A data processing agreement (DPA) is the written contract that GDPR Article 28 requires between a medical practice and any answering service that handles patient calls on its behalf. In France, the practice is the controller, the answering service is the processor, and the contract must set out what is processed, for how long, under which instructions and with which safeguards. The sections below explain what the document contains, how health data changes the requirements, when French HDS hosting rules apply, and which checks a practitioner can make before signing.
Key Takeaways
- A practice that outsources calls and appointment scheduling remains the controller. The answering service acts as processor and may act only on the practice’s documented instructions.
- The CNIL expects the contract to define the subject matter, duration, nature, purpose, categories of data and categories of data subjects, adapted to the real service.
- Health data is a special category under GDPR Article 9, so confidentiality, security measures, breach notification and the return or deletion of data deserve precise wording.
- Subprocessors, data location, transfers outside the European Union and retention periods should be reviewed across the whole chain, backups included.
- Outsourced appointment scheduling belongs in the practice’s record of processing activities, whatever the contract says.
Table of Contents
- Why an answering service needs a data processing agreement
- Controller and processor: who is who in a medical practice
- What the agreement must contain
- What health data changes
- HDS: when French hosting rules apply
- Subprocessors, location, transfers and deletion
- What stays with the practitioner
- Our perspective
- Outsourced phone reception built for health professionals
- FAQ
- Sources
Why an answering service needs a data processing agreement
A medical answering service hears names, phone numbers, reasons for consultation and sometimes symptoms. Each of these is personal data, and much of it is health data. When a practice entrusts this processing to an outside provider, the law does not allow an informal arrangement. The CNIL’s guidance of 8 July 2020 states that a controller and a processor must conclude a contract containing the mandatory Article 28(3) information, adapted to their situation.
The same regulator also warns against starting processing before an Article 28-compliant contract exists, in its 2024 practical guide on the security of personal data. In practice, the agreement should be signed and understood before the first patient call is forwarded, not after the service is running.
The need applies to every kind of outsourced reception: a general practitioner with a remote secretary, a specialist who delegates after-hours calls, a physiotherapy office, or a multi-professional health center. The size of the practice does not change the obligation. For a closer look at the contract itself, see the guide on the medical answering service DPA.
Controller and processor: who is who in a medical practice
The distinction rests on who decides. The EDPB explains that a controller determines the purposes and means of processing, while a processor processes data on the controller’s behalf and only on the controller’s instructions.
Applied to a practice, the roles usually fall as follows:
| Question | Practice (controller) | Answering service (processor) |
|---|---|---|
| Why are patient calls and appointments handled? | Decides: patient care and appointment management | Does not decide |
| Which information is collected during a call? | Defines it through written instructions | Collects only what the instructions specify |
| Who may access the data? | Sets access rules by function | Limits access to authorized, confidentiality-bound staff |
| What happens at the end of the contract? | Chooses return or deletion | Returns or deletes data and copies as instructed |
| Who informs patients and handles their rights requests? | Remains responsible | Assists the controller |
A processor that starts using the data for its own purposes, for example to build marketing files, stops being a processor for that activity and takes on its own responsibilities. This is why the instructions in the contract should be precise and why any processing outside them calls for renegotiation or written instructions, as the CNIL notes.
What the agreement must contain
The CNIL’s 2020 guidance lists the elements to be defined and adapted to the service: the subject matter, the duration, the nature and purpose of the processing, the categories of personal data and the categories of data subjects. For an answering service, each of these can be made concrete.
- Subject matter and purpose: answering incoming calls, scheduling and moving appointments, relaying messages, and, where the service includes it, qualifying the urgency of a call.
- Duration: the term of the service contract, with a clear end date or notice period.
- Nature of processing: recording of caller identity, entry into the practice’s calendar, transmission of messages, and any call recording or transcription.
- Categories of data: identity and contact details, appointment details, and health information that a caller may disclose.
- Categories of data subjects: patients, and sometimes relatives, caregivers or other professionals who call.
The CNIL’s Article 28 guide for processors adds the operational obligations. The processor must process data only on documented instructions, ensure that authorized persons are bound by confidentiality, and obtain written authorization before appointing another processor.
The EDPB completes the list: the processor must help the controller with security, breach notification and data protection impact assessments, delete or return the data at the controller’s choice when services end, provide the information needed to demonstrate compliance, and allow audits.
