Medical confidentiality and information sharing: practical guide

Introduction

Medical confidentiality constitutes one of the fundamental pillars of the relationship of trust between a patient and healthcare professionals. However, in a context of coordinated care and multidisciplinary teams, the question of sharing confidential information arises daily. How can we reconcile the absolute obligation of confidentiality with the need to exchange data to ensure optimal care? This practical guide clarifies the legal framework of medical confidentiality and the conditions under which information sharing is legally authorised, based on the provisions of the French Public Health Code and the recommendations of the CNIL.

The legal foundation of medical confidentiality

Medical confidentiality is established by article L.1110-4 of the French Public Health Code and by article 226-13 of the French Criminal Code, which penalises its breach with one year's imprisonment and a fine of 15,000 euros. This confidentiality covers all information that comes to the knowledge of the professional: diagnosis, treatment, patient confidences, as well as elements observed or deduced.

It is binding on all professionals working in the healthcare system: doctors, nurses, pharmacists, midwives, but also administrative staff in healthcare establishments. The Law of 26 January 2016 on the modernisation of our healthcare system extended this obligation to medico-social sector professionals, creating a unified framework for protecting confidential information.

Conditions for information sharing between professionals

Information sharing between healthcare professionals is governed by article L.1110-4 of the French Public Health Code. Two distinct situations must be distinguished:

Within the same care team: sharing is presumed to be authorised, provided that the patient has been informed and can exercise their right to object. The care team is defined as a group of professionals directly involved in the care of the same patient.

Between professionals not belonging to the same team: express and prior patient consent is required, obtained by any means, including electronic means. This consent must be informed, specific and revocable at any time.

Sharing must in all cases be limited to information strictly necessary for coordinating or continuing care, in accordance with the minimisation principle set out in the GDPR (article 5).

Legal exceptions to confidentiality

Certain situations authorise, or even require, the lifting of medical confidentiality. The reporting of abuse of minors or vulnerable persons (article 226-14 of the French Criminal Code), the mandatory declaration of notifiable diseases (article L.3113-1 French Public Health Code), or the transmission of information to the Sickness Insurance doctor are exceptions provided for by law.

On the other hand, the patient's family does not have a general right of access to medical information. Only the person of confidence designated by the patient (article L.1111-6 French Public Health Code) may receive certain information, according to their expressed wishes.

Tools and best practices

The implementation of the Shared Medical File (DMP) and the Secure Health Messaging System (MSSanté) makes it possible to technically secure exchanges. Establishments must also adopt a health information system security policy (PSSI-S) and designate a Data Protection Officer (DPO), in accordance with the GDPR.

Conclusion

Medical confidentiality is not an obstacle to the quality of care but a condition for patient trust. Mastering the rules of confidential information sharing enables healthcare professionals to collaborate effectively whilst respecting their deontological and legal obligations. Regular training of teams and clear information to patients are essential to secure these practices.