Healthcare Compliance in France

The French market is open to digital health services, but it is regulated by profession and by channel rather than by a single licence. Clinicians remain bound by their professional orders; telemedicine acts must meet the conditions of the Public Health Code; companies that bill the public health insurer for teleconsultations need ministerial approval; and anyone hosting patient data for others needs a health data hosting certificate.

The principal authorities are the Ministry of Health, which approves teleconsultation companies, the Agence du numérique en santé, which writes and certifies the binding interoperability and security frameworks, and the CNIL for health and biometric data. For a new entrant the biggest obstacle is the approval route: model validation by the ministry, a certified information system and a two-year renewal cycle.

1. Who regulates this sector

Regional health agencies receive the prior declaration of online pharmacy websites (art. L5125-36 CSP).

2. Licensing and authorisation

There is no general "telehealth licence". Registered health professionals practise remotely under the Code de la santé publique (CSP): article L6316-1 defines telemedicine, R6316-1 lists its five acts (teleconsultation, tele-expertise, remote monitoring, remote assistance and emergency regulation) and, under R6316-2, the clinician decides whether a remote act is appropriate.

Teleconsultation companies

A company that employs doctors may claim public health insurance coverage for their teleconsultations only with approval from the ministers for health and social security (art. L4081-1 CSP). It must be a commercial company not controlled by a supplier of medicines or medical devices, and its tools must meet the GDPR and the frameworks in L1470-5 (L4081-2); several doctors require a medical committee with patient representatives (L4081-3).

Under D4081-1 (décret 2026-626, in force since 13 July 2026) the application is electronic and includes the SIRET number, the planned medical organisation, the legal representative's commitments and the ANS certificate for the teleconsultation information system. Ministers decide within four months; approval lasts two years, substantial changes must be notified within one month, and renewal also depends on the quality framework in L161-37 22° CSS (L4081-4 CSP).

Health data hosting and online pharmacy

Anyone hosting personal health data for others needs a certificate from an accredited body (art. L1111-8 II CSP); taking data briefly to enter or digitise them is not hosting (R1111-8-8). Version 2.0 of the health data hosting (HDS) framework, published on 16 May 2024, requires storage exclusively in the European Economic Area and disclosure of any remote access from outside the EU; existing hosts had until 16 May 2026 to recertify. Selling identifiable health data is prohibited (L1111-8 VII). Online sale of medicines is reserved to a community pharmacy's own website (L5125-33), limited to non-prescription medicines (L5125-34) and declared in advance to the regional health agency (L5125-36); the Ordre national des pharmaciens listed 869 authorised sites on 28 October 2026.

3. Identity framework (AML rules do not apply)

Healthcare providers, telehealth platforms and doctors are not obliged entities under France's anti-money laundering regime: article L561-2 of the Code monétaire et financier (version in force since 5 August 2026) lists credit, payment and insurance institutions and certain professions, but no health professions or care providers. Customer due diligence, beneficial ownership checks and reporting to Tracfin therefore do not apply to care activity.

Identity obligations come instead from three health-sector layers:

Telemedicine conditions

Every telemedicine act or telecare activity must guarantee authentication of the professionals, identification of the patient and access to the health data needed (art. R6316-3 CSP).

National Health Identity

The NIR (social security number) is the health identifier for care (art. L1111-8-1 CSP). ANS doctrine requires all health data to be referenced with the INS since 1 January 2021, once the INS is qualified.

Professional identity

Clinicians authenticate to national digital health services through Pro Santé Connect with a CPS smart card or the e-CPS mobile app; connection has been mandatory for national services since 1 January 2023.

4. Identity verification and onboarding

The INS combines the INS number (the person's NIR, or a temporary NIA) with five identity traits: birth surname, birth first names, date of birth, sex and place of birth. Under the ANS INS doctrine, an INS may reference health data only once "qualified": identity validated with a high-confidence means under the national identity-vigilance framework (RNIV 1), and the INS retrieved or checked through the INSi teleservice. The INS framework in force is version 2.0 (arrêté of 13 December 2024).

RNIV 1 (version 2.0, December 2024) accepts: for French nationals, an identity card or passport; for nationals of the EU and certain other countries, a passport, identity card or residence permit; for others, a passport or residence permit; and eIDAS "substantial" or "high" electronic identification, such as the electronic identity card, La Poste's digital identity or the Carte Vitale app. A paper or digital copy without the original cannot validate an identity. Only a "qualified" identity (INS retrieved through INSi and identity validated) may be used in data exchanges.

