Key Benefits:
The public concerned: beneficiaries of social security benefits, health professionals and employers.
Purpose: Implementing personal data processing for the performance of the social services missions of the management organizations of the mandatory health insurance plans.
Entry into force: this decree comes into force on the day after its publication.
Notice: The decree authorizes the implementation by the management bodies of the mandatory health insurance plans of personal data processing required for the exercise of the support and care missions of insured persons and their beneficiaries in the social services of these organizations.
References: This decree is available on the website Légifrance (http :// www. legifrance. gouv. en).
The Prime Minister,
On the report of the Minister of Social Affairs, Health and Women ' s Rights,
Vu le Rural Code and Maritime Fishingincluding article L. 723-2;
Vu le Social Security Code ;
Having regard to Act No. 78-17 of 16 January 1978, as amended, relating to computing, files and freedoms, in particular its article 27;
Vu la Act No. 98-1194 of 23 December 1998 the financing of social security for 1999, including its article 41;
See?Order No. 2005-1516 on electronic exchanges between users and administrative authorities and between administrative authorities;
Vu le Decree No. 2005-1309 of 20 October 2005 amended for the application of Act No. 79-17 of 6 January 1978 on computers, files and freedoms;
Having regard to the advice of the Board of the National Health Insurance Fund for Employees dated 26 August 2014;
Having regard to the advice of the Board of Directors of the Central Fund for Agricultural Social Community dated 10 September 2014;
See?opinion of the National Commission on Informatics and Freedoms dated 23 October 2014 ;
The State Council (Social Section) heard,
Decrete:
For the application of the provisions of the articles L. 211-1, L. 221-1, L. 611-4 and L. 611-8 social security code and articles L. 723-2 and L. 723-11 the Rural Code and Maritime Fisheries, the management organizations of the mandatory basic health insurance plans are authorized to implement personal data treatments whose purposes are:
A. - The care and monitoring of records of insured persons and their beneficiaries of the social services of basic health insurance organizations, consisting of:
1° Management of the relationship with insured persons and their beneficiaries by postal or electronic mail, telephone or physical reception, telephone and tele-service, and management of individual or collective service offers;
2° The care of populations at risk of precariousness mentioned inArticle L. 262-1 of the Social Security Code ;
3° Transfer, where an insured person changes a managerial body, information relating to the insured person required to perform the duties of the new attachment organization, in accordance with professional secrecy.
B. - Leading the activity of the social service at the national, regional and local levels and evaluating the quality of service rendered to beneficiaries and their beneficiaries through statistics drawn from previously anonymized data.
I. - The treatments authorized by section 1 may relate to the following categories of data with respect to social insured persons and their beneficiaries of social service, provided that such data is strictly necessary and proportionate to the purposes of the processing referred to in section 1:
1° The registration number on the National Register for the Identification of Physical Persons (NIR) and, where applicable, any temporary registration number that would have been assigned to them or, for persons pending the issuance of a registration number on the National Register for the Identification of Physical Persons, a waiting ID number (NIA) assigned to all organizations by the National Fund for the Old Age Insurance of Employees on the basis of civil status data,
2° The family name, the name of use, the first names, the sex;
3° The date and place of birth;
4° The postal address, telephone numbers and e-mail address;
5° The family situation;
6° The identification data of persons composing the home, including their surname, name, first name, year of birth and relationship with the insured;
7° Data on the social situation and the appreciation of social difficulties involving the names and coordinates of family, friendly, neighbourhood or associative relations, strictly necessary for the assessment and treatment of problems relating to loss of autonomy and isolation;
8° For all members of the home, the amount and type of resources, expenses, credits, debts strictly necessary for the examination of precarious situations related to illness, disability or loss of autonomy;
9° The data on the terms and conditions of health care, including, where applicable, the registration of the insured in a care journey, its eligibility for the compensation of the disability, its classification according to the grid "autonomy, gyrontology, group Iso resources", its partial permanent disability rate, the exemption of the moderator ticket and the existence of a statement of attending physician;
10° Medical advice and limitations on the ability, including, where appropriate, references to consolidation, aggravation, incapacity to work or work;
11° The situation with respect to the training and employment and professional status of the insured or entitled beneficiary of the social service;
12° The risk involved, namely illness, maternity, occupational injury, occupational illness or disability;
13° Linking organizations and affiliate regimes and their identifiers and contact information;
14° Information on the situation with regard to social organizations in respect of rights and benefits and entitlements;
15° The potential benefit of universal disease coverage, complementary universal disease coverage or assistance in the acquisition of a health supplement;
16° The information necessary to support benefits in the context of health and social prevention and action involving the type and conditions of housing, preventive and compensatory aids such as aid to the person or household, technical assistance, home care, social action and optional assistance;
17° Data on stopovers, the payment of daily sickness, maternity, paternity, occupational accidents and illnesses, and the payment of disability pensions, work-related rents and occupational diseases or death capital.
