SpecificAuthorisation.com campaign reaches House of Representatives

Bill by minister Schippers (VWS) threatens to legitimise generic consent for medical data sharing Campaign SpecificToestemming.nl asks House of Representatives to uphold specific consent.

Recently, on the initiative of Privacy First and the Civil Rights Protection Foundation, a large-scale internet campaign was launched around the right to medical privacy: SpecificAuthorisation.co.uk. The crux of this campaign is that specific consent should (again) become the guiding principle in the exchange of medical data. This is in contrast to the generic consent that applies, for example, to the private successor to the Electronic Patient Record, the National Switch Point (LSP). This week (Wednesday 10.15am), the Lower House is debating a bill that threatens to legitimise generic consent. In this context, the team behind SpecificToestemming.nl sent a fire letter with critical questions to the Lower House late last week.

The campaign SpecificAuthorisation.co.uk sent a letter to the House of Representatives on bill 33509, which is about client rights in healthcare. The campaign was launched at the end of April 2014 and is now being supported by numerous civil society organisations, healthcare providers and relevant academics.

The campaign team believes that the bill, despite its name, weakens rather than strengthens client rights in healthcare. Particularly on the issue of consent and control over the sharing of medical data, the proposal goes in the wrong direction. The new law introduces generic consent as a 'choice option' for clients. With this, patients will soon effectively be given the choice to give away their rights, following the US model. This contravenes privacy legislation, in particular strict European regulations and case law on the exchange of (medical) data. Under current European as well as Dutch legislation, the exchange of medical data requires the prior specific (targeted, well-defined) consent of the client. By definition, generic (broad, undirected) consent does not meet that requirement.

With generic (one-off) consent, medical data are shared by default with an incalculable number of (categories of) healthcare providers. When a healthcare provider wants to retrieve data via, for example, the National Switch Point, patients are suddenly asked whether they consent to the retrieval of data. For the client, at that moment it is completely impossible to know what data will be requested. Often, the client will not really be able to say "no" to the healthcare provider at that moment either. Moreover, malicious parties will also not care about the legal wash of consent when requesting data. With specific consent, clients should be able to determine prior to sharing information whether, and if so which, data may be accessed by which (categories of) healthcare providers. This reduces risks and allows clients to retain control over the sharing of their data.

The idea of generic consent - also as a choice option - goes against all existing European treaties, regulations and case law on informed consent. Moreover, the bill seems hardly practicable for healthcare providers, who already appear - with consent for the LSP - to be presenting a wide variety of (mostly misleading) consent questions to their patients. So how should this be done when choice is also before them? The law must be and remain clear: consent must be well-informed, and therefore specific. That is why the bill should not be passed in its current form.

Click HERE for SpecificAuthorisation.nl's letter with a number of critical questions and suggestions for the debate this Wednesday morning in the Lower House. On the same day, the Utrecht District Court is expected to rule in the lawsuit filed by the Association of Practising General Practitioners (VP Huisartsen) against VZVZ on the illegality of the National Switch Point. The case also centres on the issue of specific versus generic consent. This Wednesday thus promises to be a crucial day for the future of the right to medical privacy in the Netherlands.

Watch the promo of the campaign below:

Update 12 June 2014: click HERE and HERE for the verbatim reports of the House debate yesterday. The vote on the bill, motions and amendments tabled is tentatively scheduled for Tuesday 24 June next. However, the ruling by the Utrecht court in the case of VP Huisartsen vs VZVZ is deferred until (no later than) Wednesday, July 23 next. Below is an intriguing excerpt from yesterday afternoon's parliamentary debate:

"[CDA]: (...) Is it true that the LSP works with a generic opt-in and that a specific opt-in is not possible in the LSP?

Minister Schippers: We are now laying down in law that the specific opt-in will be an option though.

[CDA]: So, reasoning that back, I understand the minister to say: yes, the LSP now works with a generic opt-in.

Minister Schippers: The LSP works ahead of the system with an opt-in. I look briefly at my officials. Is the LSP now operating with a generic opt-in?

The chairman: Do you want to come back to that in the second term?

Minister Schippers: I will come back to that in the second term.
(…)
Minister Schippers: It was asked whether the LSP works with generic consent, with specific consent or with both. I had to check because it is not a system of ours. If I have to report something about a system, I check. The latest information I have received on this is that specific consent can be given per category but not yet per healthcare provider individually. (…) If you insist on having that specific permission, then just refrain from electronic exchange for a while until those systems are ready. After all, you have to give a reasonable amount of time to get something that complex done.“

Privacy First comment: or generic consent with the current LSP! When asked, why doesn't the minister just admit this? Why does Schippers flee into semantic juggling of terms? Afraid of the outcome of the court case? Moreover, there is no question at all of "giving specific permission per category"; VZVZ seems to have misinformed the minister about this. Indeed, the GP cannot set this per category at all, but only enter "yes" or "no" in the "opt-in" screen in his/her system.

Update 7 July 2014, good news: generic consent has been removed from the bill by the House of Representatives! In line with our campaign, this leaves specific consent over; this will have to be implemented in all existing and future medical data exchange systems, including the current LSP (former EHR). Despite this initial success, there are still some ifs and buts; read HERE the entire commentary on the weblog of SpecificAuthorisation.co.uk. Next stop: Upper House!

Update 23 July 2014: today, the Utrecht court issued an extremely disappointing, incomprehensible ruling in the case of VP Huisartsen vs VZVZ; click HERE. On the point of contention specific vs generic consent, the court considers the current consent to be specific, referring only to superficial PR material (brochure) from VZVZ (see judgment, rulings 5.15-5.16). Privacy First hopes VP GPs will appeal and looks forward with confidence to the verdict of higher, better-informed judges.