A French medical practice can record patient calls, but only for a specific, justified purpose, with oral notice at the start of each call, and with encryption in transit and at rest on infrastructure suited to health data. Most English-language guidance on this topic is written for HIPAA, the US framework. In France, the reference points are the GDPR, the CNIL’s guidance and the French Public Health Code, and they lead to different decisions: often to recording less, not more.
Key takeaways
- Systematic recording of every patient call is generally hard to justify under the GDPR’s data minimization principle. Recording should serve a defined purpose, such as proving that an appointment or service contract was concluded.
- Encryption is a baseline, not a solution on its own. It must cover transmission and storage, and an outsourced provider handling health data must also meet the HDS (Hébergeur de Données de Santé) hosting requirement.
- Each caller must be informed at the moment of the call, orally, of the purpose of the recording and of their rights. A link in general terms and conditions is not enough.
- Recordings made for different purposes, such as quality training and proof of an appointment, should be separated so that retention periods and access rights can differ.
- Outsourcing the phone line does not transfer responsibility: the practitioner remains accountable and needs a written processor contract.
Table of Contents
- Why HIPAA guidance does not transfer to France
- Is a recording justified in the first place?
- Notice: what callers must hear, and when
- What encryption must cover
- HDS hosting and the processor contract
- AI transcription and call analytics
- Our perspective
- A practical setup for a practice or health center
- How ClicFone fits into this
- FAQ
- Sources
Why HIPAA guidance does not transfer to France
Search results for this topic are dominated by HIPAA guides: encryption of electronic protected health information, business associate agreements, state-by-state consent rules. They are useful for a US clinic. For a practice in Lyon, Lille or Marseille, they answer the wrong legal question.
In France the framework has three layers:
- The GDPR, which sets the principles (purpose limitation, data minimization, storage limitation, security) and treats health data as a special category.
- The CNIL, the French data protection authority, which publishes practical guidance for practices, including a reference framework on the management of medical and paramedical practices that covers appointment management among other processing activities.
- The Public Health Code, which in Article L. 1111-8 requires health data hosted on behalf of others to be held by a certified HDS host.
For a comparison point, a US provider’s published HIPAA security controls show how that framework is typically documented: access controls, encryption and audit logging. The same technical vocabulary applies in France, but the legal test starts earlier. Before asking how to encrypt a recording, a French practice must ask whether the recording should exist at all.
Is a recording justified in the first place?
The CNIL states that recording telephone conversations to prove the formation of a contract is allowed provided it is necessary. That condition carries the weight. A practice that records every call “just in case” collects more than it needs, which runs against Article 5(1)© of the GDPR on data minimization.
In practice, this leads to a sorting exercise:
| Situation | Recording approach | ||||
|---|---|---|---|---|---|
| Routine appointment booking, rescheduling, cancellation | Usually no recording needed. | ||||
| The booking in the calendar is the record. | |||||
The last row matters more than it looks. A recording made to settle a dispute about an appointment and a recording used to coach a secretary are two different processing activities. They need different retention periods and different people with access. Keeping them in one undifferentiated archive is a frequent source of over-retention, which the CNIL treats seriously: its 2024 decision against two online psychic-consultation companies included excessive data retention among the grounds for sanctions of 250,000 and 150,000 euros. That case did not involve medical practices, but it shows how the authority reads retention failures.
Notice: what callers must hear, and when
The CNIL’s position is that each person must be informed at the time of the call. Its guidance on informing callers says that the caller must learn the purpose of the operation and the other points of the information obligation as the call begins.
In a medical setting, a workable notice has two stages.
- A short oral message at the start of the call. It states that the call may be recorded, for what purpose, and that the caller may object. It must be brief enough that a worried patient actually hears it.
- A fuller disclosure that is easy to reach. This identifies the data controller, states the retention period and lists the rights of access, rectification and objection. It can sit on the practice website or be available on request.
