Many people wonder why a doctor chat asks for online banking credentials or a mobile certificate (Mobiilivarmenne) when almost everything else works with an email and a password. The short answer: because this is your health data, and the doctor must know for certain who they are treating. Here is the longer answer about what happens when you sign in, what Treat learns and what Treat never receives.
We are building this sign-in flow ahead of our first pilots. This post explains the identification design and what it will mean for patients using Treat.
Why email and password are not enough
Health data is especially sensitive under the law. When a doctor writes a prescription or a sick leave certificate and makes an entry in Kanta, Finland's national health data archive, the entry must belong to the right person. That is why Finnish authorities require strong electronic identification for access to health services, at an assurance level at least equal to the Finnish Trust Network's substantial level. Treat requires that level from every patient.
A password does not reach that level, because a password can be guessed, phished or leaked. Bank credentials and the mobile certificate are identification tools backed by an identity check that your bank or mobile operator has already carried out.
What happens when you sign in
- Your browser is directed to Idura, a Nordic identity broker.
- You choose an identification method, for example your own bank or the mobile certificate.
- The bank or operator verifies your identity in its own way: with a PIN, a fingerprint or a confirmation code.
- Idura returns a signed OpenID Connect token to Treat.
- Treat stores only what it needs from the token.
The whole identification happens between your bank or operator and Idura. Treat is not present when you enter your credentials.
Signed is the important word here. Treat checks the signature on every token and accepts it only if Idura issued it and it has not been altered on the way. The persistent identifier is created by Idura and stays the same from one sign-in to the next; Treat uses it to connect a new sign-in to your existing account.
What Treat receives and what it never receives
Treat receives three things from the identification:
- your name
- your personal identity code (or the equivalent Nordic identifier)
- a persistent identifier that recognises you as the same person the next time you sign in
Treat never receives your bank credentials, your PIN or your biometric data. They do not pass through Treat and cannot leak from Treat, because they are not here. The identification event's data sits with Idura only temporarily, and we do not keep it beyond the sign-in either. What is stored permanently is only the data listed above, on your Treat account.
Why Idura rather than a direct bank connection
Idura ApS is a Danish identity broker that relays the Nordic identification methods through a single interface: in Finland bank credentials and the mobile certificate, in Sweden BankID and Freja ID, in Norway BankID and Vipps, in Denmark MitID. We do not have to build and maintain a separate connection to every bank, which reduces the room for error.
Idura is a processor under our privacy policy, bound by a data processing agreement. It commits to keeping identification traffic and the related personal data within the EU. The banks and operators, for their part, are independent controllers and publish their own privacy policies.
Idura also publishes its own list of subprocessors. As of the date of our privacy policy, it lists Microsoft Azure (Ireland and the Netherlands) and AWS (Germany) as hosting providers for the identification traffic, and HubSpot as Idura's internal customer system, which does not receive Treat's identification data. All of them are in the EU.
Passkeys: a faster way back in
Treat also supports passkey sign-in. A passkey is a key pair created by your device, for example your phone. Depending on the provider, the private key either stays on a single device or is securely synchronised between your devices, and the sign-in is confirmed with the device's own lock: fingerprint, face or PIN. There is no password to phish, and the key does not work on any site other than the one it was created for.
Where passwords are used at Treat at all, they are not stored as such but as an Argon2 hash, which cannot be turned back into the password.
What this means for you
You sign in with the same credentials you use for your bank or the Tax Administration, and you do not have to remember a new password. The doctor knows who they are talking to and can, when appropriate, send a prescription straight to the Prescription Centre. The visit appears under your name in Omakanta, the citizen's view of Kanta, like any other healthcare visit.
The details of identification are described in section 10 of the privacy policy. If anything puzzles you, ask us.