Anyone who shares personal information with a doctor, nurse, lawyer, civil-law notary, psychologist or other confidant must be able to count on that information remaining confidential. That trust is the core of professional secrecy. Without professional secrecy, people would be less likely to seek medical help, ask for legal advice or speak openly about sensitive problems. That is precisely why professional secrecy is protected by law. Even so, things sometimes go wrong in practice. For example: a doctor discusses medical data with a family member without permission, or a healthcare provider emails a file to the wrong address. In such situations there may be a breach of professional secrecy. A breach of professional secrecy can have various consequences. The professional can be held to account under disciplinary law, criminal law or civil law. To obtain compensation, however, more is needed than simply establishing that professional secrecy has been breached. There must also be damage, attributability and a link between the breach and the damage. This page describes the situation in the Netherlands.
Features of statutory professional secrecy
Professional secrecy means that a professional must keep silent about confidential information that he learns through his profession. In healthcare, people often speak of medical professional secrecy or the medical duty of confidentiality (zwijgplicht). With lawyers and civil-law notaries, people also speak of the duty of confidentiality, official secrecy (ambtsgeheim) or simply confidentiality.
Professional secrecy primarily protects the person who shares information. A patient must, for example, be able to discuss medical complaints, addiction, mental health problems or family problems without having to fear that this information will end up with third parties. But professional secrecy also protects a general public interest. People must have access to healthcare, legal assistance and other professions of trust without hesitation.
Professional secrecy is not regulated in the same way for every profession. Sometimes it is laid down directly in the law. Sometimes it follows from a combination of legislation, professional rules and disciplinary law.
| Profession or professional group | Features of professional secrecy | Legal basis |
|---|---|---|
| Doctors, general practitioners and medical specialists | Duty of confidentiality about everything they learn about the patient in their capacity as a doctor. Also applies to data in the medical file and to non-medical information that becomes known in the treatment relationship. | Article 7:457 of the Dutch Civil Code (BW), Article 88 of the Individual Healthcare Professions Act (Wet BIG) and Article 272 of the Dutch Criminal Code (Sr). |
| Dentists, pharmacists, midwives, physiotherapists, nurses, healthcare psychologists, psychotherapists and other BIG-registered healthcare providers | Confidentiality about confidential information they receive in the practice of their profession in individual healthcare or understand to be confidential. | Article 88 Wet BIG, Article 7:457 BW where there is a medical treatment contract, and Article 272 Sr. |
| Healthcare institutions and care providers under the Medical Treatment Contracts Act (WGBO) | The care provider may not give information about the patient or access to the file to others without permission, except in statutory exceptions. Staff within an institution must also handle patient data carefully. | Article 7:457 BW, the Healthcare Quality, Complaints and Disputes Act (Wkkgz), the General Data Protection Regulation (GDPR, in Dutch AVG) and Article 272 Sr. |
| Youth care workers | Confidentiality about data from youth care. Information may only be shared if the law allows it, for example with permission, for direct care or in specific statutory situations. | The Youth Act (Jeugdwet), including Article 7.3.11, and Article 272 Sr. |
| Lawyers | Confidentiality is a core value of the legal profession. A client must be able to speak openly with his lawyer. The lawyer also has a right of non-disclosure (verschoningsrecht), which allows him to refuse to provide information in certain situations. | Articles 10a and 11a of the Counsel Act (Advocatenwet), the rules of conduct for the legal profession and Article 272 Sr. |
| Civil-law notaries | The civil-law notary must keep secret what has been entrusted to him in his role as a notary. Staff working under the notary's responsibility are also bound by this duty of confidentiality. | Article 22 of the Notaries Act (Wet op het notarisambt) and Article 272 Sr. |
| Spiritual care workers and clergy | Confidential information shared in the exercise of the office may fall under official or professional secrecy. The exact scope depends on the role, context and applicable rules. | Including Article 272 Sr. and procedural rules on the right of non-disclosure. |
Towards whom does professional secrecy apply?
In principle, professional secrecy applies towards everyone except the person the information is about. A doctor may therefore not simply share medical data with the partner, children, parents, neighbours, employer, insurer, municipality, police or media. Within a healthcare institution, too, information may not circulate freely. Only those who need the information for their task may receive it.
Professional secrecy also applies towards family members. That sometimes feels harsh, especially when family members are genuinely concerned. Even so, a healthcare provider may not simply say whether someone is a patient, what diagnosis has been made or how the treatment is going. In principle, the patient decides who receives which information.
There are, however, exceptions. Information may, for example, be shared with healthcare providers directly involved in the treatment, insofar as they need that information. A legal representative may also be entitled to information. The patient can also give permission. In addition, there are statutory obligations and exceptional situations in which professional secrecy may, or even must, be breached.
