How to Run an Internal Investigation in Dutch Healthcare (2026): IGJ Reporting, Evidence Preservation, Staff Interviews and Liability

Internal investigations healthcare Netherlands providers must conduct have become one of the most scrutinised areas of hospital governance going into 2026, as the Inspectie Gezondheidszorg en Jeugd (IGJ, the Dutch Health and Youth Care Inspectorate) sharpens its risk-focused enforcement and public and board expectations rise after high-profile incidents. This guide is written for hospital managers, board members, in-house counsel, compliance officers and senior clinicians who must start, run or supervise a lawful internal probe. It walks through when to trigger an investigation, how and when to report to the IGJ, how to preserve evidence and protect patient and staff data, how to conduct staff interviews, and how internal fact-finding interacts with disciplinary, tuchtrecht (professional disciplinary) and criminal processes.

Throughout, the focus is on practical, compliance-first steps grounded in Dutch law, the Wkkgz, the WGBO, the AVG (the Dutch implementation of the General Data Protection Regulation) and relevant case law.

Why a lawful internal investigation matters in 2026

A properly run internal investigation protects three things at once: patient safety, the organisation’s legal position and the fairness owed to the staff involved. In the current environment, where internal investigations healthcare Netherlands boards oversee are increasingly reviewed by the IGJ, a poorly documented or rushed probe can expose a provider to enforcement action, undermine later disciplinary or criminal proceedings, and breach data protection law. A lawful investigation is one that preserves evidence correctly, respects the rights of those interviewed, meets statutory reporting obligations and keeps a clear record of every decision taken and why.

The remainder of this article maps out a defensible process. It is deliberately structured as a playbook, triggers and triage first, then reporting, evidence, interviews, legal interfaces, a consolidated protocol and record-keeping. Where the law imposes a hard duty, that duty is flagged and tied to its primary source. Where the position is unsettled, the safe course is to involve counsel early rather than to guess.

When to start: triggers, triage and immediate steps

The first question in any internal investigation is not “what happened” but “is anyone still at risk”. Patient safety is always the first priority, and immediate protective steps must come before any fact-finding.

Common triggers for an internal investigation

• Serious adverse event (calamiteit). Under the Wkkgz, a calamiteit is broadly an unexpected event during the provision of care that results in the death of, or serious harm to, a patient and relates to the quality of care.
• Escalated complaint. A complaint from a patient, family member or staff member that points to a systemic failing rather than a one-off grievance.
• IGJ signal. A question, notification request or inspection prompt from the IGJ itself.
• Internal whistleblowing or peer concern. A clinician or staff member raising a reasonable suspicion of negligence, abuse or misconduct.
• Criminal red flags. Indications of intentional harm, fraud, falsified records or abuse, which change the entire posture of the response.

Immediate actions. As soon as a trigger is identified, take the following steps before fact-finding begins:

1. Remove or reduce ongoing risk to patients, this may mean temporarily reassigning staff, isolating a device, or changing a protocol.
2. Secure and freeze the relevant records and physical materials so nothing is altered or deleted.
3. Carry out a short triage to classify the matter along three axes: patient safety severity, legal and regulatory risk, and the presence of any criminal red flags.
4. Decide, provisionally, whether an IGJ reporting obligation may be engaged, and set a clock for that decision.

The triage step is where many providers go wrong. Starting interviews or sending emails asking “who was responsible” before the scope and legal risk are understood can prejudice later proceedings and contaminate evidence. In internal investigations healthcare Netherlands teams run under time pressure, a disciplined triage, ideally using a short decision tree, keeps the response proportionate and lawful. Document the triage outcome: it is the first entry in your investigation file and the reference point for every subsequent decision.

IGJ reporting: what to report, when and how

Reporting to the IGJ sits at the centre of internal investigations healthcare Netherlands providers run, and it is the area where under-reporting and over-reporting both carry risk. The duty to report, and to investigate certain incidents, flows principally from the Wet kwaliteit, klachten en geschillen zorg (Wkkgz, the Quality, Complaints and Disputes in Healthcare Act), which obliges care providers to deliver good care and to report defined serious incidents to the Inspectorate.

