Key Benefits:
The public concerned: beneficiaries of social security benefits, health professionals and employers.
Purpose: Implementation of personal data treatments for the performance of the missions of the organizations of managers of the mandatory health insurance plans related to the services of benefits.
Entry into force: this decree comes into force on the day after its publication.
Notice: The Order authorizes the implementation by the management agencies of the mandatory basic health insurance plans, personal data treatments for the implementation of the operations for the opening and monitoring of the rights of the health insurance beneficiaries and the payment of the benefits that they receive.
References: This decree is available on the website Légifrance (http :// www. legifrance. gouv. en).
The Prime Minister,
On the report of the Minister of Social Affairs, Health and Women ' s Rights,
Vu le code of social action and familiesincluding article L. 251-1;
Vu le Rural Code and Maritime Fishingincluding articles L. 723-2, L. 723-3 and L. 723-11;
Vu le Social Security Code ;
Vu la Act No. 78-17 of 6 January 1978 modified in relation to information technology, files and freedoms, including article 27;
See?Order No. 2005-1516 of 8 December 2005 on electronic exchanges between users and administrative authorities and between administrative authorities;
Vu le Decree No. 2005-1309 of 20 October 2005 amended for the application of Act No. 79-17 of 6 January 1978 on computers, files and freedoms;
Considering the opinion of the National Health Insurance Fund for Employees dated 26 August 2014;
Having regard to the opinion of the Central Fund for Agricultural Social Mutuality of 10 September 2014;
See?opinion of the National Commission on Informatics and Freedoms dated 23 October 2014 ;
The State Council (Social Section) heard,
Decrete:
For the application of articles L. 115-7, L. 161-1-4, L. 211-1, L. 221-1, L. 611-4 and L. 611-8 Social Security Code, L. 723-2, L. 723-3, L. 723-11 and L. 723-12-1 Rural Code and Maritime Fishing and theArticle L. 251-1 of the Code of Social Action and Families, the management organizations of the mandatory basic health insurance plans are authorized to implement personal data treatments for the exercise of the duties entrusted to them by law, whose purposes are:
1° Registration, affiliation, instruction, management and control of the rights of beneficiaries of health insurance, maternity, paternity, disability and death benefits, supplementary health protection, assistance in the payment of supplementary health insurance, health and social benefits, prevention, legislation in the field of occupational accidents and occupational diseases and assistanceArticle L. 251-1 of the Code of Social Action and Families ;
2° Acquisition, control, processing and recording of useful information:
(a) Payment of benefits and aids mentioned in 1° and remuneration;
(b) Upon the issuance of care, products or benefits or aids taken care of or being reimbursed;
(c) To provide information on these transactions to the recipients of reimbursements, remuneration or care, complementary organizations and health professionals, health institutions, health centres, medical and social structures and service providers;
3° Individualized management of the relationship with recipients, health professionals, health institutions, health centres, medical and social structures, service providers, supplementary health insurance organizations, health care institutions, reporting third parties and employers through postal or electronic mail, telephone, telephone or physical reception and teleservices;
4° Monitoring and processing of amicable procedures, gracious remedies, contentious actions and actions to prevent and combat misconduct, abuse and fraud;
5° The transfer, when an insured person changes a managerial body, of information relating to the insured person required for the performance of the missions of the new attachment agency, in accordance with professional and medical secrets;
6° The production of statistics and the management and implementation of risk management and public health policies based on previously anonymized data.
The treatments authorized by Article 1 of this Order may cover the following categories of data:
A. - With regard to social insured persons and their beneficiaries:
1° Identification data relating to the situation of the insured or entitled to:
(a) The registration number on the National Register for the Identification of Physical Persons (NIR) and, where applicable, any temporary registration number that would have been assigned to them or, for persons in the process of assigning a registration number to the National Register for the Identification of Physical Persons, a waiting ID number (NIA) assigned to all organizations by the National Fund for the Old Age Insurance of Employees on the basis of the civil status data and their date of assignment;
(b) The family name, the name of use, the first names, the sex;
(c) The date, place and, where applicable, birth status and date of death;
(d) Nationality, if this information is necessary for the application of a bilateral convention, or as a national of a member country of the European Union, including France, or a country not a member of the European Union;
(e) The identity document number or residence permit number, the AGDREF number, the dates of the residence permit and the nature of the residence permit;
(f) Information on the supporting documents of the stable residence in France;
(g) The postal address, telephone numbers and e-mail address;
(h) The connection regime or the affiliate organism(s);
(i) Information on membership in a supplementary health insurance organization;
(j) Information on the rights and access to care devices with supporting documents, periods and natures;
(k) Identifiers and connection to family allowance organizations;
(l) Bank identifiers;
(m) Information relating to the designation of a treating physician and its name, name, specialty, identification numbers, address and telephone numbers;
(n) Photography;
(o) The amount of resources and the composition of the household;
2° Health data:
(a) Information on residential accommodation for dependent elderly, health care or health centre;
(b) Information on the exemption or modulation of the moderator ticket, the date, nature and duration of the exemption;
(c) The nature and amounts reimbursed for acts, benefits, medicines or health products and the detailed code number of acts or benefits issued, the country in which such acts were carried out or those benefits issued;
(d) The existence of a pregnancy, maternity or paternity and, in the event of pregnancy, its presumed date, the date of examination, the date of seizure, the number of unborn children and the number of dependent children;
(e) The benefit of universal disease coverage, complementary universal disease coverage or assistance in the acquisition of complementary health;
(f) Information on a device, a spa treatment, a service subject to prior agreement;
(g) The existence of an appeal against third parties;
(h) The existence of a work accident, occupational disease or disability, date, seat of injury, file numbers, nature of medical notice;
(i) The existence of a hospitalization, the medical-to-treaty discipline and treatment methods, dates, homogeneous group of stays and homogeneous group of rates, services in the context of the retrocede pharmacy, pharmaceutical specialties and list of products and services in addition to the stay, the amount of the stay;
(j) The information necessary to support benefits and aids in the context of health and social action, including the amount of resources and the composition of the home;
(k) The information needed to support services in the context of prevention;
(l) The information necessary for the issuance of the cards referred to in Article 1 and for the management of their production and renewal;
(m) Data on stopovers, the payment of daily sickness, maternity, paternity, occupational accidents and illnesses, and the payment of disability pensions, work-related rents and occupational diseases or death capital.