Professional secrecy does not end automatically on death. Confidential information remains protected even after the death of the patient or client. Surviving relatives are therefore not automatically entitled to all information. Access or the provision of information may sometimes be possible, for example if it is plausible that the deceased would have wanted this or if the law provides a basis for it.
Which information is covered by the duty of confidentiality?
The duty of confidentiality does not only apply to diagnoses, treatments, medication or test results. Other information can also fall under professional secrecy. Think of information about relationships, work, family, addiction, debts, mental health complaints, a stay in an institution or the mere fact that someone is a patient or client.
Information that is seen or heard by chance in the practice of the profession can also fall under professional secrecy. A district nurse who visits someone at home may, for example, pick up information about domestic problems, financial worries or family members. Such information may not simply be shared either.
The same applies to information about third parties that becomes known during care. If a patient says something about his partner, child or housemate, that information is in principle also covered by professional secrecy. The confidential context in which the information was shared is therefore more important than the question of whether the information is strictly medical.
Professional secrecy and legal representation
Sometimes the patient or client cannot decide on treatment, support or the provision of information themselves. A legal representative can then act. This has consequences for professional secrecy, because the representative needs certain information to be able to take decisions on behalf of the patient or client.
For minors, the rules depend on age. For children under twelve, the parents or guardian in principle decide on behalf of the child. They receive the information needed to fulfil that role properly. For young people aged twelve to sixteen, the young person and the parents decide together in many medical situations. For sharing information with third parties, the young person's own position plays an important role. From the age of sixteen, the young person in principle decides for themselves about treatment and about sharing medical information.
After a divorce, it matters who has parental authority. If both parents have authority, they both remain legal representatives. If only one parent has authority, that parent takes the decisions. A parent without authority may sometimes be entitled to general information about important facts concerning the child, but does not have a say in the treatment. The healthcare provider must always consider whether giving information is in the child's interest.
For adult patients who lack mental capacity, there is an order of representation. First, it is checked whether there is a guardian (curator) or mentor. After that, a person authorised in writing may come into the picture. If there is no such person, the spouse, registered partner or life partner can be the representative. If that person is also absent, parents, children, brothers or sisters may be eligible. The representative only receives information that is needed for his role. If providing information is incompatible with the standards of a good care provider, the healthcare provider can refuse to share certain information.
Professional secrecy in concrete situations
In practice, professional secrecy is not only about major decisions. It is precisely everyday situations that create risks. A conversation at the reception desk, a phone call, an email or a consultation with other parties can already lead to a breach of professional secrecy.
In telephone consultations, the healthcare provider must check who he is speaking to. Medical information may not be given to someone whose identity or authority is unclear. With fax or email, extra care must be taken that data does not end up with the wrong person. A wrong email address, an unsecured attachment or a general mailbox address can already cause problems. The more sensitive the information, the more important a secure method of sending is.
The patient's privacy must also be protected within a practice, hospital or healthcare institution. Conversations about patients should not take place where others can overhear. Think of the corridor, the waiting room, the reception desk or a shared patient room. Files may not be left open and visible, and screens must be shielded if others can look on.
Social media also pose a risk. A healthcare provider may not share any information, photos, stories or recognisable details from which a patient or client can be identified. This also applies if the name is left out. A combination of details can be enough to make someone recognisable. A post that is meant to be funny, educational or harmless can still amount to a breach of professional secrecy.
Liability for breach of statutory professional secrecy
Breaching statutory professional secrecy can be unlawful. Article 6:162(2) of the Dutch Civil Code (BW) mentions, among other things, an act or omission in breach of a statutory duty as a form of unlawful act (tort). Professional secrecy laid down in law, such as medical professional secrecy or the duty of confidentiality of a lawyer or civil-law notary, can therefore play an important role in assessing liability.
Even so, a breach of a statutory standard does not automatically mean that compensation must always be paid. For civil liability, several requirements must be met together. There must be an unlawful act, attributability, damage, a causal link and relativity. There may also be a ground of justification, for example when professional secrecy has been lawfully breached.
The statutory standard must also be intended to protect against the damage as claimed by the victim. This is called the relativity requirement. With professional secrecy this will often be the case, because the standard is intended precisely to protect confidentiality, privacy and free access to healthcare or legal assistance. But even then, it still has to be proven that the breach led to concrete damage.
There has long been debate in legal literature about the role statutory standards play in assessing unlawfulness. According to the theory of Smits, one should not reason too mechanically that every breach of a standard is automatically unlawful towards every victim. The court must also look at the specific circumstances, the purpose of the standard, the interests the standard protects and the duty of care owed to society. For a breach of professional secrecy, this means that the statutory standard carries great weight, but that civil liability must still be assessed carefully.
Lawfully breaching statutory professional secrecy
Professional secrecy is important, but not absolute. There are situations in which a professional may, or even must, share confidential information. In that case there is no unlawful breach of professional secrecy, provided the professional acts carefully and goes no further than necessary.