Clauses worth reading line by line
- Instructions: do they describe what the operators actually do on a call, or only repeat the legal text?
- Confidentiality: are all staff and operators who access calls bound by a confidentiality commitment?
- Subprocessors: is prior written authorization required, and is there a list?
- Assistance: how does the provider help with patient rights requests, impact assessments and breaches?
- End of contract: is the return or destruction of data and copies specified, with a deadline?
- Audit: can the practice obtain evidence of compliance and request an audit?
The 2024 CNIL security guide recommends going a step further in the contract, with provisions on confidentiality responsibilities, minimum authentication, return or destruction at the end of the contract, incident management and prompt notification of any security breach.
What health data changes
Health data is a special category. Article 9 of the GDPR prohibits its processing in principle unless a specific exception applies. The Dalloz legal summary identifies healthcare, diagnosis, care and the management of health services under Article 9(2)(h), subject to professional secrecy or an equivalent duty of confidentiality. A call to book a consultation, once the caller explains the reason, can fall in this category.
This has direct consequences for the contract. Access should be limited according to function, and the CNIL recommends distinguishing the rights to consult, modify, delete and export data. The calendar entry visible to an operator should contain what is necessary to schedule the visit, and nothing more.
Security measures
Article 32, reproduced by the CNIL, requires technical and organizational measures appropriate to the risk. Where appropriate these include pseudonymization and encryption, ongoing confidentiality, integrity, availability and resilience, the ability to restore data after an incident, and regular testing of effectiveness. A contract that refers to these measures in general terms is weaker than one that describes the actual ones: authentication, encryption, logging, and the handling of recordings. Related questions are covered in the guide to encrypted call recording in healthcare.
Breach notification
Under Article 33, as reproduced by the CNIL, the processor notifies the controller without undue delay after becoming aware of a breach. The controller then notifies the supervisory authority without undue delay and, where feasible, within 72 hours when the breach is likely to put individuals’ rights and freedoms at risk. Because the 72-hour clock concerns the practice, the contract should state how fast and through which channel the answering service alerts the practitioner, and what information it provides.
HDS: when French hosting rules apply
France adds a national layer for health data hosting. According to G_NIUS, the French digital health agency’s regulatory portal, HDS applies when a provider hosts qualifying personal health data collected during prevention, diagnosis, care or social and medico-social follow-up, on behalf of the data producer or collector, or of the patient. The host must hold an HDS certificate.
The covered activities are broad. G_NIUS lists physical sites, hardware and virtual infrastructure, application-hosting platforms, administration and operation of the information system containing health data, and backups. Article L1111-8 requires the certificate for health data hosted on digital media by a third party.
For a practice, the useful question is not whether an answering service “uses” health data but where and how the data is stored: which platforms hold call recordings, messages and calendar data, and whether the hosting chain meets the certification requirement where it applies. The contract and its annexes should name the hosting arrangements. A detailed explanation is available in the article on HDS certification and medical phone calls.
Subprocessors, location, transfers and deletion
The CNIL recommends reviewing the entire chain, not only the provider that signs the contract. Its security guide warns against cloud services without guarantees about the actual geographic location of data and without verification of the legal conditions and formalities for transfers outside the European Union.
A practitioner can structure the review around five points:
- Subprocessors: the full list, with the role of each and the procedure for adding a new one.
- Location: where data and backups are physically stored.
- Transfers: whether any access or transfer leaves the European Economic Area, and which legal mechanism covers it.
- Retention: how long calls, recordings, messages and logs are kept, and by what process backups are purged.
- End of service: the return or secure deletion of data and all copies, at the practice’s choice.
These points matter most for services combining human operators and AI tools, because an AI component can add a subprocessor, a new hosting location or a new retention rule. The guide to AI in medical phone reception discusses this in a compliance context.
What stays with the practitioner
Signing a DPA does not transfer responsibility. The CNIL’s guidance on health data formalities asks controllers to document processing, formalize roles, keep a record, carry out an impact assessment where justified, inform individuals, respect their rights and ensure security.
The CNIL and medical council practice guide specifically lists outsourced appointment scheduling as an activity to include in the practice’s record of processing activities. The record includes purposes, data subjects, recipients and transfers, and remains the practice’s responsibility.
