To make sure your software complies with the guidelines required to implement INS into software, several documents are available:

The list of connected services is available online.

There are two steps to follow:

Step 1: Administrative phase

Should you wish to order test CPS cards or register authorisations for test software, you may:

• read our complete products offer ;
• place an order
  To place an order, select your Profile and your Structure, then choose “Produits de développement. Commander des produits de développement : carte et/ou certificat logiciel de test" (Test products for products, cards and/or test software).

Step 2: Technical phase

Use the card you validated after step 1 in order to connect with the Trusted Platform IGC-Santé. You will be able to order, withdraw, monitor and revoke test certificates through the IHM or Webservice interface.
In order to do so, make sur you have inserted your test card in the card reader. 

Read more about specific setup guidelines:

The open access data is free to download. However, the user must be mindful of the General Conditions when working with the Health Pro Directory information.

There are two search options in the Health Pro Directory:

• A keyword search (Who ? What ? Where ?) that allows you to find professionals in matching establishments;
• A detailed search (Profession, specialisation, skills, ID, place of practice) to target health professionals or health structures.

Guarantees are set out on the dedicated page.

The RPPS has restricted access content. You need to log in to the Health Pro Directory to access these data. The use of a CPS card as means of authentication is required:

• if you carry a Director of Establishement (CDE) card or a liberal CPS card, you may automatically access the information whose access is granted to you;
• in other cases, accessing the directory with a CPx-type card may need a prior enrolment process with the ANS. You will need to fill a RPPS access request form.

You need a card reader in order to authentify yourself with a CPx-type card.

For further information, read our pages to the CPS and e-CPS.

In order to request test products for certificates (CPS cards and test software certificates) issued by the IGC-Santé, go to our service page for the IGC-Santé.

Our partner, the GIE Sesam-Vitale, is here to provide you with support and answer your questions about your software project, how to integrate INSi, or solve any potential technical setbacks. 

The helpdesk is available by phone at +33 (0)2 43 57 42 88, from 9am to 12noon, and from 2pm to 6pm, Monday to Friday. You may also send an email to centre-de-service@sesam-vitale.fr.

In order to make the check lists more transparent and reduce the risk of seeing your Ségur application denied, we have published a document listing common mistakes, which is available below:

It is compulsory to have an individual CPx-type card to log in to the INSi teleservice. Three types of cards are supported: CPS, CPE, CPF. 

Your level of access to the ROR data depends on the nature of the data you wish to use (public/restricted) and the perimeter you wish to cover (one ROR or several ROR directories).

The ROR data in public access:

• is available as opendata since mid-2022;
• will be available directly on the national ROR with no specific procedure in early 2023.

The ROR data in restricted access (professional access):

• for one regional ROR, you must complete a request form to join the regional circle of trust and send it to the region’s GRADeS;
• for several ROR directories, you must complete a request form to join the national circle of trust and send it to the ROR program team.

The update frequency depends on the source of the data. Data is updated daily when it comes from entities such as: national councils for the Ordres, the army health service, the FINESS directory, the CPx card information system; the MSSanté information system. Data coming from regional health agencies is updated on a weekly basis.

CPx cards issued before December 2020 have a contactless chip that prevents from overwriting its code.

The new CPS R3V3 cards that are now in circulation have a Mifare Desfire chip. These cards can stock crypto-secret keys that work with the Mifare Desfire protocol.

All the information about this feature is available in the Manual to deploy contactless CPx cards (available to download below). One must be cautious about the data inserted in the chip’s writing code.

We strongly advise against using this section of the chip to stock access rights. The ANS recommends you to use the ANSSI guidelines on using a "transparent" reader in connected mode. This does not involve a cryptographic protocol during a badge authentication – only the UTL (logic treatment unit) takes part in the cryptographic protocol.

ANSSI advises against setting up a “smart” badge allowing a double authentication breaking from the UTL.

All the recommendations on securing systems for physical access and video projection are available in the document below, "Recommendations on securing systems for physical and video projection access".

The IGC-Santé is dedicated to the health sector and follows strict procedures in terms of data collection, professional identification, and works with certified authorities (RPPS register, etc.).

The certificates issued by the IGC guarantee the security of software or electronic cards, such as the CPS card.

The IGC also manages the publication of these certificates and can revoke them – this is signalled to the apps using certificates in revocation listings.

There are two main reasons for the creation of IGC-Santé :

• guaranteeing the security of private keys and certificates issued by the ANS: the access to these private keys must be limited in order to prevent duplicates or their installation more than one device;
• maintaining a continuity in services: many health apps used to work on certificates issued by former CKI that ceased their activity in January 2021. These apps must be compatible with certificates issued by the IGC-Santé.

In addition, these certificates meet the security standards (risk analysis, safety policies), or “Certifying Policies” that comply with the PGSS-IS guidelines.

Upgrading your products allows you to offer your customers a solution that complies with current regulations. Failure to meet this requirement will have several impacts: 

• Your customers will not incorporate the INS into their software, which will entail possible penalties with regard to several systems (Ségur Wave 1, HOPEN, portal listing in Mon Espace Santé, etc.) ; 

• Your customers will not be in compliance with the law. They will therefore be responsible for any errors in the identification of their patients and users ; 

• Sharing health data by your customers will be more time consuming ; 

• The identity used by your customers may not be the right one, for instance if a patient uses their married name or if the patient is a child registered under their parent’s social security number.

The certificates that the ANS issues are an official means to identify the players of the health sector, persons and organisations. Certificates also act as a seal of quality, making sure that the issuing cryptographic key infrastructures (CKP) are conform to the sector’s best practice standards. Certificates can be revoked in case of failure to comply.

No, a person may only have one e-CPS card at a time.