Mitz: JurassicTech and the PBM as a solution
This week, the Civil Rights Platform and KDVP Foundation launched a campaign against the patient portal Mitz.
Mitz is a Centralosaurus with serious privacy risks, but we can redeem ourselves from this. That does require some action from the House of Representatives.
Centralosaurus Mitz
Mitz contains meta-data about your medical care, including a list (index) of the locations of all your medical records and your 'consent choices' for accessing those records, if you have signed up.
Like the 2011 national SPD, Mitz is a central system, with the underlying aim of 'one solution, for everything and everyone'. Once again, a (decentralised) alternative is not on the agenda. If you don't sign up for Mitz, you may go out with paper or CD-ROMs. Via a major diversions, we are back in 2011, with the same risks to privacy, security and professional secrecy.
An example:
A doctor may only have your data if there is a treatment relationship and the first question the doctor will ask Mitz is "do you know this patient?". This therefore informs Mitz of every treatment relationship of every patient in the Netherlands, including those who have not registered with Mitz. Mitz processes medical data, without being a basis for and it is a violation of professional secrecy.
The mine 'mine' that is not yours
Everyone has them: a my.bank, my.insurance, my.pension and my.hospital. All these 'my' environments have one thing in common. They do not belong to 'you' but to the service provider (and the data mostly too). The same goes for my.Mitz.
An alternative model can be compared somewhat to the European 'wallet' and works as follows:
Your data is in your own vault and not (or very limited) with the app provider. An app (like NewMitz, for example) helps you do the tasks you want to do, but the provider of that app does not have access to your data. Compare it to Excel with which you edit a local file. You then decide whether, and with whom, you want to share that data from that file.
PBM
Here lies a wonderful opportunity for the 'Personal Health Environment (PBL)' for which the Ministry of Health has now launched a European tender.
In recent years, most PBMs have still developed as a classical my.pgo (that does not belong to 'you'). As a citizen, you have a choice between PBM-A, PBM-B, or PBM-Etc and you are chained to the specific functionality provided by that PBM. Even if you can transfer the data, you are in another my.pgo with the same problem.
Get rid of the 'system'
Privacy First Foundation, together with Schluss in talks with the Ministry of Health hoping to change this. A PBM can no longer be a 'system' are. You want to have your data in your own vault and then be able to use different applications, from different vendors. So a kind of 'app-store' model.
Your 'personal health environment' is then the combination of your own data vault and all the applications you use.
Moreover, this is a huge incentive for innovation. A supplier can deliver an application without taking cognisance of your data (and thus without its own privacy policy!). Any entrepreneur can develop an initial application from their attic room, within the frameworks created by Medmij Foundation.
Back to Mitz
The biggest risk remains the idea of using 'one system for everything and everyone', while that is completely unnecessary. For citizens who do need it can Mitz be a crucial solution, but the 'consent choices' and locations of your medical data belong in your own vault. Nowhere else.
The doctor from the example can now work on you asking if you gave 'permission' to access your medical records, and not to the Centralosaurus Mitz.