Healthcare professionals & institutions

Electronic signature for healthcare professionals

Informed consent, patient record, advance directives, inter-institutional agreements: digitise the sensitive signatures of your institution with a GDPR-compliant platform, compatible with medical confidentiality and integrable with your hospital information system. French hosting, end-to-end encryption, timestamped audit trail.

Signature électronique santé — établissement médical moderne

HDS certification in progress

Certyneo is not yet certified as a Health Data Host (HDS — Hébergeur de Données de Santé). This certification is currently being obtained. For any processing of personal health data within the meaning of Article L. 1111-8 of the French Public Health Code, please verify regulatory compliance with your DPO before deployment.

Learn more about our security roadmap →

What are the healthcare use cases for electronic signatures?

From informed consent to inter-institutional agreements and advance directives, every signed deed in a healthcare institution can be digitised.

Informed consent

Free, informed and revocable consent from the patient before a medical procedure, surgery, experimental treatment or participation in research (Article L1111-4 of the French Public Health Code). Timestamped signature with full audit trail.

Electronic patient record

Patient validation of information in a medical record, updates to allergies and medical history, consent to sharing with other healthcare professionals. Full traceability of signed versions.

Medical care

Consent to treatment, to a therapeutic protocol, to a coordinated care pathway. Mobile-friendly signature suited to patients on the move or in hospital.

Advance directives

Patient's advance directives regarding end of life (Claeys-Leonetti Act of 2 February 2016). Remote signature with strong identification, retained for ten years, revocable by the patient at any time.

Inter-institutional agreements

Cooperation agreements between healthcare institutions (public-private, Hospital Territorial Groups, care networks), medical services agreements, private practice contracts within an institution.

Supplier and subcontractor contracts

Contracts with lab service providers, medical device suppliers, cleaning subcontractors in sterile environments: the entire administrative back office of a healthcare institution.

Why choose Certyneo for healthcare?

Six concrete guarantees tailored to the requirements of medical confidentiality and the evidentiary level expected in healthcare.

Hosting in the European Union

Certyneo hosts all data in the European Union (IONOS), in facilities that meet ISO 27001 security standards. No transfer outside the EU, no CLOUD Act exposure.

Enhanced confidentiality

TLS 1.3 in transit, AES-256 at rest, strict data isolation per organisation. The level of protection is compatible with the medical-confidentiality requirements set out in Article R4127-4 of the French Public Health Code.

Advanced signature (AES)

Strong patient identification through an SMS OTP, unique link with the signed deed, detection of any subsequent modification. An evidentiary level compatible with informed-consent requirements.

Polished patient experience

Journey available in multiple languages, WCAG AA accessible, smartphone-friendly, with no account creation and no app to download. The patient signs in two minutes from their phone, at home or from their hospital room.

Ten-year probative archiving

Duration aligned with medical record retention obligations (20 years for some documents, extended on request). Audit trail embedded in the PDF, exportable at any time for handover to a colleague or a regional conciliation commission.

Documented edge cases

Electronic signatures are not always appropriate: patients in life-threatening emergencies, unconscious patients, minors without a representative. Our documentation addresses these cases explicitly and proposes alternative journeys (third-party-assisted signature, deferral after stabilisation).

SIH, DMP and business software integrations

Certyneo sits upstream of existing healthcare information systems: it collects signatures and the signed document is then routed to your hospital information system, electronic patient record or national DMP through the usual channels.

Generic SIH & DPI

Hospital information systems (DxCare, Cristal-Link, Hopital Manager, Easily, etc.) can trigger the sending of a Certyneo envelope through our REST API or webhooks whenever a document is ready to sign in the patient record.

DMP & My Health Space

Certyneo does not replace the DMP: it sits upstream to collect patient consent or sign clinical documents. The signed document can then be uploaded into the DMP through your institution's usual tool.

Private practice software

Medical practice software (Doctolib Siilo, Weda, HelloDoc, AxiSanté, etc.): integration through webhooks and Zapier/Make, especially for fee agreements, optical/dental quotes and consent before non-reimbursed procedures.

Specific integration project? Book a call with our team. The Certyneo API is publicly documented at our API documentation.

HDS, GDPR and medical-confidentiality compliance

Health data is among the most sensitive and most tightly regulated in Europe. Certyneo applies the entire applicable framework, transparently — including its current limits.

Health Data Hosting (HDS)

Certyneo is not an HDS-certified host to date. For documents containing personal health data, we recommend that the relevant institutions discuss a dedicated deployment with a partner HDS host — our roadmap includes HDS certification in the second half of the year. For signatures that do not contain health data (inter-institutional agreements, supplier contracts, HR), Certyneo is suitable out of the box.

GDPR & health processing

Article 9 of the GDPR classifies health data as sensitive. Certyneo applies strict minimisation (only the metadata required for signing is stored), systematic encryption, a standard DPA including a preliminary impact assessment, and an up-to-date processing register.

Medical confidentiality — Article R4127-4 CSP

Medical confidentiality applies to every doctor and to everyone who works with them. Certyneo applies strict data isolation per organisation, end-to-end encryption and exhaustive access logging — every technical prerequisite to preserve medical confidentiality during the signing phase.

