Protecting Health Data in the Workplace: Balancing Confidentiality, Multidisciplinary Collaboration, and Regulatory Compliance
Conference of April 1, 2025 on data protection and security.
👉 Contents
A broad legal framework
Information sharing within a multidisciplinary team
Employees’ rights over their data
Personal data protection has become a major issue across all sectors of activity, and particularly in occupational health. Because of their sensitivity, health data are subject to strict regulations. How can data be protected while still allowing multidisciplinary teamwork and information sharing to better support workers?
To find answers to these questions, Dr Christophe Garchery, Deputy General Manager at Prevlink, shares his experience and his thinking on how to reconcile legal requirements with practical challenges.
A broad legal framework
What exactly are we talking about?
The notion of health data is very broad, and this breadth makes protecting it all the more complex!
In the field of traditional care, the Public Health Code states that health data can be shared between all professionals.
Article L.1110-4 of the Public Health Code governs the sharing of information between healthcare professionals involved in care and prevention. However, it does not apply directly to Occupational Health and Prevention Services (OH services), which are not among the establishments concerned. An equivalent text in the Labour Code would therefore have been needed to say that the same applies to OH services. So the question arises: what data can be communicated?
Medical file and personal notes: what data is really accessible?
Where should data be stored? What do you do when you hold this type of information?
What about healthcare professionals’ personal notes?
While the Public Health Code presents them as neither transmissible nor accessible, the Commission for Access to Administrative Documents (CADA) qualifies this notion, considering that a note recorded in an establishment’s core business software loses its personal character and therefore becomes accessible.
“Confidential notes taken during consultations cannot lead to the notes of a physician, held and kept by a healthcare establishment, being classed as personal notes: they have necessarily lost their personal character and are consequently subject to the right of access.”
CADA Opinion 20194112, session of 16/01/2020
Source:Â https://cada.data.gouv.fr/20194112/
Information sharing within a multidisciplinary team
Teamwork is an increasingly common reality today, particularly in occupational health. How can information sharing within multidisciplinary teams be organised while guaranteeing the confidentiality of health data?
The special case of the occupational health visit
In healthcare, the whole team working under the physician’s authority (nurses, assistants) has access to the patient’s data.
In occupational health, the legislator has not fully adopted this logic. While the requirement for explicit consent to share this data has been removed, opportunities to object have been introduced, such as an employee’s ability to refuse the nurse access to their file.
This provision leads to divergent practices among OH services:
Some consider that, without access to the file, the nurse cannot carry out their mission, and so refer the employee to a consultation with a physician.
Others keep the visit going because of organisational constraints.
The case of Prevention of Professional Disinsertion (PDP) and job retention (MEE)
The effectiveness of prevention and job retention now relies on close collaboration between different areas of expertise within OH services: occupational physicians, nurses, social workers, psychologists, and so on. This multidisciplinary approach runs directly up against the need to preserve the confidentiality of health data.
An echo of the Public Health Code?
In the context of Prevention of Professional Disinsertion, we speak of consent rather than objection. In practice, this requirement does not pose a major problem: an employee who refuses to share information will not be able to fully benefit from the scheme.
“In occupational health, the physician faces a major challenge: sharing just enough health data to allow multidisciplinary care, without knowing how or where to pass on this information without violating the patient’s confidentiality.” Dr Christophe Garchery, Deputy General Manager at Prevlink
Faced with this challenge, Prevlink has developed strategies such as:
Sharing secure links to a restricted version of medical files via padoa
A policy of deleting emails after six months.
The complexity increases in certain specific cases, such as when specialist physicians intervene at the request of the occupational physician. The question of information sharing between these physicians remains without a clear, unified answer, with practices varying from one service to another.
In this context of overlapping regulations, services must make documented trade-offs to limit risks. The key remains documenting the reasoning. The small amount of case law on the subject sheds little light on these contradictions, which reflects an absence of litigation, and that is reassuring.
