Privacy of patient data

To provide good medical care, we record your contact details and medical data. We do this in accordance with the Dutch Medical Treatment Contracts Act (WGBO) and the General Data Protection Regulation (AVG/GDPR). This means that we only use your data for providing medical care and the associated administration, and that we protect your data against unauthorised access by third parties.

Retention period

We retain your data for as long as necessary to provide care and as long as the law requires us to retain your data. For medical data, this retention period is in principle 15 years (from the last treatment), unless longer retention is necessary, for example for your own health or that of your children. This is at the discretion of the treating practitioner. After this period, we will delete your data.

Data exchange

We exchange data with other healthcare providers, such as GPs, pharmacies, hospitals, physiotherapists, etc. We do this via secure systems and only when necessary. Our staff and GPs only access your data when this is necessary for the performance of their duties.

Third parties

We only share your data with third parties if this is necessary for providing good care. Where specific consent is required by law, we will request this from you in advance.

The staff of Huisartsenpraktijk Schoterpoort are obliged to handle your personal data confidentially. This means, for example, that the healthcare provider needs your explicit consent to share your personal data. However, there are some exceptions to this rule. The healthcare provider’s duty of confidentiality may be broken on the basis of a legal requirement, but also when there is a serious risk to your health or that of a third party. In addition, recorded data may, where necessary, be exchanged verbally, in writing or digitally with other healthcare providers (for example, the pharmacist processing a prescription and thereby receiving data from the treating doctor).

Medication data and LSP

We ask for your consent before making your medication data available to hospitals and pharmacies via the national LSP (Landelijk Schakelpunt - National Exchange Point).

Huisartsenpraktijk Schoterpoort, after you have given specific consent, securely and reliably exchanges relevant medical data with the GP out-of-hours service (HAP) via the Landelijk Schakelpunt. If you have been to the HAP in the evening or at the weekend, they in turn share a consultation report with the practice. This way, the GP knows exactly what complaints you presented with at the HAP and what action was taken.

Medication data can also be shared with your pharmacy and your treating medical specialists. This concerns medication prescribed to you by the GP, but also any intolerances, contraindications and allergies (ICA data). Other prescribers and dispensers of medication can take this into account. In this way, we as a general practice contribute to medication safety.

Connection of records with the emergency post: this is done via a secure connection; patients are asked for consent regarding the LSP by means of a form, which is subsequently destroyed.

Transfer of your records

If you choose a new doctor/healthcare provider, it is important that your new doctor/healthcare provider is aware of your medical history. Your medical history is contained in your patient records. It is customary for your former doctor/healthcare provider to transfer the records to your new doctor/healthcare provider. The former doctor/healthcare provider does this as soon as possible, in any case within one month, after you have asked your former doctor/healthcare provider to transfer the records to your new doctor/healthcare provider.

Your medical records are sent digitally to the new doctor/healthcare provider via Zorgmail File Transfer. This application enables medical information to be exchanged securely. You cannot receive the original records. However, you always have the right to view your records and to a copy of your records, for example if you move abroad.

Security

Huisartsenpraktijk Schoterpoort has taken the following measures and made working agreements to ensure that patient data is handled carefully:

All staff who process or otherwise have access to patient data are bound by confidentiality.
Patient data is not retained longer than necessary; medical data is in principle retained for fifteen years, or as much longer as is reasonably necessary to provide responsible care. Medical records of deceased patients are retained for a further fifteen years after the last modification in the records.
The spaces in which data is stored are not freely accessible.
Patients are informed upon registration at the practice about the procedure for transferring the medical records from the previous GP; in most cases, the records are sent digitally.
There is a large waste bin for privacy-sensitive material; the contents are securely destroyed.
There is a paper shredder for small privacy-sensitive material.
There are storage compartments for urgent matters per GP and per assistant, so that no data remains on desks in the evening; this cabinet is locked in the evening.
IT is managed through IT supplier MEOS; this company does not have access to patient records. Business documents are stored on SharePoint via Office 365, secured with two-factor authentication.
All digital passwords of all staff in the Microsoft 365 SharePoint work environment, including two-step verification, are regularly changed and at least annually; MEOS IT is responsible for this.
MEOS IT provides adequate antivirus protection.
The majority of patient correspondence is sent via the secure communication system with specialists via Zorgdomein or via ZIVVER-secured email.
Patient medical records are stored remotely via our GP information system Health Connected.
Health Connected backups are separate from the production environment and cannot be affected by ransomware. Backups are retained for 3 weeks.
HC uses ESET antivirus software.
HC is ISO 27001:2022 and NEN 7510:2017 certified.
HC conducts an annual PEN test (a simulated hacking attempt) - this is mandatory for certification.
Development of new NEN standards (the generic standards and now also the renewal of NEN 7510) also takes place here.
Regarding the human factor, HC has awareness modules and staff are screened with a VOG (Certificate of Good Conduct) (not only upon joining).
- NB: HC certificates, statement of applicability and privacy and information security policy are available online: https://www.healthconnected.nl/over-ons/informatiebeveiliging/
Communication with the emergency post: transfer of palliative or other care patients is done via Zorgdomein.
Since 2016, referrals and laboratory and function tests have been requested via the secure application Zorgdomein. In a minority of cases, the referral letter will still be given to the patient, sent by post or securely emailed via ZIVVER.
Specialist letters and primary care messages are received via Edifact in the care records, and a smaller portion is received by post. Consultation reports from the HAP are received via the care records.
Since January 2025, you as a patient have the option to view data from your specialist at Spaarne Gasthuis via MITZ (lab results, X-rays, medication, medical history, appointments).

