Outsourcing Contract Clauses for Healthcare Professionals in France

A healthcare professional in France who outsources phone reception or administrative work should make sure the contract covers eight things: a precise description of the mission, the price and its revision, service levels, confidentiality and professional secrecy, a GDPR Article 28 data-processing clause, HDS certification where health data are hosted, liability and insurance, and the terms of exit. This guide goes through each clause in turn, with the French sources on which they rest.

Key Takeaways

• The French public administration lists the minimum content of any outsourcing contract: object, price, indexation, payment terms, control of services, confidentiality, governing law and competent court.
• When patient data pass through the provider, a GDPR Article 28 clause, a security clause and a clause on return and destruction of data are required in practice.
• An outsourced secretariat must be limited to administrative tasks. Any medical act or clinical assessment stays outside the contract.
• Any host of personal health data on behalf of a third party must hold HDS certification, and the contract should attach the certificate and define its scope.
• Exit terms (reversibility, return of data, termination for breach) deserve as much attention as the commercial terms.

Table of Contents

• Start with the general framework for outsourcing contracts
• Define the mission and its limits
• Price, indexation, duration and renewal
• Service levels, reporting and continuity
• Confidentiality and professional secrecy
• The GDPR Article 28 clause
• HDS certification: when the contract must address it
• Exit: return and destruction of data, reversibility
• Liability, insurance and disputes
• Perspective
• Choosing a provider whose contract matches these clauses
• Pre-signature checklist
• FAQ
• Sources

Start with the general framework for outsourcing contracts

A medical tele-secretarial contract is first of all an ordinary outsourcing contract, and French administrative guidance describes what such a contract contains. According to Service-Public Entreprendre, the contract should state the object of the mission in detail, the price, an indexation or renegotiation clause, payment deadlines and late penalties, the modalities for modifying the contract, delivery terms, sanctions for missed deadlines, the control and acceptance of services, the guarantees granted to the provider, confidentiality, intellectual property, a clause on undeclared work, the date of conclusion and effective date, and the competent court and applicable law.

For a medical practice, this generic list is a floor. Three layers are added on top of it: the limits imposed by the nature of the work (administrative, never medical), the data-protection layer (GDPR and the rules on health data hosting), and the professional layer (medical confidentiality and insurance).

Define the mission and its limits

The description of the service is the clause on which every other clause depends. A vague mission leads to disputes about what was promised, and in a medical setting it can lead to a provider performing tasks it should never perform.

A model contract for outsourced medical secretarial services published by Certyneo asks for a precise description of the administrative tasks entrusted, excluding any medical act or diagnosis, together with the terms of collaboration and the access granted to the professional’s tools. The same model warns against three recurring errors: entrusting the secretariat with tasks that amount to a medical act or clinical assessment, omitting the mandatory GDPR subcontracting clause when health data are processed, and failing to frame the provider’s access to the practice’s business software.

In practice, the mission clause should specify:

• Channels covered: inbound calls, voicemail, messages, web or secure messaging requests.
• Tasks: answering, identifying the patient, scheduling, moving or cancelling appointments, relaying messages, reminding patients of practical instructions given by the practice.
• Qualification rules: the practitioner’s own written protocol for what counts as urgent and what the operator does in that case (transfer to the practitioner, redirect to emergency services, or note and escalate). The protocol belongs to the practice, and the contract should annex it.
• Tools: which calendar platform the provider uses on the practice’s behalf, with which access rights (read, write, creation of appointments), and how those rights are logged and withdrawn.
• Exclusions: no diagnosis, no medical advice, no interpretation of symptoms beyond the practitioner’s protocol.

Operators who use a triage script should see how phone triage is organized for clinic leaders, because the script is precisely what the mission clause must annex.

Price, indexation, duration and renewal

The commercial clauses are the ones most often negotiated and the ones most often misunderstood. The administrative framework cited above expects the price of the service, an indexation or renegotiation clause, payment deadlines and late penalties. For a recurring service, the following points need to be written down:

1. What the price covers: a flat package, a volume of calls, hours of coverage, or a combination. The contract should state what happens when volume exceeds the package, for instance during a seasonal peak.
2. How the price changes: the index or the renegotiation date, and the notice the provider gives before any change.
3. Duration and renewal: fixed term or open-ended, tacit renewal or not, and the notice period for non-renewal.
4. Trial or ramp-up period: whether an initial period is planned to adjust scripts and calendar settings before full operation.
5. Invoicing: payment deadlines and penalties for late payment, as the official guidance lists.

