Key Benefits:
The public concerned: beneficiaries of social security benefits, health professionals and employers.
Purpose: Implementing personal data treatments for the exercise of the medical services missions of the organizations of managers of the mandatory health insurance plans.
Entry into force: this decree comes into force on the day after its publication.
Notice: The decree authorizes the implementation by the management bodies of the mandatory basic health insurance plans of personal data processing required for the exercise of the medical services missions of these organizations, concerning the determination of rights, payment and monitoring of benefits.
References: This decree is available on the website Légifrance (http :// www. legifrance. gouv. en).
The Prime Minister,
On the report of the Minister of Social Affairs, Health and Women ' s Rights,
Vu le Rural Code and Maritime Fishingincluding articles L. 723-2, L. 723-11 and L. 732-5;
Vu le Social Security Code ;
Having regard to Act No. 78-17 of 16 January 1978, as amended, relating to computing, files and freedoms, in particular its article 27;
See?Order No. 2005-1516 on electronic exchanges between users and administrative authorities and between administrative authorities;
Vu le Decree No. 2005-1309 of 20 October 2005 amended for the application of Act No. 79-17 of 6 January 1978 on computers, files and freedoms;
Having regard to the advice of the Board of the National Health Insurance Fund for Employees dated 26 August 2014;
Having regard to the advice of the Board of Directors of the Central Fund for Agricultural Social Community dated 10 September 2014;
See?opinion of the National Commission on Informatics and Freedoms dated 23 October 2014 ;
The State Council (Social Section) heard,
Decrete:
For the application of the provisions of the articles L. 314-1, L. 315-1, L. 315-2, L. 613-12 and L. 613-13 Social Security Code and L. 723-2, L. 723-11 and L. 732-5 Rural Code and Maritime Fishing, the management organizations of the mandatory basic health insurance plans are authorized to implement personal data treatments, for the exercise of the missions of their medical service, the following purposes:
1° Determine the rights to benefits provided by the articles mentioned in the first paragraph, open these rights and pay the corresponding benefits;
2° To conduct the analyses and controls referred to in Article L. 315-1 above;
3° Allow the individualized management of the relationship with benefit recipients and care providers and service providers, through postal or electronic mail, telephone, telephone or physical reception and teleservices;
4° Contribute to the conformity of the payment of benefits to the rights of insured persons, to the prevention and control of misconduct, abuse and fraud, and to the management and monitoring of contentious actions;
5° Transfer, when an insured person changes his or her managerial body, the information relating to the insured person required to carry out the missions of the new attachment agency, in accordance with professional and medical secrets;
6° Produce statistics and pilot and implement the policy and actions of risk management and prevention based on previously anonymized data.
The treatments authorized by Article 1 of this Order may cover the following categories of data:
1° With regard to social insured persons and their beneficiaries:
(a) The registration number on the National Register for the Identification of Physical Persons (NIR) and, where applicable, any temporary registration number that would have been assigned to them or, for persons in the process of assigning a registration number to the National Register for the Identification of Physical Persons, a waiting ID number (NIA) assigned to all organizations by the National Fund for the Old Age Insurance of Employees on the basis of the civil status data and their date of assignment;
(b) The surname, name of use, name, sex, civility and quality of insured or entitled and, in this case, the possible family connection with the insured;
(c) The date and place of birth, the date of birth and, where applicable, the date of death;
(d) ID number or residence permit number;
(e) The postal address and telephone numbers of permanent or temporary residence sites and the e-mail address;
(f) The attachment organ(s);
(g) Data on the present and past health status of the recipient;
(h) If one has been designated, the attending physician, its identifiers, name, name, specialty, address and telephone number;
(i) Information on the residence in residential accommodation of dependent elderly people;
(j) Information on the exemption of the moderator ticket, the date, nature and medical reason of the exemption;
(k) The nature of acts and medicines or health products and their detailed codings;
(l) The existence of a long-term pregnancy or affection and the elements of the protocol on this condition;
(m) Identification of the complementary body;
(n) The potential benefit of universal disease coverage, complementary universal disease coverage or assistance in the acquisition of a health supplement;
(o) Information relating to the equipment, a spa or a service subject to prior agreement and any information relating to invoices, requests for reimbursement of health expenses, claims for payment of compensation, allowances or pensions, requests for recognition of a particular status in respect of the services provided by the Social Security Code ;
(p) The existence of an appeal against third parties;
(q) The existence of occupational accidents or diseases, their dates, the seat of the injury(s) and their diagnosis, the file numbers, the nature of the medical notice and the possible permanent incapacity rates with the description of the corresponding clinical or functional consequences;
(r) The existence of a hospitalization, its dates, the establishment number, the medico-tarido discipline, and the homogeneous group of stay;
(s) The existence of a stoppage of work, its start and end dates, its initial arrest or extension quality, the risk on which it is charged, the amount of daily allowances and the medical elements related to this stop;
(t) The existence of a disability, its category, the existence of an inability, their diagnosis and the payment of a disability benefit;
(u) The medical document containing the report of the clinical and medico-administrative examination in relation to the health condition at the origin of a request for service;
(v) The results of the complementary examinations in relation to a pathology at the origin of a request for delivery;
(w) Ongoing treatments related to a pathology at the origin of a claim for benefit;
(x) Dematerialized documents exchanged with recipients and health professionals as part of the management of records and claims for benefits.
