Patient Call Confidentiality: Rules for French Practices

Patient call confidentiality rests on one principle: whatever a caller says to a medical practice, and whatever the practice says back, is covered by professional secrecy and must be handled on a strict need-to-know basis. In practice, this means four things: controlling who answers the phone and what they can see, verifying who is calling before any information is shared, informing patients when a call is recorded, and moving data afterward through secure channels rather than ordinary email or fax. This guide sets out how each of these works in a French practice, and what changes when the telephone reception is outsourced.

Key takeaways

• Professional secrecy covers everything a practitioner has seen, heard or understood, and in France it is also a patient’s legal right under the Public Health Code.
• A secretary, in-house or outsourced, needs access to administrative data such as appointments, not to clinical records, unless formally part of the care team.
• Patients must be told at the start of a call if it is recorded, and the purpose of the recording must be defined.
• Misdirected messages and faxes remain a leading cause of breaches, so secure messaging should replace standard email and fax for nominative medical data.
• Outsourcing reception is compatible with confidentiality when the provider is bound by a clear contract, trained staff and traceable procedures.

Table of Contents

• Why the telephone is a confidentiality risk
• The legal foundation: professional secrecy in France
• Need-to-know access: what a secretary may see
• Verifying the caller before sharing anything
• Call recording: information, purpose and retention
• The physical environment of the call
• After the call: secure follow-up and messaging
• Outsourcing the phone: what to demand from a provider
• Our perspective: confidentiality is a process, not a feature
• How ClicFone supports confidential call handling
• A checklist for the practice’s phone
• FAQ
• Sources

Why the telephone is a confidentiality risk

The telephone is often the first point of contact between a patient and a practice, and it is also the least controlled. A caller may describe symptoms, name a medication or explain a diagnosis within seconds of the first greeting. The person answering may be in a waiting room, at a reception desk shared with other staff, or at home. Each of these settings creates a possibility that a third party overhears something that should have remained between the patient and the care team.

The risk is rarely dramatic. It is usually made of small, repeated situations: a patient’s name said aloud at a crowded desk, a callback message left on a family answering machine, a request for test results from a caller whose identity was never checked, or a list of appointments forwarded to the wrong address. Taken individually, each looks minor. Taken together over thousands of calls a year, they define whether a practice can honestly say that its patients’ information is protected.

The telephone can also act as an intelligent filter. A well-organized call process sorts requests by urgency, separates administrative needs from clinical ones, and ensures that only the information necessary for each step is collected and passed on. Confidentiality and efficient call handling are therefore not opposing goals: a structured process serves both.

The legal foundation: professional secrecy in France

In France, medical confidentiality is not only an ethical expectation. The Public Health Code, in its article L.1110-4, makes it a right of the patient, as the Conseil national de l’Ordre des médecins explains in its commentary on the code of ethics. The same commentary stresses that secrecy extends to everything the physician has seen, heard, understood or even deduced, including negative findings.

The code of medical ethics states the duty from the practitioner’s side. Article R4127-4 of the Public Health Code provides that professional secrecy, established in the interest of patients, binds every physician under the conditions set by law. The practical consequence for a practice is that the duty does not stop at the consulting room door. Staff who handle calls, appointments and messages work inside the same circle of confidentiality, and the physician remains answerable for how that circle is organized.

Three questions help a practice test its organization:

1. Does every person who answers calls understand that the information they hear is covered by secrecy?
2. Is the information they can access limited to what their role requires?
3. Can the practice show, if asked, how a given call or message was handled?

If any answer is uncertain, the telephone process deserves attention before any technology is added.

Need-to-know access: what a secretary may see

A recurring misconception is that anyone working in the practice can consult any patient file. The opposite principle applies. According to the guidance from the French digital health agency on Mon espace santé and the shared medical record (DMP), access depends on participation in the patient’s care, and administrative staff may handle the administrative data needed for their tasks, such as scheduling, but not the clinical content unless they are specifically authorized as part of the care team. Individual authentication, with professional cards, is what makes each access traceable.

For telephone reception, this principle has a concrete meaning. The person answering needs the patient’s identity, the type of appointment requested, the practitioner concerned, and the available slots. The person does not need the patient’s diagnosis, treatment history or test results to book a follow-up visit. A well-designed process therefore keeps the scheduling agenda and the clinical record separate, and gives the reception role access only to the first.

The same logic governs exceptional access. The CNIL’s reminder on patient record security, published on 9 February 2024 after formal notices were served on several healthcare establishments, explains that ‘break-glass’ access, intended for urgent situations, must be traced, monitored and justified. Automatic logging that flags unusual activity, such as a large number of records opened or frequent emergency overrides, is recommended. For a small practice, the lesson is simple: every access to a record should leave a trace, and an emergency override should never become a habit.

On the question of limiting staff access to patient information, this article on organizing medical records (in Spanish) offers a complementary perspective from the point of view of patients managing their own files.

