In 2021, the healthcare regulator NZa did not play open cards with the privacy watchdog Authority for Personal Data, when it was asked for advice on the lawfulness of collecting sensitive information from mental health patients. That is the conclusion of the investigative journalism program Argos tonight in its TV broadcast.
Correspondence between the care and privacy regulators, in the hands of Argos, shows that the NZa did not initially explicitly state that there was a plan to collect very intimate information from all mental health patients in the Netherlands. This includes data on addictions, sexual problems, self-mutilation and suicidal thoughts.
The NZa needs this data for an algorithm to predict the demand for care. In this way, the persistent waiting lists could be eliminated and the most vulnerable people would be given priority.
But nowhere is it clearly stated to the Dutch Data Protection Authority that this is an experiment in which data is collected on a large scale. The emails also show that the privacy watchdog did not really know what the advice was being asked for.
No alarm bells
Nevertheless, employees of the Dutch Data Protection Authority do ask several times whether the plans for data collection of the NZa “require attention specifically from a data protection point of view”. According to Argos, the NZa fails to report in its responses to those questions that it concerns sensitive data of approximately 800,000 mental health care patients.
In an appendix to the plans, page 86 contains the professional medical title HoNOS, which refers to questionnaires containing privacy-sensitive information. The term does not set off alarm bells with the Dutch Data Protection Authority.
The privacy watchdog could therefore have found out through research in the appendices that the NZa intended to collect the sensitive data. But they mainly based themselves on the summary that the NZa had sent. It also did not state that special information would be collected.
The NZa therefore did not receive a negative advice at the time and continued with the plans to collect patient data.
Protest
In 2022, mental health advocacy groups will begin protesting the proposed plan. That has an effect because in October of that year the Dutch Data Protection Authority still ruled negatively. The core of the criticism: the NZa has not made it sufficiently clear how and for what purpose the data should be used.
The NZa responds with an extensive letter emphasizing, among other things, that the data are essential to get a grip on the completely stalled mental health care system. Due to the long waiting lists, people in dire need do not receive the care they need. The purpose of the data is to teach an algorithm to accurately predict who needs which care. A first step to get rid of the waiting lists, according to the NZa.
It convinces. An adjusted positive advice will follow after all: the NZa may collect the data for one year. After that, permission must be requested every year.
Since 1 July, mental health care providers are obliged to provide their patient data. If they fail to do so, an order subject to periodic penalty payments is imminent.
Bottom procedure against plan
A coalition of psychiatrists, psychologists and patients have united in the action group Confidence in the GGZ. In September they will take the NZa to court. The goal is to stop data collection.
The Dutch Data Protection Authority does not want to respond – as long as the case is before the courts. The NZa does not want to comment for the same reason.
More at Argos tonight at 21.06 on NPO 2.
- Psychiatrists accuse regulator of ‘untargeted surveillance’ of patients
- Criticism of mandatory provision of information mental health patient to supervisor