B. - With respect to applicants and beneficiaries of the assistance provided forArticle L. 251-1 of the Code of Social Action and Families, in addition to the information mentioned at 1° :
(a) The benefit of the assistance provided forArticle L. 251-1 of the Code of Social Action and Families ;
(b) The recipient number of the assistance providedArticle L. 251-1 of the Code of Social Action and Families ;
(c) The date of arrival in France;
(d) The characteristics of the address, whether it is a personal address, domicile or accommodation;
(e) The type code relating to the validity of the residence permit, the duplicata number, the reference code on the residence permit;
(f) Photography;
(g) Resources.
C. - For health professionals, medical assistants and other service providers:
(a)) Identification data with the name, first name, ADELI number, registration number on the shared directory of health professionals (RPPS), SIRET number, FINESS number and health insurance number (DAM);
(b) Occupation and, where appropriate, specialty;
(c) The postal address, telephone numbers and e-mail address;
(d) The conventional situation;
(e) The acts, products and services prescribed and executed with their detailed coding;
(f) The amount of fees or the amounts and types of remuneration received, as well as the indicators and the patient used to calculate such remuneration;
(g) Bank identifiers;
(h) Rates;
(i) Activity indicators;
(j) Information on the existence of a health professional agreement with a complementary body.
D. - Health facilities, health centres and medical-social structures:
(a) The establishment's identification data, including the social reason, the FINESS number, the SIRET number and the connection box;
(b) The data relating to the activity of the establishment, including its category, legal status, specialties exercised therein, medico-to-do discipline and treatment modes, Radio accreditation.
E. - With regard to employers:
(a) Name, social reason, SIRET numbers;
(b) The postal and electronic address and telephone numbers;
(c) Bank identifiers;
(d) The main activity of the employer;
(e) The stated elements for the management of entitlements to benefits;
(f) The name, first name and postal, telephone and electronic contact information.
F. - With regard to complementary organizations:
(a) The social reason, the identifier, the SIRET numbers;
(b) The image of the counts, the supplementary fee, including in the context of the coordinated third party;
(c) The identification data of the recipient of the billing and the paying agency in case of a coordinated paid third party, including the nature of the recipient and its postal, telephone and electronic contact information.
Access to the data referred to in section 2, for their registration and management and for their respective responsibilities, and within the limits of the need to know, the officers involved in the care of insured persons, individually authorized by the director of their health insurance organization, as well as the practitioners authorized by the medical consultancy head of the medical control department and the agents under his authority.
No access to medical data is available to practitioners and staff under their authority, in accordance with the rules of medical secrecy and in the strict extent that such data are necessary for the exercise of the missions entrusted to them.
When an insured person changes a managerial body, the agents of the new organization under which he reports have access, under the conditions set out in the preceding two paragraphs, to the personal data concerning him to the extent necessary to ensure continuity of his care.