A common mistake is to treat the recorded announcement as the whole obligation. It is the first layer only. Another is to place the information solely in terms and conditions that the patient never sees before calling. For the verbal side of this, ClicFone has written about making verbal consent auditable in French healthcare, and the same logic applies to notice: what matters is that the practice can show what was said and when.
The right to object needs a real consequence. If a patient refuses recording, the call continues and the appointment is booked in the usual way. A refusal that blocks access to care would be difficult to defend.
What encryption must cover
The European Data Protection Board’s guide for small businesses explains encryption as converting information into code so that only someone holding the right key can read it. For call recordings, three points need to be checked with any provider.
In transit
The audio travels from the caller to the telephony platform, then to storage. Each leg should be protected. A VoIP line that is not encrypted exposes content to interception on the network. Ask which protocols protect signaling and media, and ask for a recent architecture diagram rather than a marketing statement.
At rest
The stored file must be unreadable without the key. Full-disk encryption on a single office computer does not meet the standard that a shared, hosted archive requires. The questions to ask are where the keys are held, who can use them, and what happens to them when the contract ends.
Around the file
Encryption does not replace the rest of security. A well-encrypted archive that every employee can open is still a weak archive. A defensible setup also includes:
- individual accounts with role-based access, so that only those who need to listen can do so;
- an access log that records who listened to which recording and when;
- automatic deletion at the end of the defined retention period;
- a documented procedure for access requests, so that a patient exercising their rights receives a response within the legal time frame.
On retention itself, the limits are set purpose by purpose rather than by one universal number. ClicFone’s note on call log retention under CNIL rules goes into how a DPO can structure those periods.
HDS hosting and the processor contract
A practice that outsources its telephone reception hands a third party some of the most sensitive information it holds: a name, a phone number and often a reason for the visit. When that third party stores recordings or call notes, two requirements apply.
HDS certification. Under Article L. 1111-8 of the Public Health Code, hosting health data on behalf of others requires a certified host. A provider storing recordings or patient messages should be able to name its hosting and show the certificate.
A written processor contract. Article 28 of the GDPR requires a contract that defines the provider as a processor, sets out what it may do with the data, and imposes the security measures, including encryption in transit and at rest. The practice remains the controller. The provider’s compliance does not remove the practitioner’s responsibility, which is why the contract and the evidence behind it matter. ClicFone’s guide to securing clinic call recording under GDPR and Article 28 lays out the steps in order.
When reviewing a provider, a short checklist is useful:
- Does it hold HDS certification for the hosting of health data, and can it name the host?
- Is there an Article 28 contract that covers subprocessors, breach notification and the return or deletion of data at the end of the service?
- Are recordings encrypted in transit and at rest, with documented key management?
- Can the provider separate recordings by purpose and apply different retention periods?
- Does it support manual triggering of recording for sensitive calls, instead of capturing everything?
- Are access rights and logs available for audit?
AI transcription and call analytics
Many platforms now add transcription or automated call scoring. This changes the legal picture, because analysis of a recording is a further processing operation with its own purpose. The EDPB has published a summary of a national case in which a controller recorded all customer service calls and analyzed them overnight with software to detect keywords and estimate emotional state, which illustrates the kind of practice that draws regulatory scrutiny.
For a medical practice, the prudent course is to treat any AI feature as a separate decision: define its purpose, assess whether it is necessary, inform callers, and check where the data is processed. A privacy impact assessment is often the right tool, and ClicFone has published guidance on avoiding delays with call privacy impact assessments as well as a call analytics checklist covering HDS and Article 28.
Our perspective
After more than 15 years working with medical practices, we have come to a conclusion that surprises some practitioners: the safest recording is frequently the one that is never made. A telephone line in a practice acts as an intelligent filter. It qualifies the request, assesses urgency and directs the patient to the right appointment. What the practice needs from that exchange is an accurate entry in the agenda and, in the case of urgency, a clear handover, not an audio archive of everyday conversations.
