Dutch healthcare firms on notice after GDPR fine for orthodontist

Healthcare providers in the Netherlands have been reminded of the importance of protecting their clients’ data after the Dutch Data Protection Authority (DPA) issued a €12,000 fine to an unnamed orthodontist for breaching the General Data Protection Regulation (GDPR). More specifically, the DPA fined the orthodontic practice for using an unsecured website for registering clients, running the risk that sensitive personal data such as social security numbers could end up in the wrong hands. “When you register with an orthodontist, you provide a combination of personal data in confidence,” said DPA’s vice-president Monique Verdier. “These data are necessary for orthodontic practice, but are also very interesting for criminals.” Ms Verdier also stated that the DPA’s actions in this case showed that GDPR rules will be applied to all healthcare providers, both small and large. “Taking good care of your patients also means taking good care of your patients’ personal data. That does not only apply to large healthcare organisations but also applies to every healthcare provider.” The fine was issued after a complaint from the general public to the DPA triggered an investigation. Of particular concern was the fact that the web-based registration form asked clients to enter a variety of personally sensitive information, including that of children. The data was then sent unencrypted to the orthodontist. “You must be able to assume that your care providers not only treat your data confidentially, but that they also take the security of your data very seriously and have it properly organised,” said Ms Verdier. “Unfortunately, that is not always the case. Violating the confidentiality of this sensitive information can pose a significant risk to someone. This can lead to fraud, for example,” she added. According to law firm Pinsent Masons, the DPA’s actions should be seen as a warning to others. Dutch data protection expert Wouter Seinen told the law firm’s in-house publication Out-Law.com that the use of unencrypted online forms is commonplace among healthcare providers. The fine, therefore, was likely issued to encourage other healthcare providers to use encryption and secured websites for dealing with clients’ personal information. It is notable that the size of the fine was much reduced in this case. The breach of Article 32 of the GDPR, which relates to the security of processing, would normally result in a basic fine of €310,000, however that case did not involve patient administration. The fine was further reduced, to €12,000, on the grounds of proportionality and the size of the firm in question. It is the not the first time this year that the DPA has issued fines for lax data practices. In May, the authority fined maintenance company CP&A for the processing of the health data of its employees. The firm maintained a register of the different causes of workers’ sick leave. The DPA ruled that the company not only processed more health data than legally permissible but it also failed to adequately secure the data. CP&A’s sick-leave register was accessible online, without any form of authentication system, stated the DPA. Information about someone’s sick leave can say something about their health, so especially strict requirements apply to the security of health data. Only authorised employees may access such data. If a sick-leave system is accessible via the internet, access to the system is permitted only via multi-factor authentication. Besides a regular login procedure, authorised individuals must confirm their identity in another manner, such as by using a security token, in order to gain access. A login system requiring only a username and password is therefore not sufficient. “Of course, it’s completely understandable that an employer wants to know whether someone’s sickness absence is going to be short or long term in nature,” said DPA board member Katja Mur. “But to establish this, it isn’t necessary for employers themselves to process health data or start playing doctor.” And in February, the DPA imposed a €440,000 fine on Amsterdam-based hospital OLVG for failing to protect its patients’ medical records between 2018 and 2020. The DPA’s investigation was launched after it emerged that medical students were able to access patients’ medical records. “It doesn’t bear thinking about that people who have no business doing so could look at your doctor’s notes and pry into your state of health and personal details,” said Ms Verdier. “Patients have the right to expect that staff members will only access their medical records if it is necessary for the patient’s treatment. OLVG’s security measures couldn’t guarantee that. That’s a serious breach and that’s why the DPA has imposed this fine,” she added.

Dutch healthcare firms on notice after GDPR fine for orthodontist

Want to read this article?

Read Next

Courage and collaboration needed to manage emerging construction sector risks

Dubai floods put $8bn of aircraft at risk, estimates Russell Group

Parima heads to Manila for first of three conferences this year

Munich Re ‘more likely’ to exceed 2024 profit target after €2.1bn gain in Q1

Insurance Europe calls for EC to ‘get it right’ on Solvency II

Courage and collaboration needed to manage emerging construction sector risks

Dubai floods put $8bn of aircraft at risk, estimates Russell Group

Parima heads to Manila for first of three conferences this year

Munich Re ‘more likely’ to exceed 2024 profit target after €2.1bn gain in Q1

Insurance Europe calls for EC to ‘get it right’ on Solvency II

Want to read this article?

Read Next

Courage and collaboration needed to manage emerging construction sector risks

Dubai floods put $8bn of aircraft at risk, estimates Russell Group

Parima heads to Manila for first of three conferences this year

Munich Re ‘more likely’ to exceed 2024 profit target after €2.1bn gain in Q1

Insurance Europe calls for EC to ‘get it right’ on Solvency II

Related Articles