Important exceptions are:
- Permission from the patient, client or rightful claimant;
- Providing information to healthcare providers directly involved, insofar as necessary for the treatment or support;
- Providing information to a legal representative, insofar as needed for his role;
- A statutory duty to provide information;
- A conflict of duties;
- A compelling interest in special cases;
- Providing information that is necessary in formal legal proceedings, within the limits of the law.
Permission is the best-known exception. If the patient or client clearly gives permission, information may be shared within the limits of that permission. That permission must, however, be sufficiently specific. It matters which information is shared, with whom and for what purpose.
A statutory duty can also lead to secrecy being breached. Think of notifications of certain infectious diseases, serious incidents in healthcare or situations in which a law requires information to be given to a supervisory body or agency. In such a case, the statutory duty to report outweighs the duty of confidentiality, but even then no more information may be shared than necessary.
A conflict of duties is more complicated. The professional then faces a choice between keeping silent and preventing serious harm. Think of a patient who makes a concrete and serious threat, or situations in which child abuse or domestic violence is suspected. The professional must then carefully weigh up whether breaching secrecy is necessary. This involves looking at, among other things, whether serious harm is imminent, whether there is no less drastic solution and whether sharing information can prevent or limit the harm. Professional groups often have guidelines or guidance for such dilemmas. For doctors, for example, the Royal Dutch Medical Association (KNMG) has a lot of information about professional secrecy and dilemmas relating to child abuse, threatening patients, fraud and possible terrorist threats, among other things. Such guidelines do not replace the law, but they do help in making and recording a careful assessment.
Medical liability for breach of professional secrecy
Medical liability is often associated with a wrong diagnosis, missed treatment or surgical error. But a doctor, nurse, psychologist, hospital or other healthcare provider can also be held liable for breach of professional secrecy. This is then not about the medical treatment itself, but about careless handling of confidential information.
Examples are:
- Sharing medical data with family without permission;
- Providing information to an employer, municipality or insurer without a legal basis;
- Emailing a file to the wrong person;
- Having a conversation about a patient where others can overhear;
- Sharing medical information within a partnership without necessity;
- Sharing information with a legal professional (jurist) or insurer without permission;
- Posting recognisable information about a patient on social media;
- Informing an ex-partner when there is no permission to do so.
To obtain compensation, the patient must show that professional secrecy has been breached and that he has suffered damage as a result. Merely establishing that the mistake was made is not always enough. The damage must be substantiated in sufficiently concrete terms. Think of mental health complaints, damage to honour or reputation, loss of income, costs of legal help or other adverse consequences.
Non-material damage may in some cases qualify for compensation. For example, when the breach is serious, privacy has been deeply affected or the person concerned has developed mental health complaints. But a mere assertion that someone feels hurt, angry or emotionally damaged will not always suffice.
A causal link is also important. The damage must be the result of the breach of professional secrecy. If, for example, medical information has wrongly been shared with a third party, it must become clear which damage arose precisely as a result. That can be difficult when tensions, complaints or other causes already existed.
With healthcare institutions, the healthcare organisation itself can also be liable. A hospital, clinic, mental healthcare institution (ggz-instelling) or GP practice must ensure good work processes, secure communication, clear authorisations and sufficient instructions to staff. If an employee breaches professional secrecy in the course of his work, the institution may, under certain circumstances, also be liable.
Complaint about a breach of professional secrecy
Anyone who thinks professional secrecy has been breached can take various steps. Which route is most suitable depends on the goal. Sometimes a person mainly wants an explanation or an apology. Sometimes it is about stopping further disclosure. In other cases, someone wants a disciplinary assessment, a privacy complaint or compensation.
- Ask for an explanation
A first step is often to ask the professional or organisation for an explanation in writing. Ask which information was shared, with whom, when, why and on the basis of which permission or legal basis. Also ask whether the organisation is taking measures to prevent further disclosure and whether the incident will be recorded in the file.
- Consult the complaints procedure
If it concerns a healthcare provider, a complaint can be submitted under the healthcare provider's complaints procedure. Under the Wkkgz, a healthcare provider must have a complaints procedure and a complaints officer must be available. If the complaint is not resolved, the patient can often go to a recognised disputes body. In some cases, a disputes body can also award compensation.
- Submit a disciplinary complaint
For BIG-registered healthcare providers, a disciplinary complaint can also be submitted to the Regional Disciplinary Tribunal for Healthcare (Regionaal Tuchtcollege voor de Gezondheidszorg). For a lawyer, the complaint usually goes through the dean of the local Bar (deken) and the disciplinary route within the legal profession. For a civil-law notary, a complaint can be submitted to the Chamber for Notaries (Kamer voor het notariaat).