Informed consent — Article L1111-4 CSP

Consent must be free, informed and revocable. Certyneo's advanced electronic signature guarantees patient identification, precisely timestamps their consent (to start withdrawal or reflection periods) and supports subsequent revocation through a new counter-envelope tracked in the history.

HIPAA Privacy & Security Rules (45 CFR Part 160-164)

The Health Insurance Portability and Accountability Act regulates protected health information (PHI) in the US. HIPAA's Security Rule requires administrative, physical, and technical safeguards equivalent to the European HDS certification: access controls, audit logs, encryption in transit, and integrity controls — all of which Certyneo's pipeline implements. Business Associate Agreements (BAAs) are signed on demand for healthcare clients processing PHI.

21 CFR Part 11 — FDA electronic records

The FDA's regulation for electronic records and electronic signatures applies to pharmaceutical, biotech, and medical-device companies submitting data to the agency. Part 11 requires identity verification, audit trails immune to tampering, and signatures that are the legal equivalent of handwritten signatures. Certyneo's PAdES-LT signatures with qualified timestamps satisfy the technical controls; the regulated entity remains responsible for the procedural controls (training, SOPs, system validation).

HITECH Act & meaningful-use

The Health Information Technology for Economic and Clinical Health Act strengthens HIPAA enforcement and incentivises certified EHR adoption. Electronic signatures on consent forms, prescriptions, and clinical documentation feed directly into meaningful-use criteria. Certyneo's REST API integrates with major EHRs (Epic, Cerner, Allscripts) via FHIR-compatible webhooks for documents that need to round-trip back into the patient record.

Electronic signature guide·eIDAS guide·Certyneo security·Roadmap (HDS)

How to sign a healthcare document online?

Consent forms, agreements, advance directives: electronic signing saves precious time for care teams and patients alike, while producing timestamped, enforceable evidence. Here is how to sign a healthcare document online in four steps.

1
Upload the healthcare document
Upload the consent form, agreement or certificate as a PDF or Word file. The document is encrypted on upload and its cryptographic fingerprint is computed to guarantee its integrity.
2
Add the signers
Patient, practitioner, legal representative or institution: each signer receives an email invitation and signs from their phone or computer, without creating an account.
3
Choose the signature level
For a binding healthcare document (informed consent, inter-institution agreement), prefer the advanced signature (AES): the signer is authenticated with an SMS OTP code before signing.
4
Retrieve the signed document and its audit trail
The signed PDF is sealed, timestamped and comes with a full audit trail (identities, OTP codes, timestamps). Keep it for the legal retention period that applies to the document.

Healthcare documents you can sign online with Certyneo:

Frequently asked questions from healthcare professionals

Is Certyneo certified for Health Data Hosting (HDS)?

At the time this page was published, Certyneo is not an HDS host. For documents containing personal health data, we recommend that the relevant institutions discuss the most suitable scenario with our team (dedicated deployment through a partner HDS host, or limiting use to documents with no health data). HDS certification is on our public roadmap.

Does electronically signed informed consent carry the same weight as paper consent?

Yes. Article L1111-4 of the French Public Health Code requires free, informed and revocable consent but prescribes no particular form. Article 1367 of the Civil Code recognises electronic signatures as equivalent to handwritten signatures provided they rely on a reliable process — which Certyneo's advanced signature (AES) delivers.

How does Certyneo protect medical confidentiality?

TLS 1.3 in transit, AES-256 at rest, strict data isolation per organisation, no clear-text access by our teams without documented escalation. Certyneo does not store the medical content itself (beyond what is in the PDF): only the metadata required to manage signatures (envelope identifier, emails, timestamps) is kept in the database.

Can advance directives be signed electronically?

Yes. The Claeys-Leonetti Act of 2 February 2016 and Article L1111-11 of the French Public Health Code allow advance directives to be drafted freely, with no required form. An advanced electronic signature timestamped with strong patient identification meets the evidentiary requirements — directives of course remain revocable at any time through a new envelope.

Can we integrate Certyneo with our SIH or DPI?

Yes. Certyneo exposes a documented REST API (see /docs) and real-time webhooks. DxCare, Cristal-Link, Hopital Manager, Easily and other SIH platforms can trigger the sending of envelopes when a patient document is ready to sign. Zapier and Make connectors also cover private practice software.

How do we handle patients without email or smartphone?

Certyneo offers an "in-person signing" mode: the healthcare professional uses their own tablet or workstation to have the patient sign, with identification through an SMS OTP sent to the patient or validation by a trusted third party (carer, caregiver). The audit trail retains the context of the signature.

How long are signed medical documents retained?

Our plans include ten-year probative-value archiving. For medical documents requiring longer retention (20 years for some types of hospital file, 28 years for transfusion records, lifetime for some imaging) extended archiving is available on request. Documents remain downloadable at any time.

What should we do if a patient wants to revoke their consent?

The right to revoke consent is central in healthcare. In practice, you create a new revocation envelope signed by the patient, which is timestamped and linked to the original consent. The case history clearly shows both acts (consent, then revocation), which fully documents the situation in the event of a dispute.

Collect your next informed consent in five minutes

Create your free account and send your first consent form today. No credit card, no commitment.