MEMORANDUM
To: Conny Helder, Minister of Health, Welfare and Sport
From: Dion Dijkshoorn, Policy Advisor
Date: May 3rd, 2024
RE: Recommendation to Reform Current Administration of Electronic Patient Files Policy
EXECUTIVE SUMMARY
The current administration of electronic patient files policy by Calculus, a commercial
software company, has raised concerns about privacy, centralisation risks, and GP autonomy.
This memo recommends a reform of the current policy, advocating better privacy protection
with the need for explicit patient consent, decentralised storage of medical files to reduce the
risk of commercial exploitation and breaches, and more autonomy for GPs by encouraging
more competition between software systems so that GPs have more choice in which IT
system to use.
BACKGROUND
The recent NRC investigation into Calculus, a healthcare software provider, highlights
concerns about the privacy and autonomy of both patients and GPs when handling electronic
patient files. This investigation shows that Calculus copies and stores entire patient records of
GP practices, regardless of a patient's medical history. This is done without the consent of the
patients, many of whom also do not even know that their personal medical data is being
shared and stored. Although the Data Protection Authority investigated Calculus earlier in
2018 and recommended no further action, but the lack of choice and transparency for GPs
and patients raises questions. The current policy emphasises the need for policy reform to
align the policy values of data protection, patient consent, and GP autonomy.
POLICY ANALYSIS: CONFLICTORY FAILURE
Based on McConnell (2015), the current administration of electronic patient policy fails on
programmatic, process, and political dimensions. Each dimension provides a different lens
through which a policy can be analysed and assessed.
The programmatic dimension examines whether the policy effectively addressed the problem
it was intended to solve. The commercial software programme Calculus is intended to
simplify patient care by making copies of all patient files of a GP for a better and faster
overview of a patient's medical background, but this broad and centralised data collection
may lead to unintended consequences such as privacy violations or breaches. Where the aim
was to simplify administration for GPs has succeeded, it does come with the increased risk of
data breaches and privacy concerns for patients.
The process dimension examines the procedural effectiveness of the implemented policy by
evaluating whether the policymaking process was carried out correctly. GPs often have no
power over which IT processes to use, resulting in low autonomy. The process by which
consent is obtained from patients to store and process their data is also not transparent:
“Many of the patients are unaware that their doctors are sharing the information” (NL Times,
2023). The current policy has failed to engage the GP and patients in the policymaking
process.
1
To: Conny Helder, Minister of Health, Welfare and Sport
From: Dion Dijkshoorn, Policy Advisor
Date: May 3rd, 2024
RE: Recommendation to Reform Current Administration of Electronic Patient Files Policy
EXECUTIVE SUMMARY
The current administration of electronic patient files policy by Calculus, a commercial
software company, has raised concerns about privacy, centralisation risks, and GP autonomy.
This memo recommends a reform of the current policy, advocating better privacy protection
with the need for explicit patient consent, decentralised storage of medical files to reduce the
risk of commercial exploitation and breaches, and more autonomy for GPs by encouraging
more competition between software systems so that GPs have more choice in which IT
system to use.
BACKGROUND
The recent NRC investigation into Calculus, a healthcare software provider, highlights
concerns about the privacy and autonomy of both patients and GPs when handling electronic
patient files. This investigation shows that Calculus copies and stores entire patient records of
GP practices, regardless of a patient's medical history. This is done without the consent of the
patients, many of whom also do not even know that their personal medical data is being
shared and stored. Although the Data Protection Authority investigated Calculus earlier in
2018 and recommended no further action, but the lack of choice and transparency for GPs
and patients raises questions. The current policy emphasises the need for policy reform to
align the policy values of data protection, patient consent, and GP autonomy.
POLICY ANALYSIS: CONFLICTORY FAILURE
Based on McConnell (2015), the current administration of electronic patient policy fails on
programmatic, process, and political dimensions. Each dimension provides a different lens
through which a policy can be analysed and assessed.
The programmatic dimension examines whether the policy effectively addressed the problem
it was intended to solve. The commercial software programme Calculus is intended to
simplify patient care by making copies of all patient files of a GP for a better and faster
overview of a patient's medical background, but this broad and centralised data collection
may lead to unintended consequences such as privacy violations or breaches. Where the aim
was to simplify administration for GPs has succeeded, it does come with the increased risk of
data breaches and privacy concerns for patients.
The process dimension examines the procedural effectiveness of the implemented policy by
evaluating whether the policymaking process was carried out correctly. GPs often have no
power over which IT processes to use, resulting in low autonomy. The process by which
consent is obtained from patients to store and process their data is also not transparent:
“Many of the patients are unaware that their doctors are sharing the information” (NL Times,
2023). The current policy has failed to engage the GP and patients in the policymaking
process.
1