A guide on outsourcing contracts from ITG adds the date of conclusion and effective date, the duration, and the place and schedule of execution. For a telephone service, the schedule of execution is the opening hours and coverage windows, including public holidays and out-of-hours cover.

Service levels, reporting and continuity

The same ITG guide recommends a service level agreement with performance indicators, a system for monitoring performance, corrective measures, financial sanctions and a continuity and disaster recovery plan. Translated into a medical phone service, these become measurable clauses:

The numerical targets are for the parties to agree. What matters is that each indicator is defined, measured the same way by both sides, and tied to a consequence.

Confidentiality and professional secrecy

Patients who call a practice share health information with the person who answers. The contract should therefore bind the provider and each of its operators to confidentiality. The Certyneo model refers to a reinforced confidentiality commitment and to professional secrecy by ricochet, to which the provider is subject. The model subcontractor contract from Les ODF likewise states that the subcontractor is subject to professional secrecy and to the confidentiality of the data processed.

The HDS reference framework published by the Agence du numérique en santé requires that the employment contracts of the provider’s staff include a confidentiality or non-disclosure clause, and that this requirement extend to subcontractors. A practice can reasonably ask the provider to confirm in the contract that every operator who may hear patient information has signed such an undertaking before taking calls.

For drafting details, the page on confidentiality agreements for medical secretaries in France sets out the points that an individual undertaking should contain. On the wider question of why confidentiality is a documentary matter as much as a legal one, this article on medical records and secrecy discusses how organizations structure access to sensitive files.

The GDPR Article 28 clause

An outsourced secretariat that handles patient names, phone numbers, reasons for consultation and appointment times processes personal data, and health data in particular, on behalf of the practice. The practice is the controller and the provider is the processor. The Conseil National de l’Ordre des Médecins states that, for a patient appointment platform, the contract must include a clause allocating the responsibilities of each party for patients’ personal data, a data-protection clause compliant with GDPR Article 28, a data-security clause, and a clause on the return and destruction of data at the end of the contract.

The mandatory content can be organized as follows, drawing on the CNIL example clauses:

• the subject and duration of the processing;
• its nature and purpose;
• the personal data and the categories of people concerned;
• processing only on the controller’s documented instructions;
• confidentiality commitments of everyone authorized to process the data;
• security measures;
• conditions for engaging another processor;
• assistance to the controller for answering data subjects’ requests;
• breach notification;
• the fate of data at the end of the service.

Further subcontracting

The Les ODF model provides that the provider may not recruit another subcontractor without the controller’s prior written authorization, specific or general. If it does, the same data-protection and confidentiality obligations apply to that sub-subcontractor, and the initial provider remains fully responsible to the controller. Where a provider relies on technology vendors, a notice period is a useful addition. One HDS addendum published by Genesys provides for at least 30 days’ notice before a new subprocessor is engaged, which shows what such a clause can look like.

Security measures

A law firm article on health SaaS contracts by Mirabile recommends that the security annex describe concrete measures: encryption in transit and at rest, access management, strong authentication, logging, penetration testing and vulnerability management. The same article advises specifying data location within the European Economic Area, listing the countries where processing occurs, framing transfers outside the EEA and being transparent about exposure to extraterritorial legislation. Call recording and analytics deserve their own line in the annex; the pages on encrypted call recording in healthcare and on GDPR checks for call analytics explain what to specify.

Breach notification

The contract should state a maximum delay for the provider to notify the practice of a data breach. The CNIL’s examples provide for a contractually specified maximum number of hours, and the CNB model clauses use 48 hours after the provider becomes aware of the breach. The CNIL guide for processors explains the chain that follows: the processor notifies the controller as soon as possible, and the controller must then notify the supervisory authority and, where required, the data subjects under GDPR Articles 33 and 34. A general GDPR compliance guide can help a practice manager picture those notification duties. The shorter the provider’s delay, the more time the practice has to meet its own.

