Healthcare insurers

Healthcare insurers may process health data if this is necessary to execute the agreement they conclude with insured persons (healthcare insurance). And to perform their statutory tasks. For example, healthcare insurers may process health data to process claims.

On this page

  1. General information

Healthcare providers, such as hospitals and family doctors, are legally obliged to transfer certain data to healthcare insurers. The healthcare insurer uses that data to check whether the care is reimbursed or not. Professional secrecy does not apply here.

According to the General Data Protection Regulation (GDPR), a legal obligation is a basis for processing personal data. In this case, this means that healthcare providers may transfer patient data to healthcare insurers in accordance with the GDPR privacy law.

The minister determines:

  • which health data healthcare providers must transfer to healthcare insurers;
  • for what purposes they should do this.

The rules can be found in the ministerial regulations under the Health Insurance Act, the Long-term Care Act and the Healthcare (Market Regulation) Act.

Read more at: Transferring health data to healthcare insurers.

Duty to accept

Healthcare insurers are obliged to accept people for basic healthcare insurance. It doesn’t matter how healthy someone is. A healthcare insurer may therefore not use data about someone’s health to refuse that person for basic healthcare insurance.

Quick answers

What medical data will I see when I pay for my child’s healthcare insurance?

Your minor child is automatically covered under your basic healthcare insurance. In principle, as a policyholder you are entitled to information about the care that is being claimed. This also includes the claimed care provided to your child. This allows you to check whether your child has indeed received that care, for example.

Minor children do have the right to have their privacy protected. They can ask a healthcare insurer to describe the care provided as generally as possible.

Can an optician or hearing aid shop request data about my healthcare insurance policy to see whether the healthcare insurer will (partly) reimburse my glasses or hearing aid?

Are you buying glasses or a hearing aid? The sales assistant may, with your consent, request information about your healthcare insurance. You may be able to get (partially) reimbursed for your glasses or hearing aid through your healthcare insurance.

The sales assistant at the optician or hearing aid shop can look up information about your insurance policy in a special database (Insured Check, COV) at VECOZO. Your healthcare insurer has included information about your insurance in that database.

Your healthcare insurer and the optician or hearing aid shop may also exchange your data via VECOZO in order to process claims properly.

Can my healthcare providers use VECOZO to exchange my data with my healthcare insurer, care administration office or municipality?

Yes, that is permitted. Your healthcare insurer, care administration office and/or municipality can exchange messages with your healthcare providers via the VECOZO digital environment. For example, to allocate care or process claims for your medical care.

Can my healthcare insurer ask for a referral letter from my family doctor if I have submitted a privacy statement?

If you have submitted a privacy statement to your healthcare insurer with your claim of your mental healthcare treatment, your healthcare insurer may not ask you or your practitioner for the referral letter from your family doctor.

The referral letter contains information about your care demand and level of care. Your healthcare insurer is not allowed to ask you about this if you have submitted a privacy statement.

Instead, your healthcare insurer may ask for a shortened referral letter. The shortened referral letter does not contain information about your care demand and level of care.

Can my healthcare insurer request health data for an authorisation?

You require prior consent from your healthcare insurer for the reimbursement of certain medical treatments. This consent is called an authorisation or statement of approval. Your healthcare insurer may request health data from your practitioner for this purpose, if you give your consent for this.

Your practitioner may only transfer data that is necessary to assess whether you are eligible for reimbursement.

If you have submitted a privacy statement to your healthcare insurer, your healthcare insurer may not ask for diagnostic information to assess your authorisation application (paragraph 4.3 of the Healthcare Insurance Regulations).

To whom can I turn if I have a question or complaint about the processing of personal data by my healthcare insurer?

If you have a question or a complaint about the processing of your health data by your healthcare insurer – for example, when claiming the care you have received – you can contact the Data Protection Officer (DPO) of your healthcareinsurer.

If you and the healthcare insurer are unable to find a solution, you can submit a complaint to the SKGZ (Health Insurance Complaints and Disputes Board) about the processing of your personal data by your healthcare insurer. You can also notify the NZa (Dutch Healthcare Authority).