GDPR is a European regulation that covers all personal data, and it is the framework that governs patient calls in a French medical or paramedical practice. HIPAA is a United States law that covers protected health information held by specific US organizations. A practice in France does not apply HIPAA to its own patients, but it can still learn from the comparison, particularly when it works with US partners or evaluates software built for both markets.
The two texts share a goal, the protection of patient information, yet they differ in scope, legal logic, patient rights and breach procedures. The sections below set out those differences, then turn to the practical question for French practices: which lawful basis, which safeguards and which contractual framework apply when patients phone the practice, and when part of that work is outsourced to a medical telephone secretary.
Key Takeaways
- The GDPR protects all personal data of people in the EU, with health data classed as a special category. HIPAA protects health information held by US covered entities and their business associates.
- For patient calls in France, the GDPR, French data-protection law and the Public Health Code apply. HIPAA is relevant only if the organization is itself a US covered entity or works for one.
- Health data needs both an Article 6 lawful basis and an Article 9 condition. For care and appointment management, Article 9(2)(h) is the usual route, tied to professional secrecy.
- Data minimization is the practical default: collect what the appointment and the care require, and avoid recording whole conversations without a justified need.
- When a secretarial service handles calls, a written Article 28 agreement, confidentiality commitments and role-based access are the core safeguards.
Table of Contents
- GDPR and HIPAA at a glance
- Where the two frameworks differ
- Does HIPAA apply to a practice or to patient calls in France?
- GDPR lawful basis for patient calls in France
- Recording, transcription and minimization
- Outsourcing patient calls: the processor framework
- Practical steps for a French practice
- Perspective: why call handling should be built on the GDPR first
- How ClicFone supports compliant call handling
- FAQ
- Sources
GDPR and HIPAA at a glance
The acronyms first. GDPR stands for General Data Protection Regulation (RGPD in French). HIPAA stands for the Health Insurance Portability and Accountability Act of 1996. According to the US Department of Health and Human Services, the HIPAA Privacy Rule governs the uses and disclosures of protected health information (PHI) by covered entities and gives individuals privacy rights over that information.
The covered entities are defined narrowly. HHS lists health plans, healthcare clearinghouses, and healthcare providers that transmit health information electronically in connection with standard transactions adopted by HHS. Service providers working for those entities, known as business associates, are brought in by contract and by the rule itself.
The GDPR starts from a different point. It is not a health law at all. It applies to the processing of any personal data, whoever the controller is, and it singles out health data for stronger protection. The CNIL describes health data as sensitive data whose processing is prohibited in principle unless one of the exceptions in Article 9 applies.
| Criterion | GDPR | HIPAA |
|---|---|---|
| Type of law | EU regulation, directly applicable in France and complemented by French law | US federal law and its implementing rules |
| Who is covered | Any organization processing personal data of people in the EU, in any sector | Health plans, clearinghouses, and providers transmitting standard transactions electronically, plus their business associates |
| Data covered | All personal data; health data is a special category | Protected health information (PHI) |
| Legal logic | Principles: lawfulness, purpose limitation, minimization, security, accountability | Detailed rules on use, disclosure and safeguards |
| Outsourcing | Processor contract under Article 28 | Contract with business associates |
| Breach notification | Supervisory authority within 72 hours where feasible | Individuals within 60 days of discovery |
Where the two frameworks differ
Scope: all personal data versus PHI
The most important difference is the object of protection. HIPAA regulates PHI held by regulated entities. Health information in the hands of a non-covered organization, such as a consumer app, may fall outside it. The GDPR follows the person and the data, not the sector, so a medical practice, a pharmacy, a software vendor and a telephone answering service are all caught when they process personal data of people in the EU.
