Health data on the phone: what a reception desk must not say or ask

The practical guide from the Conseil national de l’Ordre des médecins (the French national medical council, CNOM) and the CNIL (France’s data protection authority), June 2018 edition, points out that even simply knowing about a consultation with a specialist can give an indication of a person’s state of health, for example when they regularly see a cardiologist. A routine call to move an appointment is therefore not trivial.

Article L1110-4 of the Code de la santé publique (the French Public Health Code) guarantees every person receiving care respect for their privacy and for the secrecy of information concerning them. Except where the law expressly provides otherwise, this secrecy covers all information concerning the person that has come to the knowledge of the professional, of any member of the staff of the establishments, services or bodies concerned and of any other person in contact with them through their activities. Reception acts on behalf of the professional: whether it is handled by a person or by a tool, it applies the instructions the professional has set.

A spouse, an employer, an insurer or a relative asking “Is Ms X a patient of yours?” is seeking information about the person. Answering, whether yes or no, communicates data about them. The reasonable instruction is a neutral answer, for example: “I can neither confirm nor deny; the person concerned can contact us directly.” Any exceptions, such as a relative designated by the patient, are for the professional, not for reception.

For doctors in France, the Code de déontologie (the medical code of ethics, Article R4127-4) states that secrecy covers everything that has come to their knowledge in the course of their practice, including what they have seen, heard or understood, and Article R4127-72 requires them to ensure that the people who assist them are instructed in their obligations regarding professional secrecy. Written instructions and team training are the practical expression of this. Other health professions are subject to their own ethical rules.

Distinguish two types of request. General questions (opening hours, address, access, documents to bring) concern no one in particular and do not require identification. Requests that concern a file, an appointment or a result involve a specific person: before answering, reception makes sure that the caller is the person concerned or is authorised to act for them, according to the procedure the professional has defined.

The GDPR (Article 5(1)(f)) requires that data be processed in a way that ensures appropriate security, including protection against unauthorised or unlawful processing. Giving information to the wrong person is precisely what this principle seeks to prevent. In case of doubt, the prudent answer is to offer a call back from the professional rather than to answer on the spot.

Data concerning health belongs to the special categories of Article 9 of the GDPR: its processing is prohibited in principle, subject to the exceptions in paragraph 2, for example explicit consent or the needs of care and medicine, where the data are processed by a professional subject to professional secrecy or under their responsibility (paragraph 2, point (h), and paragraph 3). To this is added the minimisation principle of Article 5(1)(c): data that are adequate, relevant and limited to what is necessary. The CNOM and CNIL guide states that, if the consultation requires no preparation or specific equipment, the reason need not be recorded, and, for the patient file, that it is legitimate to collect the social security number only for issuing care claim forms (feuilles de soins) and for electronic transmission to the health insurance funds.

In practice, reception does not ask for a diagnosis, detailed symptoms or medical history, and does not give medical advice. If the caller confides of their own accord, the note passed on keeps only the minimum useful for following up the request.

Article L1111-8 of the Code de la santé publique governs the hosting of personal health data collected during prevention, diagnosis, care or social and medico-social follow-up activities: the digital host must hold a certificate of conformity issued by an accredited certification body (HDS certification, from hébergeur de données de santé, “health data host”), and the service is covered by a contract. Before entrusting recordings, transcripts, summaries or an appointment diary to a provider, whoever it is, ask for proof of the HDS certification of whoever hosts the data, the provider itself or its subcontractor, and have your lawyer or data protection officer check whether your use falls within the scope of this regime.

The CNOM and CNIL guide adds that the provider of a telephone answering service acts as a processor, under a subcontracting contract, and that the professional remains the controller. The other obligations of medical remote secretarial services are covered in a dedicated article on this blog.

This vigilance applies to a voice agent too. Alyas answers from the information you provide, announces at the start of the call that it is an AI and that the conversation is recorded and, when it does not know, says so and offers to pass the request on. For a use touching on health, apply to it, as to any provider, the checks described above. The trial is free for 10 days, with no card required.