2° For health professionals, health institutions, health centres and medical-social structures, medical assistants and other service providers:
(a) Identification data including name, name, ADELI numbers, shared directory of health professionals, RFOS or SIRET;
(b) Occupation and, where appropriate, specialty;
(c) The postal address, telephone numbers and e-mail address;
(d) The conventional situation;
(e) The acts prescribed and executed with their detailed coding;
(f) The amount of fees or remuneration received.
Access to the data referred to in Article 2 is strictly necessary for the exercise of their duties, within the limits of the need to know it, the officers involved in the care of the insured persons, individually authorized by the chief medical officer of the medical control department and placed under the authority of a consulting practitioner.
Only consulting practitioners and staff under their authority have access to the nominal data from treatments, when associated with the code number of a diagnosed pathology.
When an insured person changes a managerial body, the agents of the new organization under which he reports have access, under the conditions set out in the preceding two paragraphs, to the personal data concerning him to the extent necessary to ensure continuity of his care.
The data referred to in section 2 shall not be retained after the death of the insured or the entitled person. However, they are kept to the maximum:
1° Three years after his/her death when they are related to an insured person or a person entitled to a long-term condition or benefits subject to the prior agreement of the medical control service;
2° Five years after his death when they are related to an insured person or a person entitled to a disability or incapacity;
3° Ten years after his death when they are related to an insured person or a person who is entitled to a work accident or occupational disease.
In addition, where a third party appeal or litigation exists, the data is retained until the final decision is taken.
Beyond the above-mentioned deadlines, data can be archived for ten years in a separate logical environment to ensure better handling of disputes, the fight against fraud and third-party remedies.
Access to archived data is restricted to only authorized officers jointly by the local medical practitioner responsible for the medical service or the medical consultancy chief of the medical control of the agricultural social mutuality funds and by the director of the organization in the context of the management, risk management, internal control, litigation, third-party recourse, the control of fraud and activities of the medical service. Simultaneous access to archived data on recipient pathologies and identifiers is only possible for consulting physicians and individuals under their authority.
For each of the treatments authorized under this Decree, the data shall be retained for a period commensurate with the purpose of processing, in accordance with the provisions of articles 6 and 36 of the Act of 6 January 1978 as amended above.
Information relating to the identification of agents who have accessed the data recorded in the treatments referred to in section 1 or who have altered them and the dates, times and types of such access or modification shall be retained during the calendar year in which access or modification took place and the following four calendar years.
The persons to whom the data referred to in Article 2 relate are informed of the existence and implementation of the personal data processing relating to them, its purposes, the identity of the person responsible, the recipients of the data and the terms and conditions for the exercise of the rights of access and rectification provided for in sections 39 and 40 of the law of 6 January 1978 referred to by the dissemination of information on the respective websites of the health insurance of the
The right of opposition provided for in section 38 of the Act of 6 January 1978 referred to above does not apply to the treatment authorized by this Order.
The rights of access and rectification provided for in sections 39 and 40 of the Act of 6 January 1978 referred to above shall be exercised with the director of the attachment agency of the persons concerned.
Processors take the necessary measures to preserve the security of data both in the collection and in the consultation, communication or preservation of data.
The treatments implemented under this Order in Council shall, when they are subject to it, respect the general safety reference created by section 9 of the above-mentioned Order of 8 December 2005.
Pursuant to the provisions of Article 26 of the Act of 6 January 1978 referred to above, the person responsible for each of the authorised data processing on the basis of this decree shall address to the National Commission of Computer Science and Freedoms, prior to its implementation, a commitment to conformity with the provisions of this Decree in the conditions set out in thearticle 8 of the decree of 20 October 2005 referred to above.
The Minister of Social Affairs, Health and Women's Rights and the Minister of Agriculture, Agri-Food and Forestry, spokesperson for the Government, are responsible, each with respect to it, for the execution of this decree, which will be published in the Official Journal of the French Republic.
Done on April 3, 2015.
Manuel Valls
By the Prime Minister:
Minister of Social Affairs, Health and Women ' s Rights,
Marisol Touraine
Minister of Agriculture, Agri-Food and Forestry, Government Spokesperson,
Stéphane Le Foll