II. - The treatments authorized by Article 1 may also include, as long as these data are strictly necessary and proportionate to the purposes of the processing, the identification of public and private partners of the social service associated with the care of the beneficiary:
1° For legal persons, their nature and their social reason;
2° For individuals, their name, name and function as well as their postal, telephone and electronic coordinates.
Access to the data referred to in Article 2 is strictly necessary for the exercise of their duties, within the limits of the need to know, the agents involved in the care of the insured persons and their beneficiaries, individually authorized by the director of their health insurance agency.
When an insured person changes a managerial organization, the agents of the new organization under which he reports have access, under the conditions set out in the preceding paragraph, to the personal data concerning him to the extent necessary to ensure continuity of his care.
The data referred to in section 2 is strictly necessary for the exercise of their duties, within the limits of the need to know it, the personnel of the legal partners mentioned in the 1st of Article 2, entitled by the authority responsible for these partners.
Only organizations authorized to use the registration number on the national identification directory of natural persons or a waiting ID number as user ID may be recipients.
Data relating to an insured person or a beneficiary of the action of the social service shall be retained for a maximum period of eighteen months after the action is terminated subject to the implementation of the provisions of section 38 of the Act of 6 January 1978 referred to above.
Beyond this period and except for opposition by the insured or entitled person, such data may be archived for a maximum of three years in a separate logical environment for the purpose of evaluating intervention devices. Access to archived data is restricted to agents authorized for this purpose by the director of the organization.
Access to archived data is restricted to only authorized officers jointly by the local medical practitioner responsible for the medical service, or the medical officer in charge of the medical check-up of the agricultural social mutuality funds and by the director of the organization in the context of the management, risk management, internal control, litigation, third-party remedy, anti-fraud and medical services activities.
For each of the treatments authorized under this Decree, the data shall be retained for a period commensurate with the purpose of processing, in accordance with the provisions of articles 6 and 36 of the amended Act of 16 January 1978.
Information relating to the identification of agents who have accessed the data recorded in the treatments referred to in section 1 or who have altered them and the dates, times and types of such access or modification shall be retained during the calendar year in which access or modification took place and the following four calendar years.
The persons to whom the data referred to in Article 2 relate are informed of the existence and implementation of the personal data processing concerning them, authorized under Article 1, its purposes, the identity of the person responsible, the recipients of the data and the procedure for the exercise of the rights of opposition, access and rectification provided for in Articles 38, 39 and 40 of the law of 6 January 1978
The right of opposition provided for in section 38 of the Act of 6 January 1978 referred to above shall be exercised with the director of the attachment agency.
The rights of access and rectification provided for in sections 39 and 40 of the Act of 6 January 1978 referred to above shall be exercised with the director of the attachment agency.
Processors take the necessary measures to preserve the security of data both in the collection and in the consultation, communication or preservation of data.
The treatments implemented under this Order in Council shall, when they are subject to it, respect the general safety reference created by section 9 of the above-mentioned Order of 8 December 2005.
Pursuant to the provisions of Article 26 of the Act of 6 January 1978 referred to above, the person responsible for each of the authorised data processing on the basis of this decree shall address to the National Commission of Computer Science and Freedoms, prior to its implementation, a commitment to conformity with the provisions of this Decree in the conditions established by thearticle 8 of the decree of 20 October 2005 referred to above.
The Minister of Social Affairs, Health and Women's Rights and the Minister of Agriculture, Agri-Food and Forestry, spokesperson for the Government, are responsible, each with respect to it, for the execution of this decree, which will be published in the Official Journal of the French Republic.
Done on April 3, 2015.
Manuel Valls
By the Prime Minister:
Minister of Social Affairs, Health and Women ' s Rights,
Marisol Touraine
Minister of Agriculture, Agri-Food and Forestry, Government Spokesperson,
Stéphane Le Foll
