Millions of Dutch patient files copied, stored by commercial software company

The majority of all patient files of Dutch general practitioners are copied and stored on a commercial software company’s computer on a weekly basis, NRC reports based on its own investigation. That involves the personal medical data of millions of people, many of whom are unaware that their doctors are sharing the information, according to the newspaper.

The GPs use software from the company Calculus in Leiden, which is part of a Canadian investment firm, to collaborate with other practitioners in the region. It is mainly intended to simplify the care of patients with chronic conditions like diabetes or the lung disease COPD. The company makes a copy of a GP practice's entire patient administration, including people without chronic illnesses, every week and stores it.

Privacy laws dictate that large amounts of data mustn’t be stored in one place to limit the consequences of a data leak or hack. According to NRC, the Dutch Data Protection Authority looked into Calculus in 2018 but saw no reason for a follow-up investigation. The company stores the data encrypted, doesn’t share it further, and the data can only be viewed by general practitioners, the regulator said to the newspaper.

Several doctors don’t like the practice. “I actually had no choice,” one GP told the newspaper. “To this day, I am amazed that I’m exchanging data for which some of my patients have never been asked if they’re okay with it. I’m not comfortable with it, still not.”

Calculus doesn’t see the problem, director Rosa Sherjon told NRC. “The time when sensitive personal medical files were only stored in steel filing cabinets in the basement of GP practices is now far behind us. Look, the data remains the responsibility of the GP even after the copy. It does not leave their domain. We do this only on behalf of the doctor, for the benefit of the doctor.”

The company stressed that the data is well-secured and encrypted, and only the doctor can access it.

The LHV, the national association of GPs, told NRC that the general practitioner is ultimately responsible for what data they do and do not share. But doctors often don’t have much power in what IT they use, the association said. “There is currently too little freedom of movement and transparency for GP practices. Switching is complex, time-consuming, and sometimes also expensive, and there is too little clarity about costs and what you get for it,” the association said.