For that reason our approach to confidentiality rests on organization before technology. Trained human operators handle the call, the information collected is limited to what the appointment or the triage requires, and the result is synchronized with the practice’s calendar platform. Encryption and secure hosting are conditions of that work, not a substitute for deciding what should be kept. Where a recording is justified, it should be a defined, notified and time-limited exception.
We also encourage practices to document their choices. A dated note stating why calls are or are not recorded, who has access, and when data is deleted is more valuable during an audit than any technical brochure.
— Rudolph Thierry
A practical setup for a practice or health center
For a general practitioner, a specialist, a paramedical professional or a multi-professional health center, the following sequence keeps the work manageable.
- Map the calls. List the types of calls the practice receives: booking, cancellation, results inquiries, urgent requests, prescriptions renewals.
- Decide the purpose of any recording. If none can be justified, do not record. If one can, write it down.
- Write the notice. Prepare the short oral message and the fuller disclosure. Test the oral message on a colleague who has not seen it.
- Choose the infrastructure. Check HDS hosting, encryption in transit and at rest, and the Article 28 contract.
- Set separate retention periods and access rights for each purpose, and schedule automatic deletion.
- Plan for the exceptions. Define how staff trigger a recording manually, and what happens when a patient objects.
- Review annually. Update the record of processing activities and check the access logs.
For teams that also exchange messages after calls, the secure messaging guide for French secretariats covers the follow-up channel, and the guide to securing paramedical phone exchanges addresses the paramedical context.
How ClicFone fits into this
Practices that would rather not build this framework internally can delegate phone reception to trained medical tele-secretaries. ClicFone’s remote telephone secretarial service handles calls and appointments in sync with platforms such as Doctolib, LibreRDV, Maiia and CalenDoc, with human operators trained for the healthcare sector and AI support for after-hours coverage, within medical confidentiality standards. For urgent requests, the urgent appointment triage and medical phone triage offers describe how calls are qualified before they reach the practitioner. To discuss how this applies to your practice, start from the ClicFone site.
FAQ
Is end-to-end encryption enough to make call recording compliant in France?
No. Encryption addresses security, but compliance also requires a legitimate purpose, oral notice to the caller, defined retention and, for outsourced hosting of health data, HDS certification and a processor contract. A perfectly encrypted recording that should never have been made is still a breach of data minimization.
Does HIPAA apply to a French medical practice?
No. HIPAA is a US law. French practices are governed by the GDPR, CNIL guidance and the Public Health Code. HIPAA guides can still help you understand technical safeguards such as access control and audit logs, but their consent and vendor-agreement rules do not replace French requirements.
Can a practice record every patient call for safety?
In general, no. According to the CNIL’s approach to recording, it must be necessary for a defined purpose, and blanket recording of all calls tends to exceed that. For distressing or emergency calls, a manual decision by the staff member is the safer design than automatic capture.
Is a recorded announcement at the start of the call sufficient?
It is necessary but usually not sufficient. The caller must be told at the moment of the call about the purpose and their rights, and fuller information on the controller, retention and rights should be easy to find elsewhere. The practice should also be able to show what the announcement said.
Does outsourcing the phone line move the legal responsibility to the provider?
No. The practice stays the data controller and must have an Article 28 contract with the provider as processor. The provider takes on defined obligations, such as encryption and HDS hosting where relevant, but the practitioner must be able to demonstrate that these are in place.
Sources
- CNIL: recording telephone conversations to prove the formation of a contract
- CNIL: informing callers when conversations are recorded or listened to
- CNIL: reference framework for medical and paramedical practices
- CNIL: sanctions against COSMOSPACE and TELEMAQUE
- EDPB: securing personal data, SME guide
- EDPB: data protection issues in the use of artificial intelligence
Recommended
- Secure French Clinic Call Recording: 5 Steps to GDPR and Article 28
- 3 GDPR Steps French Clinics Must Take for Medical Calls
- 3 Ways to Make Verbal Consent Auditable in French Healthcare
- 5–20 Year Call Log Retention in France: CNIL Rules for Medical DPOs