Verifying the caller before sharing anything

A confidentiality policy is only as strong as its first question: who is calling? The caller may be the patient, a relative, a caregiver, a pharmacist, a colleague or someone with no legitimate interest. The French health authority makes the point clearly in the context of medical regulation. In its guidance on prescriptions by telephone, it notes that the physician may not know the patient and that the caller may not be the patient. The same guidance asks the physician to have the caller reformulate instructions to confirm they were understood, and recommends secure channels rather than fax for transmitting a written prescription to a pharmacy.

Although that guidance concerns medical regulation, its logic applies to any practice that answers calls. A reasonable identity check at reception is built on a few habits:

• Ask the caller to state the patient’s full name and date of birth rather than reading them back.
• Share only what is necessary: confirming that an appointment exists is different from reciting its reason.
• Never leave detailed information on voicemail or with a third party who has not been authorized by the patient.
• Offer to call back on the number held in the patient file when a request is sensitive.
• Record in the file that the check was made, and by whom.

The practice also benefits from a written rule for relatives. Patients can say, once, who may receive information about appointments, and the rule is then applied consistently by everyone who answers the phone, whether in the practice or at a remote service. For a deeper look at this subject, ClicFone has published a guide on identity verification by phone in a clinic setting.

Call recording: information, purpose and retention

Recording calls is common in remote medical regulation and tele-secretary work. According to the HAS, as cited above, recording serves to secure the information entered, support training and quality improvement, and handle possible disputes, and patients must be informed of the recording at the start of the call, typically through a short announcement before the conversation begins.

For a practice, this translates into several decisions, each of which should be documented:

Recordings of health-related calls are health data in the wider sense, so they fall under the general data protection framework. The European Data Protection Supervisor stresses that the confidentiality of electronic communications must be protected on all publicly accessible networks, including those offered by hospitals and medical centers. Any processing of health data requires the controller to be able to demonstrate GDPR compliance through internal measures such as impact assessments and a register of processing activities. ClicFone has detailed the practical steps in its guides on secure call recording and Article 28 under GDPR and on the three GDPR steps French clinics must take for medical calls.

For practices that want a structured way to keep their register of processing, impact assessments and incident log in one place, this GDPR explainer from a Swedish compliance platform gives a clear overview of why the regulation exists and what it requires.

The physical environment of the call

Confidentiality is also a matter of space. The HAS recommendations on medical regulation specify that the regulation room must be dedicated, with restricted access and soundproofing, so that unauthorized persons cannot hear sensitive patient information. A private practice is not a regulation center, but the principle carries over.

In a consulting practice or a multidisciplinary health center (maison de santé), a few arrangements make a real difference:

• Position the reception desk so that waiting patients cannot hear a caller’s details.
• Keep screens showing the agenda out of sight of visitors.
• Avoid speakerphone for calls that involve health information.
• Give calls about test results or sensitive appointments to a person who can take them in a closed room.
• Keep reception staff from handling calls in open areas shared with other tenants.

These measures cost little and solve the most common source of accidental disclosure: being overheard. Many practices also find that moving the bulk of call handling to a remote team trained for the task removes the issue at the source, since the calls no longer take place in the waiting area at all.

After the call: secure follow-up and messaging

The conversation is only half of the exchange. The information gathered must then reach the practitioner, and this transfer is where many breaches occur. The CNIL’s guidance on health data, email and fax states that email and fax are not, in principle, a secure means of sending nominative medical data, and that a simple handling error, such as a wrong address or a misdialed number, can expose it. Mitigations include pre-registered address books and a visual check of the recipient before sending.

For telemedicine, the CNIL recommends that professionals prioritize certified secure messaging over standard email or fax. If ordinary email has to be used, files containing patient data must be encrypted before being attached, and personal email accounts should not be used for professional medical exchanges.

A practical summary for call follow-up:

1. Capture only the data needed to act on the call.
2. Transmit it to the practitioner through secure messaging or directly into the agenda.
3. Avoid free-text details in channels that are not designed for health data.
4. Use an address book of verified recipients rather than typing addresses by hand.
5. Review misdirected-message incidents regularly, and treat every near miss as information.

ClicFone documents this topic in a dedicated guide on secure messaging after calls for French secretariats, written with the CNIL and ANS expectations in mind. Practices that send appointment reminders by text can also consult the guide on GDPR-compliant text appointment reminders.

Outsourcing the phone: what to demand from a provider

Handing telephone reception to an external service does not transfer the practitioner’s duty of secrecy. The practice remains responsible, so the choice of provider is a confidentiality decision as much as an organizational one. A sound evaluation covers the following points:

• A written contract defining roles, purposes, security measures and the handling of recordings. The guide on the data processing agreement for medical answering services explains what such a contract should contain.
• Trained staff. Operators who work every day with medical calls recognize urgency, know which questions are appropriate and understand why a diagnosis should never be repeated on an open line.
• Role-limited access. The provider should work in the agenda, not in clinical records.
• Traceability. Every call, note and booking should be attributable and retrievable.
• Compatibility with the practice’s tools. The provider should work inside the calendar platform already in use rather than asking staff to copy data between systems.
• Transparency on AI. When automated tools answer calls, the practice should know when, for what and with which safeguards.