- Look at other complaint options
In addition, a privacy complaint to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) may be appropriate when personal data has been unlawfully processed or leaked. In serious or intentional breaches, criminal law can also play a role, because intentional breach of professional secrecy can be a criminal offence. Anyone who wants compensation will have to hold the liable party or its insurer to account under civil law.
Frequently asked questions about liability for breach of professional secrecy
A breach of professional secrecy often raises many questions. May a doctor tell family something? May a healthcare provider share information with another care provider? When is permission needed? And can you get compensation if confidential information has wrongly been shared? Below we answer the most important questions about liability for breaching professional secrecy.
What is professional secrecy?
Professional secrecy is the duty of a professional to keep silent about confidential information that he learns through his profession. In healthcare, this concerns, for example, medical data, diagnoses, treatments and the patient's personal circumstances. Confidentiality also plays an important role for lawyers, civil-law notaries and other professions of trust.
How far does professional secrecy go?
Professional secrecy goes a long way. It applies not only to diagnoses, treatments and files, but also to other confidential information that a professional learns through his profession. Think of family problems, addiction, mental health complaints, debts, problems at work or even the fact that someone is a patient or client.
Why is professional secrecy important?
Professional secrecy protects the trust between client or patient and professional. People must be able to speak freely with a doctor, psychologist, lawyer or other confidant without fear that their information will simply be shared. Without professional secrecy, people would be quicker to avoid care or advice, which is undesirable for society.
What is the duty of confidentiality (zwijgplicht)?
The duty of confidentiality is the duty to keep confidential information secret. In healthcare, this usually means the same as professional secrecy. A healthcare provider may therefore not give information about a patient or client to others without a valid reason.
When may a psychologist breach professional secrecy?
A psychologist may only breach professional secrecy in exceptional situations. This may be possible, for example, with the client's permission, when there is a statutory obligation or when there is a conflict of duties. In such a conflict, breaching secrecy may be appropriate if keeping silent poses a serious danger to the client or someone else and there is no less drastic solution.
Who has professional secrecy?
Professional secrecy applies to various professions of trust. In healthcare, these include doctors, nurses, psychologists, psychotherapists, dentists, pharmacists, physiotherapists and other healthcare providers. Lawyers, civil-law notaries, spiritual care workers and some other care workers also have a duty of confidentiality.
Is professional secrecy the same as the duty of confidentiality?
In everyday language, professional secrecy (beroepsgeheim) and the duty of confidentiality (zwijgplicht) are often used interchangeably. The duty of confidentiality mainly emphasises that the professional must keep silent about confidential information. Professional secrecy is the broader term.
When does professional secrecy end?
In principle, professional secrecy does not simply end. It continues to apply after the end of the treatment, after the end of the engagement and even after the death of the patient or client. However, professional secrecy can be lawfully breached in certain situations, for example with permission, on the basis of a statutory duty or in a conflict of duties.
How far does a psychologist's professional secrecy go?
A psychologist's professional secrecy applies to everything the psychologist learns about the client in his professional role. This concerns not only diagnoses, test results and treatment reports, but also personal stories, family problems, problems at work, traumatic experiences and other confidential information. The psychologist may not simply share that information with parents, a partner, an employer, a school or other third parties.
What is derived professional secrecy?
Derived professional secrecy means that someone who receives confidential information through a person bound by professional secrecy must also keep that information secret. Think of an assistant, administrative employee, interpreter, legal professional, medical adviser or other support worker who gets access to confidential data. This person did not receive the information directly from the patient or client, but must handle it just as carefully.
May a doctor share information with family?
Not just like that. A doctor may only share medical information with family if the patient gives permission for this or if a statutory exception applies. For minors or patients who lack mental capacity, a legal representative may be entitled to information. Even then, no more information may be shared than necessary.
May a healthcare provider share information with other healthcare providers?
Yes, but only if those other healthcare providers are directly involved in the treatment or support and need the information for their task. Within a treatment team, necessary information may therefore be shared. Information that is not relevant to the care may not simply be passed on.
May medical information be sent by email?
This is only possible if it is done carefully and with sufficient security. The healthcare provider must check whether the correct address is used, whether the recipient is authorised and whether the transmission is appropriately secured.
Does professional secrecy also apply after death?
Yes. In principle, professional secrecy continues to exist after the death of the patient or client. Surviving relatives are therefore not automatically entitled to all medical information. In certain cases, providing information may be possible, for example if it is plausible that the deceased would have wanted this or when the law provides a basis for it.
Is breach of professional secrecy a criminal offence?
Intentional breach of professional secrecy can be a criminal offence. In addition, a breach can lead to disciplinary measures, a complaint to a disputes body or civil liability.
May a doctor share my file with the insurer?
Not just like that. Even when someone is held liable, medical professional secrecy continues to apply. In practice, a medical authorisation is often needed before relevant medical data may be shared with the insurer, legal professional or medical adviser.