For a full walk-through of this clause in the context of phone answering, the page on a medical answering service data processing agreement covers each element.

HDS certification: when the contract must address it

French law adds a sectoral requirement. According to Atias Avocats, under Article L.1111-8 of the Public Health Code any person hosting personal health data on behalf of a third party must hold HDS (Hébergeur de Données de Santé) certification, and using a non-certified host is an offence. The Conseil National de l’Ordre des Médecins makes the same point for hosts of patient records.

The practical consequence is that the contract should not simply state that the provider is compliant. It should:

1. specify the exact scope of the certificate and attach the attestation;
2. require that certification be maintained throughout the contract;
3. provide for immediate notice if the certificate is suspended or withdrawn (these three points follow the Mirabile article);
4. check which activities the certificate covers, since a publication on hospital GDPR obligations from Données Personnelles notes that scopes vary and that an infrastructure certificate does not cover application operation.

The HDS addendum from Genesys shows a termination right tied to certification: the customer may end the agreement immediately without compensation if certification is not renewed, is withdrawn or is lost through the provider’s exclusive fault. It also commits the provider not to use health data for marketing, advertising, commercial or statistical purposes, citing Article R.1111-11 of the Public Health Code.

The HDS reference framework adds requirements that translate directly into clauses: processing only on documented instructions, no use of health data beyond the hosting service, notification of breaches as soon as possible, and a formalized reversibility procedure defining how data are returned at the end of the contract or upon withdrawal of certification. A page on what HDS certification covers for medical phone calls explains how this applies to a telephone service, and a page on protecting health data in an outsourced medical secretariat describes the safeguards in operation.

Exit: return and destruction of data, reversibility

The end of the contract is where practices are most exposed, because data and appointment history live in the provider’s systems for months or years. Three sources converge on the same clause:

• The CNIL’s processor guide states that, at the end of the service and following the client’s instructions, the processor deletes all data or returns it, and destroys existing copies unless a legal obligation requires retention.
• The CNB model clauses add that the provider must justify the destruction in writing.
• The Les ODF model lets the controller choose between deletion and return, with exceptions where data serve to assert rights in progress or where EU or member state law requires retention.

The contract should also set a format for returned data, a deadline for return, and what the provider continues to do during a transition so that patients are not left without an answer on the phone. The Les ODF model further gives the controller the right to terminate unilaterally when a breach of the subcontracting obligations is proven, a useful template for a termination-for-breach clause.

Liability, insurance and disputes

The contract should say who answers for what. Liability clauses commonly cover damage caused by errors in scheduling or message relay, breach of confidentiality, and failure to meet the data-protection obligations. Whether and how liability is capped is a matter for negotiation and for a lawyer reviewing the specific contract.

On insurance, two separate points apply. First, the practitioner’s own cover: according to a MACSF article, Article L.1142-2 of the Public Health Code requires healthcare professionals in private practice to hold liability insurance, and Article L.1142-25 provides a fine of 45,000 euros and possible prohibition from practice for non-compliance. Second, the provider’s cover: the practice can ask for a certificate of professional liability insurance as an annex to the contract and a commitment to keep it in force.

Finally, the governing law and competent court clause appears in the Service-Public Entreprendre list. For a French practice with a French provider, the clause is simple. Where any processing occurs outside France, the transfer provisions described above should be read together with it.

Perspective

Over more than fifteen years of handling medical calls, we have seen that the contracts which work best are the ones that describe the daily reality of the practice. A good contract names the calendar platform, annexes the practitioner’s own urgency protocol, and says plainly that the secretariat performs administrative tasks and never medical acts.

We also think confidentiality should be demonstrated through organization rather than declared. Dedicated operators trained for healthcare, a clear data-processing agreement and a defined exit procedure give a practice something concrete to rely on. Our approach combines qualified human tele-secretaries with AI support, always within the confidentiality framework that the profession requires.

Flexibility matters as well. Practices change: a partner joins, a schedule shifts, a flu season brings more calls. Clauses on volume, adjustment and notice let the service follow the practice instead of constraining it.