The point on contracts deserves emphasis. Under GDPR, an organization that processes health data on behalf of a practice acts as a processor, and the practice must be able to show it chose one that offers sufficient guarantees. The ClicFone guide to GDPR phone call rules for medical practices and the one on call recording rules are useful companions for that discussion.

Our perspective: confidentiality is a process, not a feature

After more than 15 years working with medical and paramedical professionals, and after handling hundreds of thousands of calls, we have reached a conviction: confidentiality fails less often through technology than through habits. A missing identity check, a message left in the wrong place, a conversation held where others can hear it: these are the usual causes.

For that reason, we organize our service around people who are trained specifically for healthcare calls, supported by AI that extends availability to every hour of the day. Human operators bring judgment: they recognize when a request is urgent, when a caller hesitates about who they are, and when a question should go to the practitioner instead of being answered at reception. The AI component brings consistency, so that a patient calling late in the evening receives the same professional treatment as one calling at mid-morning.

We also believe that a practice should keep control. Our service synchronizes with the calendar platforms that practitioners already use, including Doctolib, LibreRDV, Maiia and CalenDoc, so that appointment data lives where the practice expects it. Our offers are flexible and carry no commitment, because a practice should be able to judge a service by its results and not by the length of its contract. More than half of our clients have stayed with us for over ten years, and we take that as evidence that trust is built on discretion, repeated every day.

The practical advice we give to any practice, whether or not it works with us, is to write down the rules for its telephone: who may receive what information, what is recorded, how callers are identified, and how messages travel. A short, clear document applied consistently does more for confidentiality than any tool.

— Rudolph Thierry

How ClicFone supports confidential call handling

For practices that want to delegate reception without weakening confidentiality, ClicFone offers remote medical telephone secretarial services in which trained operators answer calls, book appointments in the practice’s calendar and route requests according to urgency. Practices concerned with urgent requests can look at medical phone triage, and those with seasonal peaks at call and appointment management. To discuss the confidentiality framework applicable to a specific practice, the ClicFone website is the place to start.

A checklist for the practice’s phone

The measures described above can be turned into a short review that a practice can complete in an afternoon:

A review of this kind also prepares the practice for questions from patients or supervisory authorities. A practice that can show how it handles its calls is in a far stronger position than one that relies on good intentions.

FAQ

What is the difference between confidentiality and privacy?

Privacy is the patient’s broader right to control personal information and to be left undisturbed. Confidentiality is the duty of those who receive information in the course of care to keep it secret. In France, the second is expressed as professional secrecy, which the Public Health Code protects as a patient right.

Can a medical secretary access a patient’s medical record?

Only within the limits of the role. According to French digital health guidance, administrative staff may access the administrative data needed for tasks such as scheduling, but not clinical content in the shared medical record unless they are authorized as part of the care team. Each access should be individually authenticated and traceable.

Do patients have to be told that a call is recorded?

Yes. In medical regulation, the HAS indicates that patients must be informed of the recording at the start of the call, normally through a short announcement. The practice should also define the purpose of the recording, who may listen to it and how long it is kept.

Is it safe to send patient information by email or fax?

Not by default. The CNIL considers that standard email and fax are not secure enough for nominative medical data, because of interception and misdirection risks. Certified secure messaging is preferred, and any file sent by ordinary email should be encrypted first.

Does outsourcing the phone line transfer responsibility to the provider?

No. The practitioner remains bound by professional secrecy and must choose a provider that offers sufficient guarantees, set out in a written contract. The provider should work with limited access, trained staff and traceable procedures.

Sources

• Conseil national de l’Ordre des médecins: Article 4, professional secrecy
• Légifrance: Article R4127-4, general duties of physicians
• ANS / esante.gouv.fr: Mon espace santé and data protection
• CNIL: patient record security measures (2024)
• HAS: prescription by telephone in medical regulation
• European Data Protection Supervisor: ePrivacy rules
• HAS: recommendations on medical regulation
• CNIL: health data, email and fax
• CNIL: telemedicine and patient data protection

Recommended

• Confidentiality Agreements for Medical Secretaries in France: 3 Musts
• 3 Ways to Make Verbal Consent Auditable in French Healthcare
• Secure French Clinic Call Recording: 5 Steps to GDPR and Article 28
• 5–20 Year Call Log Retention in France: CNIL Rules for Medical DPOs

LibreRDV-ClicFone Télésecrétariat

ClicFone Télésecrétariat depuis 2010 au service des professionnels de la santé. Permanence téléphonique 7h/20h. Secrétariat téléphonique à distance pour médecins, paramédicaux ou autres praticiens de la santé. Secrétariat humain, empathique et formé aux agendas Doctolib, Maiia, CalenDoc ou LibreRDV mais aussi synchronisé avec Google Agenda, Calendly et Cal.com

See Full Bio

CalenDoc Doctolib Maiia LibreRDV ClicFone Télésecretariat Secretariat téléphonique Permanence téléphonique Médical