The UZI card is disappearing: what does Dezi mean for healthcare organization?

Blog - Health & IT - Legislation / 5 November 2026

Healthcare is digitalising rapidly, but the security of digital access to patient data is struggling to keep pace. Of the 1.5 million people working in healthcare, only 90,000 hold an approved login credential [1]. One explanation is that the UZI card places significant demands on those who use it: the card requires specialist hardware, is costly to obtain and is primarily intended for BIG-registered healthcare providers. Because no better alternative has been available, the rest rely on credentials that do not meet the required level of assurance.

The Digital Identification and Authentication in Healthcare Act (DIAZ) is the legislature's attempt to resolve this access problem structurally. The DIAZ Act was passed by the House of Representatives on 6 October 2026 [2]. In this blog, we explain exactly what is changing, for whom and when.

The problem with a physical card in a digital world

The current standard for secure digital access in healthcare is the Unique Healthcare Provider Identification (UZI) card: a physical card used with a card reader and PIN code [3]. Secure in theory. Problematic in reality.

To begin with, the card only works in combination with a physical card reader and is not suitable for use on smartphones or tablets. That is unworkable in a sector where healthcare professionals are increasingly mobile. District nurses, home care workers and ambulance personnel do not work at a desk with a fixed card reader and in practice turn to other login methods that frequently fail to meet the required level of security [4]. The card is also expensive: a UZI card originally cost €255 for three years. From November 2026, the price is reduced to €127.50 per year, but solely because the validity period has been shortened for technical reasons [5].

For smaller organisations the cost remains a significant barrier, so significant that cards are shared between staff in practice, which undermines the very security they are meant to provide. The card's reach is also limited: it is primarily intended for BIG-registered healthcare providers and, strictly speaking, the UZI credentials were not legally permitted for access to healthcare information systems such as the electronic health record systems (EHR-systems). Finally, a staff member's healthcare identity is physically encoded on the chip. Change employer or role? An entirely new card is required [6].

The solution: Dezi gives the whole of healthcare one digital identity

The DIAZ Act introduces a new system: Dezi, short for De ZorgIdentiteit (The Healthcare Identity). Dezi has two components: an authentication platform to which healthcare providers connect their systems, and a register in which healthcare professionals and organisations enrol and where their digital healthcare identity is managed. In brief: the register establishes who you are and the platform governs how you gain access. Together, they will replace the current UZI system in due course [7].

To make this legally possible, the Additional Provisions for the Processing of Personal Data in Healthcare Act (Wabvpz) and the Youth Act are being amended. The changes also affect the Digital Government Act (Wdo) and the Electronic Data Exchange in Healthcare Act (Wegiz) [8].

Dezi brings the following concrete changes

No physical card required. Login will be possible via approved digital credentials, including DigiD and the European Digital Identity Wallet (EUDI Wallet). The EUDI Wallet is a digital wallet on a smartphone that allows EU citizens to prove their identity securely and share documents. It flows from the eIDAS Regulation, the European framework that harmonises digital identification and authentication across the EU [9].
Greater freedom of choice. Healthcare providers and professionals choose whichever approved credential best suits their workflow, provided it meets assurance level 'high' under the eIDAS Regulation [10].
Broader reach. The Dezi register is not limited to BIG-registered professionals. Anyone who processes patient or client data as part of their role, from nurse to administrative staff member, can be enrolled [11].
Greater flexibility when circumstances change. A Dezi registration remains in place when someone changes employer or role. Only the link to the healthcare provider is updated, making it easier for agency staff and temporary workers to start quickly [12].
Lower costs. Costs are expected to fall significantly compared with the current UZI credentials: estimates range from €20 to €70 per staff member per year. A subsidy scheme of 25 million euros in total is also available for the years 2026 to 2028 [13].
Future-proof. The system aligns with the eIDAS Regulation and the European Health Data Space (EHDS), which require healthcare providers to work with interoperable systems. The DIAZ Act therefore fulfils a prerequisite for the broader digitalisation of European healthcare.

How Dezi works in practice

To log in via Dezi, a healthcare professional first needs a healthcare identity. That identity consists, at a minimum, of a Dezi number and the organisation for which the professional works. To obtain it, the professional logs in via the healthcare worker portal and completes three steps in around five minutes: entering contact details drawn from the Municipal Personal Records Database (BRP), providing professional registration details retrieved automatically where possible from the BIG register, and reviewing and submitting the application [14].

Once registered, the professional can log in to any connected healthcare system. At each login, the Dezi register retrieves the healthcare identity: a combination of a unique number, the employing organisation and the associated authorisations. The healthcare provider then decides whether the professional is granted access. Registration alone is therefore not sufficient: the provider must explicitly grant access [15].

The Minister of Health, Welfare and Sport approves credentials in advance, a task carried out in practice by the Central Information Point for Healthcare Professions (CIBG). Approved credentials include public and private credentials recognised under the Digital Government Act, healthcare-specific credentials certified under NEN 7518, PKI-government server certificates and credentials notified under the eIDAS Regulation. If a credential no longer meets the requirements, approval can be suspended or withdrawn [16].

When will this happen?

The transition to Dezi is phased. The current timeline is as follows [17].

November 2026: Only one-year UZI credentials available to request

November 2026: EU Digital Identity Wallet available

Januari 2027: Dezi system technically ready

November 2027: Issue of UZI credentials stops

November 2028: End of dual period (UZI credentials deactivated); SBV-Z access via Dezi only

2026 to 2028: Subsidy scheme for new credentials (€25 million)

30 September 2029: Final deadline for phasing out UZI card

2030: Credentials must be quantum-proof

1 January 2031: Full mandatory use of Dezi for all healthcare information and exchange systems

Prepare now

The UZI card is disappearing, and Dezi is taking its place. The transition period provides breathing room, but those who wait until the last moment risk falling behind. For platform suppliers: the Dezi authentication platform test environment is available. Suppliers of healthcare information systems can connect now to test their systems and prepare for implementation [18].

For healthcare providers: now is the time to consider which approved credentials suit your workflows, whether your systems are ready to connect to the Dezi platform, and how you will manage the registration of staff, temporary workers and self-employed professionals. Those who map out what needs to be done now will not face surprises later.

We are following developments closely. If you have questions about what the DIAZ Act means for your organisation or would like to know how to prepare legally and practically, please do not hesitate to get in touch.