Most medical records in the care of Dutch family doctors are being copied and stored on servers owned by a commercial software company on a weekly basis without some patients’ knowledge, the NRC reported.

A large number of doctors are using the services of Canadian-owned software firm Calculus in Leiden which offers a system by which doctors can share patient information with other doctors in the region, for instance about patients with chronic illnesses.

However, several doctors the paper spoke to said every single patient file was being copied by the firm, including those of people without a chronic disease. They also said Calculus was storing too much data in one place, which is against European privacy rules because of a risk of a massive data leak.

In 2018 privacy watchdog AP investigated the storage system at the request of doctors but did not find cause to intervene. The AP told the NRC that the data were encrypted and shared only with other doctors.

While some doctors are refusing to use the system, others feel they have no choice. “I feel bad about sharing data about patients who were never asked if that was ok,” one doctor told the paper.

Family doctors association LHV said the final responsibility for data sharing lies with the doctors and that it had been working to strengthen family doctors’ position with regard to IT providers.

“Family doctors have too little choice and transparency is lacking. It is complex, time-consuming and sometimes very costly to change systems and there is too little clarity about what you will get when you do,” an LHV legal adviser told the NRC.

Calculus, part of a Canadian investment company, said the data is safe and can only be accessed by authorised doctors.