Responding to COVID-19 Across the Pond

The European Union’s response to the COVID-19 pandemic is a mix of disease suppression techniques that includes temporary travel restrictions, shelter-in-place orders, social distancing guidance, and lockdowns of certain economic sectors vulnerable to the viral spread.

The next phase is a more precision-based strategy of widespread and on-demand testing, digital- and human-based contact tracing, and self-quarantines for confirmed and suspected cases of infection.

Complicating these efforts are the challenges of utilizing digital technology that is interoperable among the 27 member states and adheres to the European Union’s (EU’s) strict patient privacy regulations.

To get a better idea of how the EU—and, more specifically, the Netherlands—is grappling with these issues, the Journal of AHIMA spoke with Roger Lim, senior policy advisor at the Dutch Ministry of Health, Welfare and Sport. The Ministry, which Lim joined in January 2019, plays a significant role in finding a balance between privacy and adequately responding to the most significant public health emergency in more than 100 years. This conversation was lightly edited for clarity and length.

JAHIMA: Can you give me an overview of the Netherlands’ response to COVID-19?

Roger Lim: What we are doing is an “intelligent lockdown,” because our economy is not on full lockdown. This fits very well within the culture of the Netherlands, where the central government is calling upon the responsibility of the citizens. This is different from other countries, like France, where there is a very strong central government saying, “You have to do this.”

Now, we are in a process of relaxation. The first set of relaxations came two weeks ago, where primary schools could open again under certain conditions, like enhanced hygiene measures and [social distancing] in the classrooms. On June 1, a new set of relaxation measures will be announced. Bars, terraces, and restaurants can open again, under the condition that within that confined space, a limited number of people could sit there at one-and-a-half-meters distance. Outdoors, there is no limitation to the number of people, as long as everyone maintains one-and-a-half-meters distance. Also, high schools can open again on the first of June.

We gradually lift measures until we get to the new normal, as we call it. We will never be able to go back to the normal situation as we had before the crisis. We have to live as a one-and-a-half-meter society until we have found a vaccination or a proper treatment against COVID-19.

JAHIMA: What are your responsibilities at the Dutch Ministry of Health, Welfare and Sport, and how have they changed since the pandemic started?

Lim: Until recently, my main task was to coordinate the European development of cross-border interoperability, to make sure that health information systems are connected in Europe.

Since the outbreak, the EU has tasked the eHealth Network to come up with a common approach on the use of contact tracing apps. The whole topic of contact tracing apps is very new for all of us. The EU has 27 member states, and each member state wants to develop its own app. The biggest challenge is making sure that these apps are interoperable. So, for example, how can we make sure that when a Dutch citizen crosses the border to Germany or to Belgium that the app is still working, without having to download 27 apps for the whole of Europe?

JAHIMA: What progress has the Netherlands made on an app?

Lim: When the crisis started, the Outbreak Management Team, which consists of epidemiologists and virologists, advised the minister to look into the possibility of using a digital solution for contact tracing purposes.

So, we performed a market scan. We approached the whole matter very technically, looking at what is available already in the market. We came to the conclusion that currently we do not have a solution that is sufficient and that complies with the strict privacy regulations in our country.

We are now working on our own app. We have, for that purpose, created several workstreams. One is the epidemiological workstream that provides inputs to our technical work team. We also have a behavioral team that advises us on how we can make sure that this app is downloaded properly by as many people as possible and is used properly.

JAHIMA: What are the challenges of app development, especially around interoperability and privacy?

Lim: The basic challenge, when it comes to cross-border interoperability, is how to enable connections among the backends of the various systems used by other countries. How can we ensure that data being collected in one backend can also be shared with another backend?

Within Europe, there’s a split between countries following a decentralized model and others choosing a centralized model.* The biggest challenge will be to connect these two different models and make sure Europe is interoperable. When it comes to privacy, the European Commission has set up a working group of legal experts from all member states to discuss any legal barriers when it comes to cross-border interoperability.

JAHIMA: In the United States, we’ve waived certain provisions of our HIPAA privacy law to help stand up and scale widespread telehealth initiatives. Have you had to waive or modify any of your existing healthcare privacy regulations—either within the EU or in the Netherlands—to accommodate the COVID-19 response?

Lim: Not yet. Everything that we’re doing is within the European regulations of the GDPR, the General Data Protection Regulation. And the Netherlands has, on top of that, some additional strict measures. We’re not changing laws at the moment, but we are investigating what impact privacy has on the COVID-19 response.

JAHIMA: Can you describe specific privacy considerations that are being built into your app?

Lim: We’re building this app with the notion of data minimization, meaning that the app should never collect more data than necessary for contact tracing purposes. In principle, that means that the app only collects ephemeral keys that are being generated by a specific device, which cannot be traced back to a specific individual. We have such strict laws on privacy. We have also decided to do a decentralized model. In a decentralized model, the app is designed to prevent any central authority from identifying users.

JAHIMA: Is the Netherlands’ strategy to make contact tracing almost or primarily digital rather than to use people?

Lim: No. Contact tracing apps are only in addition to manual contact tracing. We are investing more in resources when it comes to manual tracing, hiring more people. We’d like to implement as soon as possible because contact tracing apps and increasing the capacity of manual tracing capabilities need to go hand in hand.

JAHIMA: Have you determined how many contact tracers you would need to cover your country?

Lim: We need thousands of extra contact tracers to cover the whole country. Our country has around 17.5 million people. This is organized per region, because the virus is not spread equally within the country. Most cases are in the southern provinces of the country. What I foresee is increasing contact tracing capacities of the local healthcare services in the south.

JAHIMA: Contact tracing is most effective when you have widespread testing and a public willing to comply with self-quarantine measures as needed. Can you tell me a little bit about your concurrent efforts to scale up testing and your strategy of communicating with citizens about submitting to compliance measures that would normally be seen as intrusive?

Lim: The government has announced publicly that they will increase their testing capacity as of the first of June. Until then, only the high-risk professions are entitled *to get a test. But we are now increasing capacity so that we can test the whole population as of the first of June. So come the first of June, everyone can request a test the moment anyone reports the slightest symptoms of a flu or a cold. They can call the services and they can go to a drive-by or a drive-in testing facility, and they get tested. And within eight hours, they get their results.

* Editor’s Note: Lim is referring to a debate among the 27 member states of the EU between centralized or decentralized architecture for Bluetooth-enabled disease surveillance apps. A centralized approach would store and process anonymized data on a server controlled by a national or central authority, like a healthcare service. A decentralized architecture stores data locally on a device and is only uploaded with the express consent of the user.

Matt Schlossberg (matt.schlossberg@ahima.org) is editor of the Journal of AHIMA.