Legal basis: a required justification
Under the GDPR, every processing operation needs a lawful basis from Article 6. Health data needs more: Article 9 prohibits its processing unless a listed exception applies, as set out in the regulation itself on EUR-Lex. HIPAA works differently. It permits many uses of PHI for treatment, payment and healthcare operations without a separate legal basis, and then limits other disclosures through authorizations and minimum-necessary standards. HHS describes the Privacy Rule as balancing the information flows needed for care and public health with the protection of individuals’ health information.
This is where the common shorthand that HIPAA allows implied consent and the GDPR does not becomes misleading for French practices. In France, a practice rarely relies on consent for care itself. It relies on the health-care exception of Article 9, and consent is reserved for optional extras.
Patient rights
Both frameworks give individuals rights over their information, including access. The GDPR is broader: access, rectification, erasure in certain cases, restriction, objection and portability, each with its own conditions. Erasure is not absolute in healthcare, since medical record retention obligations under French law can justify keeping data. The comparison with HIPAA, which requires providers to retain certain records, is therefore less sharp than it first appears. Each practice has to know which rights apply to which data set.
Security: principles versus specified safeguards
HIPAA’s Security Rule is organized around administrative, physical and technical safeguards. The GDPR sets a risk-based obligation to apply appropriate technical and organizational measures. The CNIL’s reference for liberal medical and paramedical practices states the expectation plainly: the practice takes precautions appropriate to the risks to prevent unauthorized access, and protects data during collection, transmission and storage.
A practice that tries to cover both regimes will generally find the HIPAA safeguards a useful checklist. A US-focused overview of what HIPAA security and compliance programs involve shows the kind of administrative and technical controls that also make sense as a reference point for French teams, even though the legal obligations in France come from the GDPR.
Breach notification
The GDPR sets a short clock. According to the CNIL’s notification service, an initial notification is due within 72 hours where possible after the breach is discovered, with reasons given if the deadline is exceeded, and a supplementary notification when more information is available. Under the HIPAA Breach Notification Rule, individual notices must go out without unreasonable delay and no later than 60 days after discovery.
The practical consequence for a French practice is that an incident involving patient call data needs an internal procedure that works within days, not weeks. That procedure should name who decides whether the incident is notifiable, who contacts the processor, and who keeps the record.
Does HIPAA apply to a practice or to patient calls in France?
Not by default. HIPAA applies to US covered entities and their business associates, as HHS defines them. A general practitioner in Lyon, a physiotherapy office in Lille or a multi-professional health center in Toulouse is established in France and treats patients residing in France. Its processing falls under the GDPR and French law. The CNIL states that its prior-formality regime covers processing carried out in the activities of an establishment in France or concerning people residing in France.
HIPAA becomes relevant in a few situations:
- A French organization acts as a subcontractor for a US covered entity and signs a business associate agreement.
- A practice serves patients who are insured through US plans and exchanges data with US providers.
- A software vendor sells the same product on both sides of the Atlantic and designs its controls to satisfy both regimes.
In these cases, the GDPR still applies to the data of people in the EU, and any transfer outside the EU needs a transfer mechanism such as an adequacy decision or standard contractual clauses. Some French vendors state in their processing agreements that data is generally not processed or transferred outside the EU and that, where it is, one of those mechanisms is used. A practice choosing a provider can ask for the same clarity.
GDPR lawful basis for patient calls in France
A patient call looks simple: someone phones to book, move or cancel an appointment, or to describe a symptom. Legally, it produces personal data (a name, a number, a reason for the visit) and often health data. Two layers must be met.
Layer one: an Article 6 basis
For the administrative side of the call, the practice needs a lawful basis under Article 6. In a care relationship, the basis most often cited is the performance of a task carried out in the public interest or the legitimate interests of the practice in managing its patients, depending on the activity. The right choice should be documented in the processing register.
Layer two: an Article 9 condition
Because the content of a call can reveal health information, Article 9 also applies. Article 9(2)(h) covers processing necessary for preventive medicine, medical diagnosis, the provision of care or treatment, or the management of health systems and services, as published on rgpd.com. The same provision adds a condition: the data must be processed by or under the responsibility of a health professional bound by professional secrecy, or by another person bound by an equivalent obligation of secrecy.
