HOSTING OF HEALTH DATA: THE PUBLISHED PRESCRIPTION

In line with the law of January 26, 2016, on the modernization of the health system, Ordinance No. 2012-27 of January 12, 2017, on the hosting of personal health data amends the legislation in this area.

What does the prescription change?

The European regulation of April 27, 2016, defines health data as "personal data relating to the physical or mental health of a natural person, including the provision of health care services, which reveal information about the state of health of this person ”. One of the main changes introduced by the ordinance concerns the approval of the hosts of such data.

Till now, digital crowds for individual well-being data have been approved via a three-year license, announced after reviewing a catalog by the French Digital Health Agency. The order of 12 January 2017, which will take effect on a date set by decree and no later than 1 st January 2019, replaces this approval certificate issued by the hosts by certification bodies accredited by the French action of accreditation (French Accreditation Committee, COFRAC) or that of a member state of the European Union. The current holders of the authorization will be able to keep it until its expiry and will have to bring themselves into conformity within a time limit fixed by decree.

Increased security

The conditions of this ordinance ensure the security of personal health data. Indeed, any type of accommodation, on a digital or physical medium, must be the subject of a contract and a notification from the person concerned.

 The ordinance also specifies the modalities of access and use of the hosted data. Indeed, their use is restricted to the hosting service, with data restitution - without keeping a copy - at the end of the contract. Also, the ordinance prohibits the transfer of data for consideration, including with the consent of the person concerned, and recalls the obligation of professional secrecy to which hosts are bound. Finally, a major advantage of this new certification process by organizations will be the reduction in the instruction time.

… And impacts in terms of costs.

While hosting providers will be able to take advantage of this new measure which will give them access to ISO international referencing and thus gain international visibility, this new process will have consequences in terms of cost. Indeed, they will have to bear the cost of insurance certification. For the sake of security, the hosts may also be subject to controls by the General Inspectorate of Social Affairs.

Health data is still underused

The next step in France concerning the hosting of health data could be the implementation of the Shared Medical File (DMP), already in place in the United States. It is a storage platform that centralizes the health data of all citizens. This file would notably allow better support and better treatment of patients. Besides, the data thus collected represents a veritable mine of information for research. One of the major challenges of the 21st century would be to be able to use this data while preserving the anonymity of patients