The controller also has to choose a processor offering sufficient guarantees, and the CNIL’s security guide adds that the processor’s security measures should be verified. In concrete terms, a practice keeps four documents together: the signed DPA, the record entry, the information given to patients, and the provider’s description of its security and subprocessors.
A short pre-signature checklist
| Item | What to confirm in the documents |
|---|---|
| Roles | Practice named as controller, provider as processor |
| Scope | Subject matter, duration, nature, purpose, data and data-subject categories |
| Instructions | Written, matched to the real call handling |
| Staff | Confidentiality commitment for every person with access |
| Subprocessors | Written authorization, current list |
| Hosting | Location, backups, HDS where applicable |
| Incidents | Notification delay and channel to the practice |
| Exit | Return or deletion of data and copies |
| Records | Entry added to the practice’s processing record |
For teams that record or analyze calls, two further guides cover the details: call analytics under GDPR and secure call recording for French clinics.
Our perspective
For more than 15 years, ClicFone has worked exclusively with medical and paramedical professionals, and one lesson stands out: a data processing agreement is most useful when it describes the service as it is really delivered, call after call.
A telephone line is an intelligent filter between patients and the practice. It receives requests, qualifies their urgency and places appointments in the agenda. Each of these steps involves information that patients entrust to the practice in confidence. The contract that frames them should therefore be as concrete as the work itself.
This is why we favor human operators trained specifically for healthcare, supported by AI for continuity at any hour, within a framework of medical confidentiality and data protection. Our service is designed to synchronize with the calendar platforms that practitioners already use, so that the information remains where the practice expects it and does not multiply across tools.
We encourage every practitioner to ask for clear answers on instructions, subprocessors, hosting and the end of the contract. A provider that has built its offer around healthcare should welcome these questions, and the long relationships we maintain with our clients, more than half of whom have been with us for over ten years, rest on that transparency.
Rudolph Thierry
Outsourced phone reception built for health professionals
ClicFone provides medical and paramedical telephone answering: call handling, appointment scheduling, coordination of patient calls and management of medical emergencies, with qualified human tele-secretaries supported by AI. The service integrates with Doctolib, LibreRDV, Maiia and CalenDoc, and the offers are flexible, without commitment according to the company’s own description.
Practices that want to see how the service fits their organization, including the documents that frame data protection, can start from the ClicFone telephone answering page or review how medical phone triage is organized.
FAQ
Is a data processing agreement mandatory for a medical answering service?
Yes. When a practice entrusts patient calls to a provider acting on its behalf, GDPR Article 28 requires a written contract. The CNIL states that it must contain the mandatory Article 28(3) information, adapted to the actual service.
Is the answering service a controller or a processor?
In most arrangements it is a processor: it handles calls and appointments on the practice’s instructions, while the practice decides the purposes and means. If a provider used the data for its own purposes, that activity would fall outside the processor role, which is why the instructions should be precise.
Does HDS certification apply to an answering service?
It depends on whether the provider hosts qualifying health data for the practice. G_NIUS describes the activities covered, from infrastructure to application hosting, administration and backups, and states that the host must hold an HDS certificate. The practice should ask which platforms hold its data and how they are certified.
What should happen to the data when the contract ends?
The processor must delete or return the personal data, at the controller’s choice, and the CNIL recommends specifying return or destruction in the contract. Copies and backups should be included in that process, with a stated deadline.
Does the practice still have obligations after signing?
Yes. The practice keeps its record of processing activities, which should include outsourced appointment scheduling, informs patients, respects their rights and remains responsible for choosing a processor with sufficient guarantees.
Sources
- CNIL: Responsable de traitement et sous-traitant, 6 bonnes pratiques
- CNIL: Practice guide GDPR, Security of personal data 2024
- EDPB: Data controller or data processor
- CNIL: RGPD, Guide sous-traitant
- Open Lefebvre Dalloz: Traitement des données de santé
- CNIL: Chapitre IV, Responsable du traitement et sous-traitant
- G_NIUS: Healthcare data hosting (HDS)
- CNIL: Quelles formalités pour les traitements de données de santé
- CNIL and CNOM: Guide pratique sur la protection des données personnelles
Recommended
- Medical Answering Service DPA: Your GDPR Compliance Guide
- EHR Integration for Medical Answering Services: 2026 Guide
- Choosing a HIPAA Compliant Answering Service That Holds Up
