Remote medical secretary: what to check before outsourcing your practice’s secretarial work

Article L1110-4 of the French Public Health Code (Code de la santé publique) establishes the right of every person receiving care to respect for their private life and to the confidentiality of information concerning them. According to the text, this secrecy covers all information that has come to the knowledge of the professional, of any staff member of the establishments, services or bodies concerned and of any other person in contact with them through their activities, and it is binding on all professionals working in the health system. A remote secretary hears a patient’s name, the reason for their appointment or the name of their doctor, even if they do not work on your premises: the question of whether they are bound by secrecy therefore fully arises.

The French code of medical ethics goes further for doctors. Its Article 72 (Article R4127-72 of the Public Health Code) requires doctors to ensure that the people who assist them are informed of their obligations regarding professional secrecy and comply with them. The commentary published by the Conseil national de l’Ordre des médecins (France’s national medical council) expressly names secretaries among the people bound by professional secrecy and points out that doctors are responsible for any breach of confidentiality coming from those around them.

In practice, ask the provider how its operators are trained in professional secrecy, whether they sign a confidentiality undertaking and who, on its side, can listen to or read the exchanges with your patients.

Data concerning health is one of the special categories of data whose processing Article 9 of the GDPR prohibits, except for an exhaustive list of exceptions. When an external secretarial service processes such data on your behalf, Article 28 requires you to use only a processor providing sufficient guarantees, and to govern the relationship by a written contract.

This contract must, in particular, set out the subject matter, duration, nature and purpose of the processing, the types of data and the categories of data subjects. It provides that the processor processes the data only on documented instructions, that authorised persons are bound by confidentiality, that no other processor is engaged without prior written authorisation and that, at the end of the service, the data is deleted or returned, as you choose.

Before signing, go through these clauses one by one. Also ask for the list of sub-processors (telephony, hosting, calendar tool) and the country where the data is stored.

In France, Article L1111-8 of the Public Health Code governs the hosting of health data. The G_NIUS platform, published by the Délégation au numérique en santé (France’s digital health delegation) and run by the Agence du numérique en santé (the French digital health agency), sums up the rule: anyone who hosts health data on behalf of those who produce or collect it, or on behalf of the patient, must guarantee its security. The data concerned is data collected during prevention, diagnosis, care or social and medico-social follow-up activities (Article R1111-8-8).

Article R1111-9 defines hosting as providing, on behalf of the controller, all or part of six activities: making available the physical sites, the hardware infrastructure, the virtual infrastructure and the application hosting platform; administering and operating the information system containing the health data; and backing up that data. A host carrying out these activities on digital media must hold an HDS certificate (Hébergeur de données de santé, France’s health data hosting certification), issued by a certification body.

So the question to ask the provider is precise: where are call recordings, notes, messages and the calendar stored, by whom, and is that host HDS-certified for the activities concerned? If the analysis is uncertain, G_NIUS’s “Mon diagnostic réglementaire” (regulatory self-assessment) service or your data protection officer can help you characterise the situation.

Article 5 of the GDPR requires data to be limited to what is necessary in relation to the purpose: this is the data minimisation principle. For a telephone secretarial service, the purpose is essentially administrative: identifying the patient, contacting them, offering them a slot and passing their request on to you.

Write an instruction setting out what the secretarial service asks (identity, phone number, type of appointment, first consultation or follow-up) and what it does not ask, such as details of symptoms beyond what is needed to direct the caller. Also set out what it does not disclose over the phone: test results, medical information, whether a patient is at the practice. Those answers are for the practitioner.

A secretarial service does not assess an emergency. Service-public.fr, the French government’s official information site, lists the numbers to call in France: 15 (the Samu, the emergency medical service) for a medical emergency, 112, the European emergency number, and 114 for people who are deaf, hard of hearing or aphasic, reachable via an app, online or by SMS. The 15 also gives access to the healthcare access service (SAS, service d’accès aux soins) when the patient’s regular doctor (médecin traitant) is unavailable.

Draw up with the provider the list of situations that trigger an immediate referral to 15 and the exact sentence to say. That list is a matter for your medical judgement, not the secretarial service’s. Finally, make sure every such call is systematically logged so that you can review them.

The same questions apply to a voice agent: who processes the data, where it is stored, what the agent collects, what it says and how it directs an emergency. Alyas answers the phone 24/7 using the information you provide, announces at the start of the call that it is an AI and that the call is recorded, can book appointments once connected to Google Calendar or Cal.com, and places a transcript and a summary of each call in your customer area. Recordings, transcripts and summaries are hosted in the European Union, but Alyas does not offer HDS-certified hosting: this is a criterion to factor into your own analysis before any use by a medical practice.