Telehealth Regulation

Is the use of telehealth permitted?

Telehealth is authorised in France, subject to specific requirements.

The French Public Health Code (“FPHC”) defines telehealth (“télémédecine”) as “a form of remote medical practice using information and communication technologies, which connects one or more health professionals, among them or with a patient, and, where appropriate, other professionals involved in the patient's care. It allows to establish a diagnosis; to ensure, for a patient at risk, a preventive or post-treatment follow-up; to request specialized advice; to prepare a therapeutic decision; to prescribe products; to prescribe or carry out services or acts; or to monitor the condition of patients” (Art. L.6316-1 of the FPHC).

The following telehealth procedures are more specifically defined under the FPHC (Art. R.6316-1 and Art. L.6316-2 of the FPHC):

• Teleconsultation: it allows remote consultation between a medical professional (i.e., doctors, dental surgeons and midwives) and a patient, who might be assisted by any healthcare professional or a psychologist;
• Tele-surveillance: it enables a healthcare professional to remotely interpret the data necessary for the medical follow-up of a patient and, if necessary, make decisions regarding the management of the patient;
• Tele-expertise: it allows healthcare professionals to seek the opinion of other experts or healthcare professionals on their patient's pathology;
• Tele-assistance: it allows a healthcare professional to remotely assist a medical professional carrying out a medical procedure;
• Medical response: it corresponds to emergency telephone calls and is carried out within the framework of medical regulation;
• Tele-care: it enables remote care by allowing patients to connect with pharmacists or paramedics, as well as other professionals listed by Decree (e.g., nurses, audio-prosthetists, dieticians, medical laboratory technicians) using information and communication technologies. Tele-care activities are defined by Ministerial Order.

Are there specific fields of healthcare in relation to which telehealth services are currently available, and do they involve the use of proprietary technology or platforms?

Types of services

The French Public Health Code (“FPHC”) defines 6 categories of telehealth procedures: (i) teleconsultation, (ii) tele-surveillance, (iii) tele-expertise, (iv) tele-assistance, (v) medical response and (vi) tele-care (see section “Telehealth Availability” above for more information).

Professionals involved

Teleconsultations may only be carried out by medical professionals (i.e., doctors, dental surgeons and midwives), although the patient may be assisted by another healthcare professional or a psychologist during the teleconsultation.

Tele-surveillance, tele-expertise and tele-assistance can be used by all healthcare professionals in principle.

Tele-care can be practiced by pharmacists or paramedics, as well as other professionals listed by Decree (e.g., nurses, audioprosthetists, dieticians, medical laboratory technicians).

All such professionals must comply with the normative provisions relating to the conditions of practice of their profession, whatever their speciality or mode of practice (private, salaried or hospital).

Teleconsultation companies

The Social Security Financing Act for 2023 endorsed the adoption of a new accreditation regime applicable to teleconsultation companies in order to promote the coverage of the teleconsultation services they offer, under certain conditions:

• conditions of incorporation (e.g., specific approval, corporate purpose, company form),
• detention conditions (i.e., teleconsultation companies may not be under the control, in the sense of commercial law, of a natural or legal person exercising the activity of supplier, distributor or manufacturer of medicines, medical devices or medical devices, except for devices allowing the performance of a teleconsultation act);
• operational conditions (e.g., ensuring that their digital tools and services comply with the rules relating to the protection of personal data as well as the interoperability, security and ethical guidelines applicable to digital health services; proposing that teleconsultation procedures be performed by physicians they employ).

Information and communication technologies

Telehealth requires the use of information and communication technologies. Specific requirements apply depending on the type of telehealth service and device at stake.

In particular, the use of such technologies must be adapted to the clinical situations of patients and must guarantee the security of the data transmitted (confidentiality, protection of personal data), under conditions that comply with the interoperability frame of reference (from the CI-SIS) and security frame of reference (PGSSI-S) developed by ASIP Santé (Art. L. 1470-5 and L. 1470-6 of the FPHC).

The digital support used by healthcare professionals must also comply with the regulations relating to the hosting of health data in application of Article L. 1111-8 of the FPHC.

The Ministry of Health has further published a list of telehealth digital solutions with their safety scoring based on declarations made by solutions providers.

Does the public health system include telehealth services, and if so, are such services free of charge, subsidised or reimbursed? Where the public health system does not include telehealth services, are such services covered by private health insurance?

France runs a statutory health insurance system (“Assurance Maladie”) providing universal coverage for its residents. Most of the population (almost 95%) further has complementary private insurance (“mutuelle”).

The French public health system includes telehealth services, subject to applicable requirements. In particular:

• Teleconsultations
  Teleconsultations are reimbursed in the same way as a face-to-face consultations (i.e., up to 70% is covered by Assurance Maladie, with the remaining 30% generally covered by the insured person’s private complementary health insurance), subject to the fulfilment of 3 cumulative conditions:
• compliance with the coordinated care pathway (subject to limited exceptions);
• alternating consultations and teleconsultations. The patient must be known to the doctor performing the telehealth procedure and had at least one physical consultation with this professional during the 12 months preceding the online medical consultation;
• territoriality (geographical proximity between the doctor’s place of practice and the patient’s home), with exceptions in the case of difficulties in accessing care or insufficient supply of care.
• Tele-expertise
  Tele-expertise is billed directly to the Assurance Maladie by the healthcare professional and is covered at 100% by the Assurance Maladie. To date, it is billed at 20 euros per procedure (up to a limit of four procedures per year for the same patient) for the requesting physician, and 10 euros, again with the same annual limit, for the requesting physician. The agreement with the health insurance company provides for assistance with equipment.
• Tele-surveillance
  Two 2023 decrees established a permanent framework for tele-surveillance (i.e., remote medical monitoring) and a related protocol has been signed in March 2023 between was signed by the Minister of Health, the Snitem, France Biotech and France Digitale.
• Tele-care
  Tele-care procedures performed by speech therapists and orthoptists are reimbursed under the same conditions as in-person procedures.