This condition is what makes the choice of secretarial provider a legal matter and not only an organizational one. A person who answers patient calls on behalf of a practice has to work under confidentiality commitments equivalent to the practice’s own.
Where consent fits
Consent is not the default for care calls, but it matters for optional processing, such as recording a call or sending text reminders. The GDPR requires consent to be free, specific, informed and unambiguous, and silence, pre-ticked boxes and inactivity do not count. For a call, that means a clear spoken or recorded notice before the optional step, and a way to continue without it. ClicFone has published practical guidance on making verbal consent auditable and on GDPR steps for medical calls.
Recording, transcription and minimization
Recording is the point where practices most often go beyond what they need. The GDPR’s minimization principle requires data to be adequate, relevant and limited to what is necessary for the stated purpose. In its overview of the regulation, the CNIL cites an enforcement case criticizing the systematic recording of entire telephone conversations where necessity for the stated purposes had not been justified.
A sensible default for patient calls therefore looks like this:
- Collect only the information needed to schedule and prepare the appointment: identity, contact details, type of consultation, urgency level.
- Avoid full-call recording unless a specific, documented purpose justifies it, such as training or quality control, with prior information to the caller.
- Set a retention period for any recording or transcript, and delete when it expires.
- Restrict access to those who need it for their role.
For practices that do record, ClicFone’s pages on call recording and Article 28 and on encrypted call recording rules in France go through the steps in detail. Teams considering analytics on top of calls can consult the call analytics checklist.
Outsourcing patient calls: the processor framework
The CNIL’s guidance for liberal medical and paramedical practices treats medical and administrative patient management, whether performed internally or outsourced to a service provider, as subject to the GDPR, French data-protection law and the Public Health Code. Outsourcing does not remove the practice’s responsibility. It adds a contractual layer.
Under Article 28, the practice remains the controller, and the service provider acts as a processor on its instructions. Processor agreements typically state that the provider processes data on behalf of the client, under confidentiality commitments, as in one published French data-protection agreement. That same document reminds readers that processing covers a wide range of operations: collection, recording, storage, consultation, use, transmission, restriction, erasure and destruction. Each of these operations has to be covered by the contract.
A practical checklist for the agreement:
- the purpose and duration of the processing;
- the types of data and categories of patients;
- confidentiality commitments for every person with access;
- security measures, including access control and encryption;
- conditions for subcontracting and for any transfer outside the EU;
- assistance with patient rights requests and breach notification;
- return or deletion of data at the end of the contract.
ClicFone’s guide to the processor agreement for answering services and its page on protecting health data in an outsourced medical secretariat expand on these points.
Practical steps for a French practice
The CNIL’s guidance on health-data formalities points to a consistent method: document the processing, formalize roles and responsibilities, keep a processing register, conduct an impact assessment when justified, inform people and ensure security. Applied to patient calls, this becomes a short action plan.
- Map the call flow. Note what is collected, by whom, in which tool, and where it is stored. Include the calendar platform and any messaging.
- Set the legal basis. Record the Article 6 basis and the Article 9(2)(h) condition in the register.
- Inform callers. Use a short spoken notice and a longer written notice on the practice’s website and waiting room.
- Control access. The CNIL’s telemedicine guidance recommends strong authentication, unique user identifiers, no shared accounts and differentiated authorizations limiting each person to the data strictly necessary for their role. These controls apply equally to a secretarial back office.
- Sign the Article 28 agreement with every provider handling calls.
- Assess risk. For high-risk processing, the CNIL says the controller must conduct an impact assessment before processing and document compliance, including the register.
- Prepare for incidents. Define who notifies the CNIL within 72 hours where possible, and how patients are informed when the risk to them is high.