Distinguishing IGJ reporting, Wkkgz duties and patient notification

These three obligations overlap but are not the same, and conflating them is a common mistake:

• Wkkgz investigation and reporting duty. The Wkkgz requires providers to investigate serious incidents and to notify the IGJ of calamiteiten and other reportable events, such as violence in the care relationship and the termination of a care contract with a professional because of their conduct. The statutory framework is set out in the Wkkgz on the Dutch government legislation portal.
• IGJ reporting (melden). The IGJ publishes practical guidance on what constitutes a reportable event (such as a calamiteit), how to notify, and what the Inspectorate expects to receive. Always check the current IGJ guidance pages, as thresholds and procedures are updated.
• Patient and next-of-kin notification. Separately from regulatory reporting, the provider owes duties of openness to the patient under the treatment relationship governed by the WGBO (the Medical Treatment Contracts Act, part of Book 7 of the Dutch Civil Code). Telling a patient what went wrong is an obligation to that individual; reporting to the IGJ is an obligation to the public safety regulator. Both can be required for the same incident.

Timelines and what to report

Certain events must be reported to the IGJ promptly once identified, and the provider is then expected to investigate and to supply the Inspectorate with the findings within the timeframe the IGJ sets. Because the precise thresholds and deadlines are defined by law and by IGJ guidance and can change, confirm them against the current IGJ guidance and the Wkkgz before relying on any specific period. The practical discipline is simple: diarise the reporting decision from the moment of triage, and do not let the investigation’s duration absorb the reporting clock.

Practical reporting tips.

• Report facts, not framed conclusions. An IGJ notification should set out what is known, the sequence of events, the harm, the immediate measures taken, in neutral terms. Avoid attributing blame to a named individual before the investigation is complete.
• Avoid under-reporting. When in doubt about whether an event meets the threshold, the safer course is usually to report or to contact the IGJ to clarify, rather than to withhold and risk a later finding of non-compliance.
• Avoid over-reporting into vagueness. A notification padded with speculation is as unhelpful as one that is too thin. Keep it factual, dated and specific.
• Keep a copy of exactly what was reported and when. The notification itself is a piece of evidence and must go into the investigation file.

A neutral opening for an IGJ notification might read along the lines of: “On [date], during [procedure/care episode], [patient identifier redacted or coded] experienced [outcome]. Immediate measures taken were [list]. An internal investigation has been initiated to establish the facts and identify any corrective actions.” This states the position without pre-judging responsibility and leaves room for the investigation to proceed.

Preserve evidence and protect patient and staff data

Evidence that is lost, altered or gathered unlawfully can sink both an internal investigation and any later proceeding. Preservation and data protection are therefore not administrative afterthoughts, they are the foundation of a credible investigation.

Evidence preservation checklist

• Lock the records. Freeze the relevant electronic health records so that no further edits are possible, and secure any paper files in a controlled location.
• Image digital devices forensically. Where laptops, phones or workstations may hold relevant data, take a forensic image rather than browsing the live device, which can overwrite metadata.
• Preserve device and system logs. Medical device logs, infusion pump data, access logs and audit trails are often decisive and may be overwritten automatically, identify and export them early.
• Secure CCTV. Camera footage is routinely overwritten on a short cycle; request and ring-fence it immediately.
• Build a witness list. Identify everyone present or involved before memories fade and before shifts rotate.
• Maintain a chain of custody log. Record what was collected, by whom, when, from where and where it is now stored. Every transfer is logged. This is what allows the evidence to be trusted later.

Data protection under the AVG

Patient records and staff records contain special-category health and personal data, and processing them for an investigation must comply with the AVG and the guidance of the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority). The key principles to apply throughout internal investigations healthcare Netherlands organisations conduct are:

• Lawful basis. Identify and document the lawful basis for processing the data for investigation purposes, and the exception that permits processing special-category health data.
• Data minimisation. Collect and review only the data necessary for the investigation’s defined scope, not the entire record set because it is convenient.
• Access control. Restrict access to the investigation file to the named investigation team, and log who accessed what.
• Record of processing. Note the investigation in your processing records and document the decisions taken.
• Retention limits. Hold the data only as long as needed for the investigation and any resulting proceedings, then dispose of it in line with policy.
• Redaction. Where the final report will be shared internally or with a disciplinary body, redact patient identifiers that are not strictly necessary for that recipient.

For cross-border situations or where the GDPR interpretation is contested, the European Data Protection Board’s guidance on processing health data provides interpretative support. The combination of a disciplined chain of custody and an AVG-compliant processing trail is what makes an internal investigation both evidentially robust and legally defensible.