For a patient who is not physically present, RNIV 1 (section 4.9.4) names telehealth acts and online booking or pre-admission portals as uses for an eIDAS "substantial" or "high" identification means, which can create or upgrade an identity to "validated". Where such a means cannot be used remotely, the patient may be asked to show the identity document to the camera so that the professional can check it and carry out the coherence check. Identity checks still apply when the patient is later seen in person.

The HAS teleconsultation guide (May 2019) applies R6316-3: the identity check is traced, the patient must be able to show photo ID on request, the clinician knows the patient's exact location and phone number and uses two-factor authentication, and consent to the remote format is recorded.

The Carte Vitale app as a remote identity route

Issuing the Carte Vitale app requires remote identity verification (art. R161-33-13 Code de la sécurité sociale): an electronic identity card used with the State's digital identity guarantee service (SGIN, created by décret 2022-676, the route used through France Identité) or, failing that, a face match between the person's image and the ID photograph, run by the health insurance funds, with templates destroyed within 96 hours of activation (R161-33-18). RNIV 1 describes the second route as a certified remote identity verification provider (PVID) "or equivalent". In 2022 the CNIL asked for the SGIN route to be favoured and video enrolment progressively abandoned, and noted that in-person enrolment remains available. RNIV 1 treats the INS read from a holder's own app as qualified.

Article R6316-4 requires the report of the act, prescriptions, the professionals' identities, date and time and any technical incidents to be recorded in the patient's file and, where applicable, the shared medical record (DMP).

5. Digital channels: what's different

Bottom line: the duty to identify the patient is the same in the surgery and on screen, but remote care adds clinician authentication, patient location, limits on sick notes and a ban on prescribing without a live exchange.

Sick notes and prescriptions online [In force since 27 Jun 2026]

Article L6316-1 CSP, as amended by loi 2026-534 of 25 June 2026 (found constitutional before promulgation, decision 2026-904 DC), caps a telemedicine sick note or its first renewal at three days and bars later remote renewals, unless the regular doctor or referring midwife prescribes it or the patient justifies being unable to see a clinician in person. Online services whose main activity is issuing prescriptions may prescribe only after a synchronous video or telephone exchange. A clinician practising mainly abroad cannot issue any sick note by telemedicine.

Reimbursed teleconsultations

The Assurance Maladie (21 January 2026) reimburses teleconsultations within the coordinated care pathway, with exceptions such as patients under 16 or without an available regular doctor. The consultation must be by video, the doctor must be near the patient's home (with exceptions), and no doctor may do more than 20% of annual activity remotely (40% for psychiatrists), a cap that applies individually to platform-employed doctors.

Certified teleconsultation systems

The ANS teleconsultation framework version 1.5.1, binding since the arrêté of 18 October 2024, covers among other domains GDPR, the INS, Pro Santé Connect, health information-system security, ethics and territoriality, billing and digital prescriptions. Since 31 December 2025 a definitive certificate is required for any approval application.

What is changing

The ANS states that the certification obligation will later extend to teleconsultation software used in health centres and private practice [Announced, date not set]. The 2027 social security financing bill (n° 3211) would let ministers restrict antibiotic prescribing by telemedicine and open reimbursement of assisted teleconsultations by nurses employed by teleconsultation companies [Bill, not enacted]; the National Assembly rejected it at first reading on 23 October 2026.

6. Data protection and biometrics

Article 6 of loi 78-17 (Informatique et Libertés) prohibits processing health data and biometric data used to identify a person uniquely unless an exception in article 9(2) GDPR applies. Care processing by health professionals needs no CNIL formality but must appear in the record of processing (CNIL, May 2024). Since 28 May 2026, other health processing, such as data warehouses, must conform to a CNIL framework and be declared, or be authorised (art. 66). The CNIL's non-binding framework for medical practices (2020) indicates legitimate interest as the basis for telemedicine, expects an impact assessment and a data protection officer for shared systems above 10,000 patients a year, and recommends two-factor authentication with the CPS card. The CNIL's impact assessment list covers telemedicine in health establishments and biometric identity checks of patients.

The CNIL's multi-factor authentication recommendation (20 March 2025) accepts biometrics only on explicit consent unless a legal text requires or explicitly authorises them, says they cannot be imposed without an alternative, and prefers templates on a device under the user's exclusive control. For the decree-based Carte Vitale app, the CNIL noted in 2022 that face matching only checks that the person holds the identity document; in May 2023 it opposed a biometric Carte Vitale. Breaches must be notified to the CNIL within 72 hours.

7. Sector-specific obligations

Digital prescriptions

Since 22 December 2023, prescribers must issue prescriptions for care, products or services electronically and transmit them through the teleservices provided by the national health insurance fund (art. L4071-1 and L4071-3 CSP); dispensing professionals transmit execution data the same way (L4071-2). Prescriptions both issued and filled inside hospitals are excluded (L4071-4), and paper remains allowed where the patient cannot be identified through the dedicated digital health services (R4073-2 5°).