The CNIL’s telemedicine guidance also makes a useful point: confidentiality is operational, not merely contractual. Strong authentication, unique accounts and least-privilege access are expected controls, so a signed contract alone does not complete the job.
Perspective: why call handling should be built on the GDPR first
After more than 15 years in medical telephone answering, we see the same pattern. Practices ask whether they need to meet HIPAA because the term circulates widely in software marketing. In France, the useful question is different: how does each call, each calendar entry and each message stay inside the GDPR, the Public Health Code and professional secrecy?
Our answer is to build on the GDPR baseline and to treat every call as a short, bounded processing operation. Our operators are trained specifically for healthcare, they collect what the appointment requires, and they work with the calendar platforms the practice already uses, including Doctolib, LibreRDV, Maiia and CalenDoc. We believe that this combination of trained people and AI support, available around the clock, is what lets a practice keep a consistent, confidential reception without adding administrative work.
Minimization is the principle we put first. The telephone acts as an intelligent filter: it should gather the information needed to qualify the urgency and book the right slot, and nothing more. When that discipline is set in the contract and applied in daily practice, compliance stops being a separate project and becomes part of how calls are handled.
Rudolph Thierry
How ClicFone supports compliant call handling
ClicFone provides outsourced medical and paramedical telephone answering for general practitioners, specialists, paramedical professionals and health-center teams. The service combines dedicated human tele-secretaries with AI-driven support, synchronizes with the main healthcare calendar platforms, and handles appointment scheduling, coordination of patient calls and medical emergencies in line with data-protection and confidentiality standards.
Practices that want to see how this works for their own organization can start from the ClicFone telephone answering service. Teams focused on urgency handling can also read about urgent appointment triage and medical phone triage.
FAQ
What does GDPR stand for, and does it apply to healthcare?
GDPR stands for General Data Protection Regulation, known in France as the RGPD. It applies to every organization processing personal data of people in the EU, including medical practices, and it treats health data as a special category requiring an Article 9 condition in addition to an Article 6 lawful basis.
What are the main differences between HIPAA and GDPR?
HIPAA is a US law limited to PHI held by covered entities and their business associates, while the GDPR covers all personal data in any sector. They also differ on legal basis, patient rights and breach deadlines: 72 hours to notify the authority where possible under the GDPR, and up to 60 days to notify individuals under HIPAA.
Is HIPAA required for a medical practice in France?
No, not as a matter of course. A practice established in France and treating patients residing there is governed by the GDPR and French law. HIPAA would matter only if the organization acts as a business associate of a US covered entity or otherwise falls under its definitions.
Which lawful basis covers patient phone calls?
Two layers apply. An Article 6 basis covers the processing in general, and an Article 9 condition covers health data. For care and appointment management, Article 9(2)(h) is the usual condition, provided the data is handled under the responsibility of someone bound by professional secrecy or an equivalent obligation.
Can a practice record patient calls?
Only with a justified, documented purpose, prior information to callers and a defined retention period. The CNIL has criticized systematic recording of entire conversations where necessity was not shown, so minimization is the safer default.
Sources
- Summary of the HIPAA Privacy Rule, HHS.gov
- Breach Notification Rule, HHS.gov
- Quelles formalités pour les traitements de données de santé, CNIL
- Règlement (UE) 2016/679, EUR-Lex
- Article 9 du RGPD, rgpd.com
- Référentiel relatif aux traitements de données des cabinets médicaux et paramédicaux, CNIL
- Télémédecine : comment protéger les données des patients, CNIL
- Le règlement général sur la protection des données, CNIL
- Notifier une violation de données personnelles, CNIL
- Data protection agreement, Nabla
Recommended
- 3 Ways to Make Verbal Consent Auditable in French Healthcare
- Encrypted Call Recording in Healthcare: The French Rules
- Call Analytics GDPR Checklist for French Clinics: HDS and Article 28
- Secure French Clinic Call Recording: 5 Steps to GDPR and Article 28
