Confidential medical files and sensitive information about health insurance companies and care providers is not being properly secured by the Dutch health authority NZa, according to a whistleblower.

Arthur Gotlieb compiled a 600-page report listing problems with the organisation’s internet security. But when he reported issues to his superiors, they tried to force him out, the NRC, which has the report, says on Thursday.

Gotlieb committed suicide in January at the age of 50, shortly after submitting his report to NZa bosses.

Leaks

In his document, Gotlieb warns about numerous leaks and problems with the NZa’s IT security. The NZa is the government’s health service regulator.

The NZa did not raise the issues contained in the report with health minister Edith Schippers until Tuesday this week, four days after being questioned directly by NRC reporters.

Schippers has now set up an independent inquiry into potential security breaches.

Gotlieb’s report makes it clear the NZa was involved in ‘structural and major’ security breaches, the paper says. The organisation’s entire personnel, including temporary staff, had access to highly sensitive information, the digital post system and online diaries.

Confidential information

Among the information Gotlieb was able to retrieve were copies of bank cards with pincodes, complete patient files, 150 recordings of meetings, files about medical disputes, 10,000 photographs, over 800 powerpoint presentations and 14,000 legal documents.

The NZa’s internal network also included illegally downloaded films and music plus e-books that were not rights free.

The organisation says it has now taken steps to improve security. ‘Things have not been done well and cannot be excused,’ said IT chief Eitel Homan in the NRC. ‘I deeply regret this.’