France has adopted two decrees in July related to the sharing of patients' data: (1) Decree No. 2016-914 of 4th July 2016 related to the shared medical record; and (2) Decree No. 2016-994 of 20th July 2016 related to the conditions of exchange and sharing of information between health professionals and other medico-social professionals. The new Shared Medical Record (SMR) The idea of creating a medical record that would be shared by health professionals to promote coordination, quality and continuity of care is not new in France. The scheme of "personal medical record" (dossier médical personnel) was set in place in 2004 (by Law No. 2004-810 of 13th August 2004 on health insurance), but its deployment faced many obstacles, and it is only in 2016 that it was finally revived, amended and renamed by Law No. 2016-41 dated 26th January 2016 entitled "Modernizing our national health system". The personal medical record has been renamed to "shared medical record" (dossier medical partagé). The SMR is a digital medical record that is designed to promote prevention, quality, continuity and a coordinated management of patient care. All beneficiaries of the National Health Insurance have the right to hold an SMR. The SMR has now been transferred to the responsibility of the National Fund for Employees Health Insurance (Caisse Nationale d’Assurance Maladie des Travailleurs Salariés - CNAMTS), which acts as the data controller under the meaning of applicable data protection laws. In this regard, the CNAMTS must monitor compliance of the SMR with the requirements related to the hosting of health data set out by the French Agency for Shared Information Systems in Healthcare (“ASIP SANTE”) -- which was previously in charge of the DMP and had been authorized in 2010 by the French Data Protection Authority (the "CNIL") to implement the data processing required for the first deployment phase of the personal health record. The Decree of July 4th lists the categories of data contained in the SMR, among which are data related to the identity and identification of the holder, contact details of the holder’s legal representatives and relatives who must be informed in case of emergency, contact details of the patient’s referring physician, and the updated list of health professionals who are allowed to access the SMR and those whose access has been expressly blocked by the holder. Access to the SMR by health professionals is subject to the holder's consent. The Decree specifies the scope of the access rights granted to these health professionals, and notably that: • access shall be deemed given to all of the patient's care team; • persons acting under the responsibility of the health professional shall also access the SMR to fill in the name of the health professional; • the holder's referring physician shall always have access to all of the data stored in the SMR, even those that the holder shall have marked as non-accessible. At this stage, the degree of information and control that the holder shall have on the complete list and identity of the persons who will access his/her record is still unclear. Procedures and guidelines to be set out by the CNAMTS should answer such concerns. In addition, the Decree of July 4th makes no reference to the rights (to be informed, to rectify and to object to the processing of their personal data) of the persons who will be mentioned in the SMR, such as the holder’s legal representatives, trustee person and relatives to be informed in case of emergency, or to the obligations of the service providers involved in the SMR system as data processors. One could hope for practical recommendations from the CNIL in this regard. A sharing extended to non-health professionals The Decree of 20th July 2016 authorizes the sharing of patient's data between health professionals (as defined in part 4 of the Code of Public Health) and another category of professionals, who are listed in the Decree (which amends the Article R.1110-2 of the Code of Public Health), but are not health professionals. This second category includes, in particular, social service assistants, osteopaths, chiropractors, psychologists and psychotherapists who are non-health professionals, medical and psychological assistants and educational and social assistants, nursery assistants and family assistants, youth and family workers, specific employees working in youth centers, individuals accommodating elderly and disabled people, proxies for legally protected adults and family benefits delegates. These two categories of professionals shall have the right to exchange information about their mutual patients (i) provided that the information is strictly necessary for the coordination and the continuity of healthcare, the prevention or the medico-social and social follow-up of the patient and (ii) provided that they are within the limits of their respective assignments. The exchange of information between a health professional and a professional belonging to the other category is allowed provided that the data subject was given prior information of the nature of the information to be exchanged and the identity of the recipient and the category to which he/she belongs, or the profession that he/she exercises in a defined facility. Specific provisions shall apply as regards prior information when the data subject cannot express his/her consent. Some representatives of doctors worry about the impact of the Decree on medical secrecy and fear that the information sharing between the aforementioned professionals will lead to an uncontrolled spread of such information. However, according to the Ministry of Health, the Decree should be considered as a step forward, as it will frame, in the patient's interest, an informally existing practice and will improve patient's care. For more information, please contact Magalie Dansac Le Clerc.