Conducting staff interviews: planning, rights and scripts

Interviews are where facts are established, and where fairness is most easily compromised. In internal investigations healthcare Netherlands employers run, a poorly planned interview can both distress the staff member and render their account unreliable or contested.

Who should conduct the employee interview in healthcare NL

Decide early whether an interview should be led by HR, by legal counsel, or by both. As a rule of thumb: factual, non-contentious witness interviews can be handled by HR with a note-taker; interviews of a staff member who may face disciplinary, tuchtrecht or criminal consequences should involve legal input, and the staff member should be told they may wish to seek their own advice. The distinction between a witness and a subject of the investigation drives much of the process, treat subjects with greater procedural care.

Interview preparation and rights

• Prepare a written interview plan and a list of documents the interviewee may be shown.
• Explain the purpose of the interview, whether the person is a witness or a subject, and how the information will be used.
• Tell the interviewee whether notes or recordings will be taken; recording raises its own data-protection questions, so default to contemporaneous written notes unless there is a clear and documented reason to record.
• Allow the interviewee to review and comment on the note of their interview.
• Where suspension is being considered, treat it as a protective and procedural step, not a sanction, and take HR and legal advice before acting.

Sample interview structure

1. Introductions, roles and the purpose of the meeting.
2. Explanation of status (witness or subject), confidentiality and how the account will be used.
3. Open narrative, let the interviewee describe events in their own words without interruption.
4. Clarifying questions, working chronologically through the events.
5. Documents or logs put to the interviewee for comment.
6. Opportunity for the interviewee to add anything and to correct the record.
7. Close, next steps and welfare check.

Do’s and don’ts. Do keep questions open and neutral; do take accurate, timed notes; do keep the interview proportionate. Don’t conduct an interview that resembles a police interrogation, if the matter has criminal dimensions, an aggressive internal interview can both harm the individual and prejudice a later criminal process. Don’t promise confidentiality you cannot deliver, since findings may have to be shared with the IGJ or a disciplinary body.

Legal interfaces: disciplinary, tuchtrecht and criminal investigations in healthcare Netherlands

One internal investigation can feed several parallel processes, each with different rules, standards and consequences. Managing those interfaces is the most legally sensitive part of internal investigations healthcare Netherlands providers undertake.

The four parallel tracks

• IGJ administrative supervision. The Inspectorate acts in the public interest to oversee safety and can use the provider’s findings for supervision and enforcement.
• Disciplinary action by the employer. Governed by employment law, aimed at corrective action against an employee, and based on the employer’s internal procedures.
• Tuchtrecht (professional disciplinary law). For BIG-registered professionals, this is governed by the Wet op de beroepen in de individuele gezondheidszorg (Wet BIG) and is concerned with a registered professional’s fitness to practise and the protection of the public, decided by a regional disciplinary tribunal (tuchtcollege).
• Criminal investigation. Engaged where there is suspicion of a criminal offence, such as intentional harm or falsification, under the Wetboek van Strafrecht (the Dutch Criminal Code), with the highest standard of proof.

When to pause internal fact-finding

If criminal conduct is suspected, the internal investigation must be handled with great care so as not to prejudice a criminal process or compromise evidence. In practice this means contacting criminal counsel early, being cautious about interviews that could amount to an uncounselled interrogation, and sometimes pausing or narrowing internal steps while the position is clarified. Evidence that must be preserved for a criminal process should be secured and, where appropriate, handed to the authorities rather than analysed internally in a way that risks contaminating it.

Privilege and confidentiality limits

There is no automatic, absolute privilege over an internal investigation report under Dutch law. The professional secrecy (geheimhoudingsplicht) and the legal professional privilege (verschoningsrecht) of attorneys-at-law are governed by the framework overseen by the Nederlandse Orde van Advocaten (the Dutch Bar Association), and material prepared by or exchanged with an external advocaat may attract protection in limited circumstances. However, a report shared with the IGJ, used in an HR process, or relevant to a criminal matter will typically not be protected. The practical consequence is significant: assume that what you write may be read by a regulator, a disciplinary tribunal or a court.

Where litigation or prosecution is genuinely likely, take legal advice on the structure and ownership of the investigation before the final report is produced.