Professional ethics on platforms

In March 2023 the CNOM warned doctors using the FEELI platform of disciplinary risk: the "teleconsultation" was a message exchange, patients did not know in advance which doctor would respond, and reimbursement and fee information breached the rules.

8. Risk indicators and red flags

Telehealth fraud and identity-abuse indicators

• Questionnaire-only prescribing: prescriptions or sick notes issued without a live video or phone exchange.
• Serial remote sick notes: renewals by telemedicine, or notes longer than three days, outside the regular-doctor exception.
• Offshore prescribers: sick notes issued by a clinician practising mainly abroad.
• Anonymous clinician: the patient cannot see who will treat them before the consultation.
• Unqualified identities: health data filed under an INS not checked against a high-confidence means or INSi, or "validated" from an uploaded copy.
• Shared or single-factor logins: clinicians using shared accounts or passwords alone.
• Unlisted pharmacy sites: prescription medicines offered online, or sites absent from the Ordre list.
• Silent data harvesting: software that copies insurer data into patient files without a choice to consult only.

9. Enforcement and penalties

The CNIL may fine up to €10 million or 2% of worldwide turnover, whichever is higher, or €20 million or 4% for the breaches in article 83(5) and (6) GDPR, and order processing limited or stopped (art. 20 loi 78-17). It fined HÔPITAL PRIVÉ DE LA LOIRE €500,000 on 21 July 2026 after an attacker used remote access without VPN or multi-factor authentication to reach 524,867 patients' records; IQVIA OPERATIONS FRANCE €5 million on 26 May 2026 over health data warehouses, including missing multi-factor authentication; and CEGEDIM SANTÉ €800,000 on 5 September 2024 for an unauthorised warehouse, upheld by the Conseil d'État on 13 February 2026. In the warehouse cases pseudonymised data were treated as personal data. Hosting health data without HDS certification is punishable by three years' imprisonment and a €45,000 fine (art. L1115-1 CSP).

For teleconsultation companies, article L162-1-15 I bis of the Code de la sécurité sociale (as amended by loi 2026-534) lets a local health insurance fund director, after hearing the company and where the medical control service finds the listed situations, make coverage of its acts, prescriptions or sick-leave payments subject to prior medical approval for up to six months. Clinicians remain answerable to their professional order.

10. Recent changes and what to watch

• 23 October 2026[Bill, not enacted] The National Assembly rejected the 2027 social security financing bill at first reading; its telehealth articles (antibiotic prescribing, nurse-assisted teleconsultation) remain proposals.
• 13 July 2026[In force] Décret 2026-626 rewrites D4081-1: electronic application, ANS certificate, four-month decision, two-year approval. Prepare renewal files early.
• 27 June 2026[In force] Loi 2026-534 tightens L6316-1: three-day cap on remote sick notes, no remote renewals, live exchange before online prescriptions. The same law lets health insurance funds put a teleconsultation company's billing under prior medical approval for up to six months.
• 16 May 2026[In force] End of the HDS transition: all certified hosts must meet framework version 2.0, including storage in the European Economic Area.
• 31 December 2025[In force] End of the ANS transitional milestones: a definitive certificate under framework v1.5.1 is now needed for approval.
• 26 March 2027[Adopted, applies 26 Mar 2027] European Health Data Space Regulation (EU) 2025/327; patient-access and electronic health record rules apply from 26 March 2029 for patient summaries, e-prescriptions and e-dispensations, and from 26 March 2031 for imaging, test results and discharge reports.
• Date not set[Announced, date not set] ANS certification to extend to teleconsultation software in health centres and private practice.

11. What this means for identity verification

• Capture the five INS traits (birth surname, birth first names, date of birth, sex, place of birth) from the identity document.
• Remote validation needs a strong means: under RNIV 1 an eIDAS substantial or high digital identity, such as the Carte Vitale app, validates an identity; the fallback is the original document shown on camera to a professional; an uploaded copy or scan does not.
• Validate identity with a high-confidence means before filing data under the INS, and call INSi; keep a provisional status until both are done.
• Treat clinician authentication as part of onboarding: two factors, with Pro Santé Connect (CPS or e-CPS) where the service connects to national systems.
• Record the evidence: who checked identity, how and when, alongside the R6316-4 record of the act.
• Face matching needs explicit consent and an alternative unless a legal text authorises it (CNIL, March 2025); keep templates briefly, as the Carte Vitale app does with 96-hour deletion.
• Re-identify at each act: R6316-3 applies to every remote act, and the ANS still requires an identity check when the patient is received.