Do specific privacy and/or data protection laws apply to the provision of telehealth services?

The processing of personal data, including health data, in the field of telehealth is governed by the General Data Protection Regulation (“GDPR”) as well as the law no. 78-17 of January 6, 1978, as last amended, the decree no. 2019-536 of May 29, 2019, as last amended, and specific provisions set forth under the French Public Health Code.

Depending on the telemedicine project, a legal analysis must be carried out, on a case-by-case basis, to identify the applicable legal framework precisely.

Please find below some of the key obligations:

• Formalities: In principle, the processing of personal data used for the implementation of telemedicine acts is not subject to any particular formality with the French data protection supervisory authority ("CNIL"). Indeed, depending on the context, this processing falls within the scope of processing necessary for preventive medicine, medical diagnosis, health care, management of health care systems and services, which do not require any formalities with the CNIL. The data must be processed by a health professional subject to an obligation of professional secrecy or by another person subject to an obligation of secrecy.
  
  By way of exception and depending on the nature of the data collected or the purpose of the processing, the processing of personal data for the implementation of telemedicine acts may give rise to a request for authorisation if it is carried out in the context of research in the health field. Depending on the nature of the research, the sponsor may either have to file with the CNIL an authorisation or a declaration of conformity to one of the reference methodologies (e.g., MR-001)

• Accountability/privacy by design: In any case, since the processing resulting from a telemedicine activity is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall carry out an analysis of the impact of the envisaged processing operations on its compliance with the abovementioned data protection legal framework prior to the processing (“DPIA”).
• Data subject rights: Data subjects of data collected through a telemedicine device should be able to exercise their rights effectively, in particular their rights of access, rectification and objection.
• Security:
• A strong authentication system must be put in place to recognise users and give them the necessary access. Sharing access is prohibited.
• A system for managing the authorisations of users of the telemedicine system must be put in place to limit access to only those data that are strictly necessary for the users. Differentiated levels of authorisation must be created according to the needs of the users.
• A system for managing traces and incidents must be put in place. The aim is to be able to identify fraudulent access or misuse of personal data or to determine the origin of an accident. The aim is to be able to react to a data breach.
• If the telemedicine system involves outsourcing, the security conditions laid down for the hosting of health data by Article L. 1111-8 of the Public Health Code must be respected.
• In addition, the data controller must implement all physical and logical security measures with regard to workstations, mobile computing, the internal computer network, servers, websites, archiving, maintenance, subcontracting, etc.

How should the cross-border transfer of personal information collected and processed in the course of telehealth services be carried out to ensure compliance with applicable privacy laws?

Any transfer of personal health data outside of the EEA should be carried out in full compliance with Chapter V of the GDPR. Chapter V prohibits the transfer of personal data outside of the EEA unless there are appropriate safeguards in place to govern the transfer (for further information, please refer to Data Protection Laws of the World – France).

The most common way to ensure the obligations of Chapter V are met is by incorporation of the Standard Contractual Clauses (SCCs) in the relevant service agreement / data processing agreement supplemented by a transfer impact assessment in accordance with the ruling of the CJEU in Schrems II Decision.

To be noted, the European Commission has published a new set of SCCs to be used for the transfer of personal data from EU to ‘third countries’ which do not benefit from an adequacy decision. The new SCCs require the data exporter and importer to warrant that they have carried out a transfer impact assessment in relation to the transfer, and that appropriate contractual, technical and organizational measures are in place to safeguard the data subject to the transfer. 

To be noted, since the CJEU’s Schrems II decision, the “CNIL” and, to some extent, French Courts have taken a restrictive approach with respect to the transfer of health data outside the EU, especially to the USA. The CNIL is pleading for storage of health data in EU, by EU entities.

Are there any currently applicable codes of conduct on the use of telehealth systems and/or security of telehealth data in your jurisdiction?

French authorities have further published guidelines to facilitate the implementation of telehealth. In particular:

• The French National Health Authority (Haute Autorité de Santé, the “HAS”) published a set of guidelines and specific information memo (e.g., a memo intended for professionals on teleconsultation and tele-expertise, a good practice guide on teleconsultation and tele-expertise, a good practice guide on tele-care, information sheet intended for patients regarding teleconsultation and tele-care);
• The French National Health Insurance (Assurance Maladie) published a Charter of teleconsultation good practices.

Are any specific laws, regulations, or self-regulatory instruments expected to be adopted in the near future?

Several laws, regulations and guidelines are expected to be adopted in the near future:

• Implementing texts have yet to be adopted concerning the new accreditation regime for teleconsultation companies;
• Conditions for reimbursement of telehealth procedures may evolve annually through the adoption of annual Social Security Financing Acts (Lois de Financement de la Sécurité Sociale);
• French authorities’ guidelines related to telehealth may further be regularly updated;
• Finally, further telehealth procedures may be recognized, or existing telehealth procedures may further be specified, under the French Public Health Code as professionals and patients rely more and more on telehealth as part of the usual healthcare pathway.