Employees’ rights over their data
As concerns about personal data protection intensify, employees’ requests are multiplying: deletion of data, revision of diagnoses, and so on. These requests, however, run up against a strict and often poorly understood legal framework.
The GDPR grants data subjects five fundamental rights: the right of access, erasure, objection and rectification, and respect for the principle of proportionality.
How do these rights apply in practice?
Dr Christophe Garchery gives his view on the matter:
Right to object: This right normally allows a person to refuse the processing of their data. In occupational health, it quickly reaches its limits. Indeed, creating the medical file is a legal obligation imposed by the Labour Code. The OH service therefore cannot depart from it: this right is, in effect, inapplicable in this context.
Right of access: It is recognised, but regulated. Certain information, such as the physician’s personal notes or data provided by a third party, may be excluded from consultation. Access is therefore partial and subject to conditions.
Right to erasure: Here again, this right cannot be exercised. Medical data must be retained for a period defined by regulatory texts. Early deletion is therefore not possible, even at the employee’s request.
Right to rectification: This point raises particular questions. The information in the medical file reflects the analysis and interpretation of a healthcare professional at a given moment. Even if an item of data seems inaccurate, it records what was observed or understood at that time. It has historical value and therefore cannot be changed after the fact. A medical correction is made by adding new observations, not by altering previous ones.
Principle of proportionality (or minimisation): This principle requires that only strictly necessary data be collected. In occupational health, the relevance of a piece of information is for the healthcare professional to judge. It is up to them, whether physician or nurse, to determine whether the data is necessary for their mission.
Of the five rights provided by the GDPR, only two can therefore genuinely apply in this context, and even then only partially. This situation can create misunderstanding, or even complaints.
Access to the medical file: between the right of access and field realities
When an employee wishes to access their data, two legal frameworks may be invoked:
Le RGPD, qui permet l'accès à l'ensemble des données personnelles
Le Code de la Santé Publique, qui encadre spécifiquement l'accès au dossier médical
This duality raises a central question: what information really belongs in the medical file?
Take the example of the Occupational Disinsertion Risk Index: some services consider that it is not part of the medical file. Their reasoning: it is difficult to assess a risk objectively if that assessment were systematically made known to the person concerned. Moreover, the Labour Code does not explicitly list this index as something that must be part of an occupational health medical file.
Likewise, some sensitive information, such as the causes of unfitness, although necessary for studies or institutional requests, is rarely included in the main medical file.
“Today, practices vary greatly from one service to another, including among the fifty organisations we support, whether autonomous or inter-company. Everyone is trying to reconcile regulatory requirements, the authorities’ recommendations and the reality on the ground.” Nicolas Telle, Co-fondateur padoa
In practice, many services choose pragmatism: keeping a complete record of the information internally, but providing the employee only with the items judged relevant and reliable.
This approach raises questions of GDPR compliance: should everything be considered a single processing activity, the medical file, or should several processing activities with different purposes be distinguished: one for the medical file and one for the information collected on the employee outside the medical file?
A word from Maître Marguerite Brac de la Perrière, Partner at Fieldfisher
There is still little case law on this subject, which leaves some room to clarify any contradictions. It is nevertheless reassuring to note that there has been little litigation to date.
It is essential that these choices regarding data processing, documented in particular in your records, are consistent with your privacy policy. In the event of an access request, you will need to be able to provide the requested data in accordance with that policy.
Active sharing of best practices and collective reflection within the profession are essential to meet these complex challenges.
The key here is consistency between your trade-offs and your documentation!
padoa
the collaborative prevention platform
âś… An ergonomic, user-friendly platform
âś… Enter data once, see it everywhere in all dedicated spaces
âś… Triple certification (HDS, ISO 27001 and ISO 27701) for data security and protection
âś… Simple, data-driven management of your activity
âś… Rapid deployment in just a few months, plus Qualiopi-certified training for easy adoption
âś… Long-term, close-to-the-field support