Dutch courts have had to weigh how internal investigation findings are used across these tracks. The broader lesson from the case law is consistent with the comparison below: findings gathered internally can and do travel into disciplinary, tuchtrecht and criminal processes, so they must be gathered lawfully and recorded carefully from the outset.

Comparison table: when to notify IGJ and use of findings

A practical internal investigation protocol

The following protocol consolidates the steps above into a repeatable sequence. Treat it as the backbone of your internal investigation protocol and adapt the detail to the matter at hand.

1. Triage. Classify the matter by patient-safety severity, legal risk and criminal red flags. Record the outcome and the reasons.
2. Protect and preserve. Take immediate safety measures, then lock records, image devices, secure logs and CCTV, and open the chain-of-custody log.
3. Appoint a lead investigator. Name a lead with the authority, independence and support to run the probe, and define who sits on the team and who has access to the file.
4. Decide the IGJ reporting position. Assess whether a reporting obligation is engaged and, if so, notify in neutral factual terms within the required time.
5. Plan and conduct interviews. Prepare interview plans, distinguish witnesses from subjects, respect rights, and take accurate notes.
6. Analyse the evidence. Reconstruct the chronology, test it against the documents and device data, and identify root causes rather than individual blame alone.
7. Decide on action. Determine corrective measures, any HR or disciplinary steps, and whether tuchtrecht or criminal referral is appropriate, taking legal advice where the interfaces are engaged.
8. Communicate. Fulfil patient and next-of-kin openness duties and share findings with the IGJ as required, keeping regulatory and individual communications distinct.
9. Document and retain. Finalise the report, retain the file in line with retention and AVG limits, and schedule follow-up to verify that corrective actions were implemented.

Assign clear responsibilities and realistic timelines to each step. The single most common failing in internal investigations healthcare Netherlands teams run is a process that drifts, reporting deadlines slip, evidence degrades and interviewees’ recollections fade. A named owner and a dated plan prevent that drift.

Record keeping, reporting outcomes and follow-up

The investigation report is the durable output and should be structured so that it can be read by different audiences without revealing more than each needs. A workable structure is: scope and mandate; methodology and sources; chronology of events; findings of fact; root-cause analysis; conclusions; and recommended corrective actions. Keep conclusions grounded in the evidence set out earlier in the report, and separate findings of fact from any judgement about culpability.

When deciding what to share, keep three streams distinct. The IGJ receives the facts and safety-relevant findings in line with its requirements. Staff involved receive what procedural fairness demands within the disciplinary or employment process. Patients and next of kin receive the openness owed to them under the treatment relationship, which is a communication about their own care, not necessarily a copy of the internal report. Redact personal and patient identifiers that a given recipient does not need, consistent with the AVG.

Finally, close the loop. Record the corrective actions, assign owners and deadlines, and audit implementation after a set interval. An investigation that identifies a systemic risk but does not verify that the fix was made leaves the provider exposed to a recurrence, and to a far harder conversation with the IGJ the second time around.

Conclusion

Running internal investigations healthcare Netherlands providers can defend in 2026 is a matter of discipline rather than instinct: protect patients first, preserve evidence correctly, report to the IGJ in neutral and timely terms, interview fairly, respect the AVG, and keep a careful record of every decision and its reasons. The four tracks, IGJ supervision, employer discipline, tuchtrecht and criminal law, each impose their own demands, and an investigation gathered lawfully from the outset is one that can withstand all of them. Where the facts are serious or contested, seek country-specific counsel early. For tailored advice, connect with a healthcare lawyer in the Netherlands through the Global Law Experts network.

Sources

1. Inspectie Gezondheidszorg en Jeugd (IGJ)
2. Wetten.overheid.nl, Wet kwaliteit, klachten en geschillen zorg (Wkkgz)
3. Wetten.overheid.nl, Wet op de geneeskundige behandelingsovereenkomst (WGBO, Burgerlijk Wetboek Boek 7)
4. Wetten.overheid.nl, Wet op de beroepen in de individuele gezondheidszorg (Wet BIG)
5. Wetten.overheid.nl, Wetboek van Strafrecht
6. Autoriteit Persoonsgegevens (Dutch Data Protection Authority)
7. Nederlandse Orde van Advocaten
8. European Data Protection Board (EDPB)
9. Rijksoverheid, Ministry of Health, Welfare and Sport (VWS)