Digitising a medical practice in Belgium: where do you start?
With the IT, before the medical software. First take stock of the computers, the network and the internet connection, set up the official access (electronic identity card, each practitioner's eHealth certificate) and put in place a backup of patient data that you have already tried to restore. Choosing the medical software and training the team come next: built on a sound base, they then rest on a sound base.
The six steps, in order
Most guides start with choosing the medical software. In practice, it is often the last piece of the puzzle: the software runs on your computers, goes through your network, talks to eHealth with the practitioner's certificate and stores data that must be kept for decades. If one of these foundations is missing, it is the software that ‘doesn't work’, when the problem lies elsewhere.
| Step | What you do | Why it comes first |
|---|---|---|
| 1. Inventory | List the computers, the network, the internet connection | The medical software has minimum requirements |
| 2. Official access | eID card readers, each practitioner's eHealth certificate | Without them, no electronic prescriptions |
| 3. Patient data | Automatic backup, a copy outside the practice, a restore test | The patient record is kept for at least 30 years |
| 4. Security and GDPR | One account per person, a confirmation code, limited rights | The practice is accountable for its patients' data |
| 5. Medical software | Installation, rights, updates, link with eHealth | It relies on everything above |
| 6. Training | Each person, on their own computer, with their own access | A tool people don't understand gets worked around |
Step 1: what should you check before digitising?
Before buying anything, take stock of what already exists. For a small practice it is quick, and it avoids bad surprises on installation day.
- The computers: how many, how old, running which version of Windows or macOS. A computer that no longer receives security updates should not have access to patient records.
- The network: which computers are connected by cable, which by Wi-Fi, and which medical devices (X-ray, ultrasound, printer, scanner) need to talk to the computers.
- The internet connection: online software, electronic prescriptions and exchanges with eHealth depend on it. An outage stops part of the practice.
- The accounts: who uses which computer, with which account, and who knows which passwords.
Do you need a server at the practice, or can everything be in the cloud?
It mainly depends on the medical software and on imaging. If your patient record system is online software, it does not need a server at the practice. If you work with heavy images (radiology, 3D imaging), a server or a dedicated computer on site is often still needed: sending those files over the internet at every consultation would be too slow. In the dental practices with 3D imaging that we look after, we keep a server on site.
Either way, one thing does not change: there must be a copy of the data outside the practice. Online software does not exempt you from checking what the vendor backs up, and for how long.
Step 2: eID and eHealth certificate, which access should you prepare?
Two pieces of official access shape daily work. Set them up before the medical software arrives, not on the day the first patient is waiting.
- The eID card reader on every computer that needs one (reception, consulting rooms), with the official software that lets the computer read the card. That software gets updates: a reader that worked can stop responding after a Windows update.
- The eHealth certificate of each practitioner. According to INAMI-RIZIV, it is valid for 3 years; you request and renew it in the eHealth Certificate Manager application, signing in with your identity card and PIN.
- The expiry dates, written down somewhere someone will see them. eHealth's general terms ask you to renew in good time: a certificate cannot be extended.
For the procedures themselves, the reference remains the eHealth platform website and the INAMI-RIZIV website, which also explains the obligation to prescribe medicines electronically.
What should you do if the eHealth certificate stops working?
Among our clients, it comes up regularly: since June 2021, 110 support requests concerned eHealth, across 20 different clients, 53 of them about a certificate. The causes are similar. Before calling, check in this order:
- The certificate's expiry date. An expired certificate is renewed in the eHealth Certificate Manager.
- Whether the identity card is read. If the computer no longer sees the card, the problem often lies with the reader or its software, not the certificate.
- The computer being used. The certificate is stored on the computer where it was installed. On a new computer, you need to bring it over from the old one or request a new one.
- The certificate password, especially if it has just been changed.
If all of this is in order and the medical software still refuses to connect, it is time to contact its vendor or your IT provider: each sees part of the problem.
Step 3: how should you back up patient data?
In Belgium, the law of 22 April 2019 on the quality of healthcare practice requires the patient record to be kept for at least 30 years and at most 50 years after the last contact. The GDPR, for its part, requires you to be able to restore access to data after an incident, and to test the measures taken regularly.
In practice, a good backup for a practice answers yes to three questions:
- Is it automatic, without anyone having to remember to plug in a drive?
- Is there a copy outside the practice, safe from theft, fire or a virus that encrypts the whole network?
- Have you already tried to restore a record from this backup?
What happens the day the server fails, and what the backup can recover, is covered in our article server failure: can the backup recover everything?.
Step 4: security and GDPR, who is responsible for patient data?
The practice or practitioner who decides how the data is used is the data controller under the GDPR. Health data is a special category there, protected more strictly. Your IT provider, the medical software vendor or the backup host act on your behalf: they are processors, and a contract must set out what they do with the data.
A data breach must in principle be reported to the Data Protection Authority within 72 hours. The Belgian DPA publishes its recommendations for professionals on its website: that is the source to consult for your specific situation. On the IT side, three settings matter from day one: a personal account for each person, a confirmation code on top of the password for email and remote access, and rights limited to what each person needs.
Step 5: the medical software, what IT needs to check
We do not recommend any medical software: the choice depends on your practice, and it is yours. However, before signing, a few technical questions avoid weeks of trouble:
- What does it run on? Version of Windows or macOS, memory, online software or installed on a server.
- How does it connect to eHealth and to the eID card reader?
- Who installs updates, and when? An update in the middle of a consultation blocks the practice.
- Who sees what? Reception and practitioners do not have the same rights.
- How do you get your data back if you ever change software?
- Who do you call when something breaks, and how do the vendor and your IT provider work together?
Step 6: training the team
Training on the medical software is the vendor's job. IT's role is to make sure everyone arrives at that training with a working computer, their own account, and an identity card that is read first time. It is also the moment to explain simple habits: lock the screen when leaving the room, don't write your password on a sticky note, report a suspicious message.
A real case: a medical and dental centre in Brussels
In 2023, we equipped a Brussels centre that combines general practice and dentistry: around ten computers and a server. The centre is not named here. This is the order we actually followed, according to our service records:
- February 2023: professional email and a Microsoft 365 account for each person.
- June to August 2023: the medical and dental software installed computer by computer, with one account per user.
- August 2023: the identity card reading software on every computer, and the security cameras moved to a network separate from the computers.
- September 2023: the Wi-Fi reworked to cover the whole centre, and internet access restricted on the reception computers.
- Then, over the following months: a computer that could no longer reach the eHealth services, and the identity card reading tool added to the browser on three computers.
The server backup keeps one copy on site and one copy outside the practice, monitored by our team. In October 2026, the off-site copy moved to DeepIT Cloud Backup, hosted in a data centre in Paris. What we take from it: the requests of the first months were almost never about the medical software itself, but about everything around it (accounts, identity card, network, printers).
What DeepIT does
DeepIT has been the IT provider of medical practices, community health centres and dental practices in Brussels since 2017. We prepare the foundations (computers, network, access, backup, security), work with your medical software vendor, and stay reachable after installation. How we support you is described on our medical IT page.