Camera footage of the first-floor waiting area is recorded. These images are deleted after 3 weeks.

Data breaches

If, despite our measures, third parties gain unauthorised access to your data, we will report this to you and the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Patient rights

You have the following rights:

The right to know whether and which personal data about you is being processed.
The right to view and obtain a copy of that data (insofar as this does not violate the privacy of another person).
The right to correction, supplementation or deletion of data if necessary.
The right to request (partial) destruction of your medical data. This can only be accommodated if retaining the data is not of significant importance to another person and the data does not need to be retained under a legal requirement.
The right to add a personal statement (of a medical nature) to your records.
The right to object to the processing of your data in certain cases.

If you wish to exercise your rights, you can do so verbally or by means of a request form addressed to Huisartsenpraktijk Schoterpoort. Your interests can also be represented by a representative (such as a written authorised representative, or your curator or mentor).

Requests for access or copies, and requests for supplementation, correction, restricted use or deletion may be refused by the practice insofar as this is necessary to protect a significant interest of another person (including the protection of that person’s personal privacy) and/or where retention is required under a (legal) regulation.

The practice has the option of consulting a Data Protection Officer for complex matters.

Complaints

Do you have a question or complaint? For example, about with whom we share data or our handling of your medical data? Your doctor/healthcare provider is happy to discuss this with you.

If you believe that this regulation is not being followed or is being insufficiently followed by the practice, you can submit a complaint to the practice.

Privacy statement

General

The GDPR (AVG) has been the law for the protection of privacy and personal data since 2018. Under this law, an organisation that works with personal data has certain obligations and the person whose data it concerns has certain rights. In addition to this general law, specific rules apply to privacy in healthcare. These rules are set out, among other places, in the Dutch Medical Treatment Contracts Act (WGBO). This privacy regulation is intended to inform you of your rights and our obligations under the GDPR and the WGBO.

The general practice

Various personal data about you may be processed in our general practice. This is necessary in order to treat you medically and is needed for the financial handling of treatment. In addition, processing may be necessary for, for example, combating a serious risk to your health or for fulfilling a legal obligation (for example, the mandatory reporting of an infectious disease under the Public Health Act).

Purpose and scope of the privacy regulation

The purpose of this regulation is to document the measures taken by Huisartsenpraktijk Schoterpoort to ensure that patient data is handled carefully. This regulation applies to every processing (automated and non-automated) of patient data that is or will be included in a file.

1) Purpose of collecting and processing patient data

a) Patient data is processed in a proper and careful manner, and only for the purposes for which it is or has been collected;

b) Data may be collected during consultations, treatments or otherwise;

c) Purposes are:

use in the context of the care to be provided (in particular treatment, consultation, medication, referral, transfer);
use for monitoring internal quality and practice accreditation;
for (scientific) research, provided it is anonymous;
other purposes, provided these are agreed with the patient in advance.

2) Processing of general patient data, health data, genetic data

a) General patient data is only processed if one of the following conditions is met:

the patient has given consent (verbally or in writing) for the processing;
processing is necessary for the provision of general practice care to the patient;
processing is necessary to comply with a legal obligation;
processing is necessary to combat a serious risk to the patient’s health.

b) Patient health data is only processed if one of the following conditions is met:

processing is carried out by healthcare providers, institutions or facilities in healthcare or social services insofar as this is necessary for the proper treatment or care of the patient;
processing is carried out at the request of the insurer insofar as this is necessary for the assessment of the risk to be insured by the insurance institution, or insofar as this is necessary for the execution of an insurance agreement;

c) Patient genetic data is only processed in relation to the patient concerned, unless:

a compelling medical interest prevails, or
processing is necessary for scientific research and statistics.

3) Patient rights

a) The patient has the right to view all data collected and processed about them;

b) The patient has the right to a copy of the data collected and processed about them; the practice provides a copy free of charge upon the patient’s request;

c) The patient may request supplementation and/or correction of collected and processed data, insofar as it is incomplete and/or factually incorrect;

d) The patient may request deletion or restricted use of collected and processed data;

e) Where the patient cannot represent themselves, the legal representative acts in their place.

Explanation of the request form

You should be aware that medical data is in principle retained for a maximum of fifteen years under the law. You help us in locating your records and protecting your privacy by completing the form as fully as possible. The data you provide will be treated in strict confidence by us. Huisartsenpraktijk Schoterpoort is not liable for errors in postal delivery. If you prefer to collect the records in person, or have an authorised representative collect them, you can indicate this on the form.

Patient data

The Dutch Medical Treatment Contracts Act (WGBO) considers the patient to be of legal age from 16 years. Young people from the age of 16 who wish to view/copy their medical records must submit the request themselves. If the patient is no longer alive, the provision of medical data is permitted if it can be presumed that the deceased would not have objected, or if there are compelling interests to break the healthcare provider’s duty of confidentiality. This decision rests with the healthcare provider.

Publication of privacy regulation

The first privacy regulation of Huisartsenpraktijk Schoterpoort came into effect on 1 January 2010 and is published on the practice’s website. A revision took place in February 2025.

The website also contains details regarding the medical records.