456 of the Medical Treatment Contracts Act [Wet geneeskundige behandelingsovereenkomst - “Wgbo”]. A key difference between the new Wabvpz provision and the older Wgbo provision is that the latter stipulates that a healthcare provider may charge a reasonable fee for providing a paper copy, whereas the electronic copy referred to in Section 15d Wabvpz must be provided free of charge.
For this reason, it is important that healthcare providers, with their automated systems, will be able to honour requests ensuing from this right.
Section 15e Wabvpz: The right to log records
Under this section, citizens have the right to request log records: an overview of all transactions relating to their electronic medical records, such as info on who entered what data and who inspected or retrieved data from their records on what dates, also known as logging.
Apart from affording citizens an additional right to inspection, this section also imposes on healthcare providers an additional personal data security obligation, that is to log all transactions in the electronic health records systems. Since the publication of NEN 7513, it has been known that logging is a major element of ensuring the security of personal data, a fact highlighted by the DPA's fine decision in the Haga Ziekenhuis case.
Specific consent?
The legislator initially intended that from 1 July 2020 citizens would have the right, in addition to their express consent, also to give specific consent as to which of their medical data may be shared with healthcare providers. The latter category would cover only those healthcare providers with which the citizens have a treatment relationship. We must add that healthcare insurers, examining doctors, company doctors and insurance doctors do not have access to patient data through the electronic medical records exchange system.
Section 15a(2) sets out the details regarding specific consent. While Sections 15a(1) and 15a(3) Wabvpz have force of law already, in the latter months of 2019 former Medical Care Minister Bruins announced that it was going to be impossible to implement Section 15a(2) by the summer of 2020.
Over the past few years, as part of the Gespecificeerde Toestemming Structureel (“GTS”) programme, healthcare providers and patients’ associations explored the most user-friendly solution to implementing Section 15a(2) Wabvpz. The first GTS report returned 160 specific consent possibilities. The parties collaborating in the GTS programme concluded that in its current design, Section 15a(2) Wabvpz cannot be used effectively by citizens, patients and healthcare providers. An alternative scenario designed under the GTS programme returned 28 consent possibilities.
The Advisory Board on Excessive Regulation [Adviescollege toetsing regeldruk - “ATR”] issued its advice on the matter, stating that this alternative scenario would diminish the specificity of the options available, which would hamper the patient's ability to make the right choice. The ATR concluded that there is no practicable implementation possible of the specific consent provision as laid down in the Wabvpz.
Former Minister Bruins stated that in the first six months of 2020 he would submit a proposal relating to the implementation of specific consent. Given present circumstances, the wait is bound to be somewhat longer.
Legal advice or more information
If you want to know more about your organisation's obligations arising from the Wabvpz, then feel free to contact Martin Hemmer.
The (Dutch) text of the Sections mentioned in this blog can be found here.
In force since 2017, the Processing of Personal Data in Healthcare (Additional Provisions) Act [Wet aanvullende bepalingen verwerking persoonsgegevens in de zorg - “Wabvpz”] lays down the terms for the secure electronic exchange and inspection of medical data.
The legislator has added new provisions to the Act, which will enter into force on 1 July 2020. Where the processing of personal data is concerned, Sections 15d and 15e are relevant.
We will explain the changes to prepare you for a successful implementation.
Section 15d Wabvpz: The right to electronic inspection and copies
The right of citizens to inspect and obtain copies of their electronic medical records is an addition to their right to inspect and obtain copies of their paper records as laid down in Section 7:456 of the Medical Treatment Contracts Act [Wet geneeskundige behandelingsovereenkomst - “Wgbo”]. A key difference between the new Wabvpz provision and the older Wgbo provision is that the latter stipulates that a healthcare provider may charge a reasonable fee for providing a paper copy, whereas the electronic copy referred to in Section 15d Wabvpz must be provided free of charge.
For this reason, it is important that healthcare providers, with their automated systems, will be able to honour requests ensuing from this right.
Section 15e Wabvpz: The right to log records
Under this section, citizens have the right to request log records: an overview of all transactions relating to their electronic medical records, such as info on who entered what data and who inspected or retrieved data from their records on what dates, also known as logging.
Apart from affording citizens an additional right to inspection, this section also imposes on healthcare providers an additional personal data security obligation, that is to log all transactions in the electronic health records systems. Since the publication of NEN 7513, it has been known that logging is a major element of ensuring the security of personal data, a fact highlighted by the DPA's fine decision in the Haga Ziekenhuis case.
Specific consent?
The legislator initially intended that from 1 July 2020 citizens would have the right, in addition to their express consent, also to give specific consent as to which of their medical data may be shared with healthcare providers. The latter category would cover only those healthcare providers with which the citizens have a treatment relationship. We must add that healthcare insurers, examining doctors, company doctors and insurance doctors do not have access to patient data through the electronic medical records exchange system.
Section 15a(2) sets out the details regarding specific consent. While Sections 15a(1) and 15a(3) Wabvpz have force of law already, in the latter months of 2019 former Medical Care Minister Bruins announced that it was going to be impossible to implement Section 15a(2) by the summer of 2020.
Over the past few years, as part of the Gespecificeerde Toestemming Structureel (“GTS”) programme, healthcare providers and patients’ associations explored the most user-friendly solution to implementing Section 15a(2) Wabvpz. The first GTS report returned 160 specific consent possibilities. The parties collaborating in the GTS programme concluded that in its current design, Section 15a(2) Wabvpz cannot be used effectively by citizens, patients and healthcare providers. An alternative scenario designed under the GTS programme returned 28 consent possibilities.
The Advisory Board on Excessive Regulation [Adviescollege toetsing regeldruk - “ATR”] issued its advice on the matter, stating that this alternative scenario would diminish the specificity of the options available, which would hamper the patient's ability to make the right choice. The ATR concluded that there is no practicable implementation possible of the specific consent provision as laid down in the Wabvpz.
Former Minister Bruins stated that in the first six months of 2020 he would submit a proposal relating to the implementation of specific consent. Given present circumstances, the wait is bound to be somewhat longer.
Legal advice or more information
If you want to know more about your organisation's obligations arising from the Wabvpz, then feel free to contact Martin Hemmer.
The (Dutch) text of the Sections mentioned in this blog can be found here.