The data referred to in Article 2 are strictly necessary for the exercise of their duties, within the limits of the need to know, the officers authorized by the competent authority of their organization or administration:
1° Family allowance funds and the National Family Allowance Fund, for the opening of rights for beneficiaries of the benefits they serve and the prevention of undue benefits;
2° Pension and occupational health insurance funds and the National Employees' Old Age Insurance Fund, for registration in the inter-regime national directory of health insurance beneficiaries, created by theArticle L. 161-32 of the Social Security Codeand the determination of pension rights;
3° Unions for the recovery of social security and family allowance contributions and the Central Agency for Social Security Organizations, to determine the amount of contributions due by health professionals and the beneficiaries of universal health coverage;
4° Complementary health insurance organizations, to support the benefits they pay under the complementary portion, the CMU-C or the CCA;
5° Pôle emploi, pour la prévention des indus ;
6° Agents of departments and regions, for the exercise of their social missions;
7° Officers of the Centre for European and International Social Security Liaisons, for the exercise of their missions in the management of the rights of seconded workers;
8° Agents of foreign social security organizations, in the exercise of their missions in the management of claims and international social security debts, for the reimbursement of benefits under European regulations or bilateral or multilateral conventions, in accordance with the provisions of articles 68 and 69 of the Act of 6 January 1978 as amended above;
9° Department of Justice officers responsible for the prison administration, for the exercise of their duties in the care of persons placed in the hands of justice in accordance with the provisions of Article L. 381-30-1 of the Social Security Code ;
10° Officers of the Department of Internal Affairs responsible for the fight against identity fraud for the exercise of this mission;
11° Tax administration officials, on the one hand, for the calculation of the taxation of which these services are charged and, on the other hand, to transmit to the competent health insurance agency the information necessary for the instruction of claims under conditions of resources;
12° Public accountants responsible for the recovery of hospital claims for the exercise of this mission;
13° Tax administration personnel and energy suppliers for the allocation to beneficiaries of the complementary universal health coverage or health-related supplemental support of the tariffs set out in the sections L. 337-3 and L. 445-5 Energy code.
The data referred to in Article 2 are strictly necessary to carry out their duties, within the limits of the need to know:
(a) To ensure payment and reimbursement of daily allowances, employers or third parties acting on their behalf;
(b) For their information on the care they have done, refunded or taken care of, health professionals and care facilities.
Anonymized data, if any aggregated, are intended to be used strictly for the purpose of carrying out their duties, within the limits of the need to know them, officials of the High Health Authority, the European Commission and ministries responsible for social security, agriculture and labour.
The data referred to in section 2, with the exception of those referred to in 2° of the A, shall be retained not more than five years after the closure of the health insurance rights of the insured or the entitled person or until a final decision is taken in the event of litigation.
The data of the 2° of the A of Article 2 shall be kept to a maximum of three years from the date of payment. Beyond this period, they may be archived for a maximum of ten years in a separate logical environment to ensure the management of litigation, the fight against fraud and third-party remedies.
Access to the data referred to in the preceding paragraph is restricted to only agents authorized jointly by the local medical practitioner responsible for the medical service or by the medical consultancy chief of the medical control of the farm social mutuality funds and by the director of the body, in the context of the management, risk management, internal control, litigation, third-party recourse, the control of fraud and medical services. Simultaneous access to records of a medical nature and to identifiers of natural persons is reserved for consulting practitioners and staff under their authority.
For each of the treatments authorized under this Decree, the data shall be retained for a period commensurate with the purpose of processing, in accordance with the provisions of articles 6 and 36 of the Act of 6 January 1978 as amended above.
Information relating to the identification of agents who have accessed the data recorded in the treatments referred to in section 1 or who have altered them and the dates, times and types of such access or modification shall be retained during the calendar year in which access or modification took place and the following four calendar years.
The persons to whom the data of the treatment referred to in Article 1 relate are informed of the existence and implementation of a personal data processing concerning them, its purposes, the identity of the person responsible, the recipients of the data and the procedures for the exercise of the rights of access and rectification provided for in the articles 39 and 40 of the Act of 6 January 1978 referred to by the dissemination of information on the respective websites of the mandatory basic health insurance plans.
The right of opposition provided forArticle 38 of the Act of 6 January 1978 referred to above does not apply to treatment authorized by this Order.
The rights of access and rectification provided for in the articles 39 and 40 of the law of 6 January 1978 referred to above shall be exercised with the director of the association of the persons concerned.
Those responsible for the treatment authorized by this decree shall take the necessary measures to preserve the security of the data both in the context of their collection, consultation, communication or preservation.
The treatments carried out under this decree shall, when subjected to it, respect the general safety repository created by thesection 9 of the above-mentioned Order of 8 December 2005.
Implementation provisions of Article 26 of the Act of 6 January 1978 referred to above, the person responsible for each of the authorised data processing on the basis of this decree shall address to the National Commission on Informatics and Freedoms, prior to its implementation, a commitment to comply with the provisions of this decree in the conditions set out in thearticle 8 of the decree of 20 October 2005 referred to above.
The Minister of Social Affairs, Health and Women's Rights and the Minister of Agriculture, Agri-Food and Forestry, spokesperson for the Government, are responsible, each with respect to it, for the execution of this decree, which will be published in the Official Journal of the French Republic.
Done on April 3, 2015.
Manuel Valls
By the Prime Minister:
Minister of Social Affairs, Health and Women ' s Rights,
Marisol Touraine
Minister of Agriculture, Agri-Food and Forestry, Government Spokesperson,
Stéphane Le Foll
