The Dutch Personal Data Protection Authority (AP) has sanctioned, with a fine of 12.000 EUR, a professional dental office. The office has been sanctioned because new patients have registered on a website which was unsafe. This was jeopardizing patients and their sensitive data, like their BSN, which shall fall into wrong hands.

When we register at a professional dental office, we give a mix of personal data under a confidential way. Those data are necessary for the orthodontic practice, but at the same time are so useful for hackers. Take care of patients means also take care of their personal data. This is not true only for big health companies but for each health service provider.

Complaint for privacy breach

The website, which was not protected, of the office was found out after the complaint of someone to AP. Since this case refers a lack of safety in the health sector – for which there are high standards – AP has seen the complaint as a reason to start an investigation.

The web form that new patients were using in order to register them selves includes all the required fields for all the personal data of the patient. And also data of parents, of the general doctor, the dentist and the insurance company.

All the data that were inserted into the form were then sent to the professional dental office by an encrypted connection – so a connection no protected.

Extra protection for children

The majority of patient of a professional dental office are children.

For this reason, data here mentioned refer to children. They a particular vulnerable group when we talk about privacy legislation. For this reason, they have an additional legal law in order to avoid that their data are abused.

Sensitive information

You must be able to assume that your service providers not only treat your data confidentially, but that they also take the security of your data very seriously and organize it properly. Unfortunately, this is not always the case. Violating the confidentiality of this sensitive information can be a significant risk for someone. This can lead to fraud, for example.

The sanction is not yet irrevocable. The professional dental office opposed the sanction imposed. According to the PA the exception is unfounded. An appeal is still pending against this.

SOURCE: AUTORITA’ PER LA PROTEZIONE DEI DATI DEI PAESI BASSI – AP