Rudolph Thierry

Choosing a provider whose contract matches these clauses

The clauses above are easier to negotiate with a provider specialized in healthcare, because the vocabulary of calendars, urgency and confidentiality is already familiar to its teams. ClicFone provides outsourced medical and paramedical telephone answering, with appointment scheduling, synchronization with Doctolib, LibreRDV, Maiia and CalenDoc, and coordination of patient calls, delivered by trained human operators supported by AI. Practices can discuss scope, data-processing terms and coverage hours through the ClicFone telephone secretariat page.

For a structured comparison before signing, the guides on how to choose a specialized medical secretarial provider and on criteria for choosing an external medical secretary list the questions to ask.

Pre-signature checklist

1. The mission is described task by task, with exclusions for any medical act.
2. The urgency protocol is annexed and signed by the practitioner.
3. Price, indexation, duration, renewal and notice are stated.
4. Service levels, reporting and corrective measures are defined.
5. Confidentiality undertakings cover every operator and every subcontractor.
6. The Article 28 clause is complete, including breach notification delay and subprocessor authorization.
7. The HDS certificate scope is attached where health data are hosted, with notice of loss of certification.
8. Return and destruction of data, with written justification, are planned.
9. Insurance certificates are annexed, and governing law and court are named.

FAQ

Does an outsourced medical secretariat need a GDPR Article 28 contract?

Yes, whenever the provider processes patient personal data on the practice’s behalf. The Conseil National de l’Ordre des Médecins lists a data-protection clause compliant with Article 28 among the minimum clauses for this type of service. The CNIL publishes example clauses that a practice can use as a base.

Can the provider book appointments in my calendar software?

Yes, provided the contract frames it. It should state the access rights granted, limit them to what the mission requires and provide for traceability. The practice remains responsible for the tools it opens to the provider.

Is HDS certification always required?

It is required for any person hosting personal health data on behalf of a third party under Article L.1111-8 of the Public Health Code. Whether a given phone service falls under it depends on whether health data are hosted, so the contract should state the scope of the certificate explicitly, and a lawyer or the practice’s data protection adviser can confirm the analysis.

What happens to patient data when the contract ends?

The contract should require the provider to delete or return all data, at the practice’s choice, and to destroy existing copies, unless a legal obligation requires retention. Written proof of destruction and a defined return format make this clause enforceable.

Sources

• Service-Public Entreprendre: Externaliser certaines activités de son entreprise
• Conseil National de l’Ordre des Médecins: Protection des données, FAQ
• Certyneo: modèle de contrat de secrétariat médical externalisé
• ITG: Contrat d’externalisation
• Agence du numérique en santé: HDS reference framework requirements v1.1
• CNIL: Sous-traitance, exemple de clauses
• CNIL: RGPD, guide du sous-traitant
• Les ODF: Modèle de contrat de sous-traitant
• CNB: modèle de clauses RGPD de sous-traitance
• Mirabile: Contrat SaaS santé, les clauses à verrouiller
• Atias Avocats: Contrat d’hébergement HDS
• Données Personnelles: RGPD hôpital
• Genesys: Health Data Hosting Addendum
• MACSF: obligation d’assurance RCP
• Imageone: medical records and secrecy
• Filmijob: GDPR compliance guide

Recommended

• Confidentiality Agreements for Medical Secretaries in France: 3 Musts
• 2–4 Week Compliant Pilot to Outsource Medical Calls in France
• Protecting Health Data in an Outsourced Medical Secretariat
• Outsourcing Secretarial Services for Osteopaths: 2026 Guide

LibreRDV-ClicFone Télésecrétariat

ClicFone Télésecrétariat depuis 2010 au service des professionnels de la santé. Permanence téléphonique 7h/20h. Secrétariat téléphonique à distance pour médecins, paramédicaux ou autres praticiens de la santé. Secrétariat humain, empathique et formé aux agendas Doctolib, Maiia, CalenDoc ou LibreRDV mais aussi synchronisé avec Google Agenda, Calendly et Cal.com

See Full Bio

CalenDoc Doctolib Maiia LibreRDV ClicFone Télésecretariat Secretariat téléphonique Permanence téléphonique Médical