What Is Health Data?
What You Need to Know About Health Data
Definition
This refers to any information relating to a person’s physical or mental health.
This includes, for example, the following information:
- information used to identify a person for health purposes (number, symbol, etc.)
- information related to tests or examinations, including genetic and biological data
- information regarding diseases, symptoms, treatments, disabilities, medical history, etc.
This data is sensitive and is subject to specific regulations
The main provisions regarding health data are as follows:
- Data Protection Act (Art. 8 and Chapter IX)
- Provisions on confidentiality (Art. L. 1110-4 of the CSP)
- Provisions regarding security and interoperability standards for health data (Art. L. 1110-4-1 of the CSP)
- Provisions on the hosting of health data (Art. L. 1111-8 and R. 1111-8-8 et seq. of the CSP)
- Provisions on the Provision of Health Data (Art. L. 1460-1 et seq. of the CSP)
- Prohibition on the transfer or commercial use of health data (Art. L. 1111-8 of the CSP, Art. L. 4113-7 of the CSP)
What are the main rules to follow?
Your digital service must be designed to comply with certain requirements specific to the sensitivity of health data.
The data subject—particularly the patient—has fundamental rights in addition to those provided for by the French Data Protection Act, which must be taken into account from the very beginning of the project’s design:
- The right to information prior to treatment and to consent to treatment;
- The right to privacy and confidentiality of information (professional confidentiality);
- Right of access to all information concerning their health.
- The security of health data must be ensured (link to PGSSI-S fact sheet)
- Access to health data must be strictly regulated, particularly the exchange and sharing of health data
To learn more...
Health data is not used solely for the purpose of patient care. It can also be used for secondary purposes, such as research, algorithm evaluation, health system management, and innovation.
This framework is evolving with the introduction of the European Health Data Space (EEDS), which is scheduled to take effect by March 2029. It provides for regulated, secure, and transparent access to data through a single point of contact.
👉 Learn more about the secondary use of health data
Learn more
Practical Guide
Health Data: Watch Out for False Friends
Some data may not appear to be health-related, but it becomes personal health information when combined with other data or when used for medical purposes.
Even without a name, a person can be identified—particularly if you collect multiple pieces of information about them (for example, date of hospital admission, date of discharge, and initials).
The Major Challenge of Health Data Protection
Health data protection is a critical issue in the age of big data, where algorithms to aid diagnosis and improve the patient care journey through information technology are rapidly advancing. All these innovations rely on health data. Therefore, it is imperative to establish a framework for the use, processing, and collection of this personal data.
The GDPR (General Data Protection Regulation) provides a broad definition of health data. According to the CNIL (National Commission on Informatics and Liberties), personal health data is data relating to the past, present, or future physical or mental health of a natural person that reveals information about that person’s state of health.
In light of this definition, it is essential—when collecting or processing such data using a service or IT tool—to comply with applicable laws and ensure the protection of this personal data.
G_NIUS provides the keys
The G_NIUS platform provides you with the tools to understand and apply the legal framework for processing health data to your project by outlining the key obligations related to health data. What does the law say? What are users’ rights? What rules must be followed?
Since the CNIL is a major partner of G_NIUS, you’ll find here a practical guide to help you grasp the fundamentals of protecting this data within the context of your innovation projects, ensuring that patients’ rights in this area are respected.
G_NIUS offers educational fact sheets on these topics—including the GDPR—through its regulatory services. You can also find a fact sheet on the secondary use of health data.
You’ll also find episodes of the “100 Days to Success” podcast on the processing of health data in research (featuring an expert from the Health Data Hub), as well as an episode providing you with the tools you need to ensure compliance with CNIL regulations when processing health data.