The accountability framework defines the means that can be used to:

• ensure traceability of actions carried out in relation to a healthcare IS;
• guarantee the value of recorded traces;
• control the use made of this healthcare IS.

In an inclusive way, all digital services aimed at citizens and useful for their healthcare can apply. Eligible services must be for the use of patients/citizens and proposed by public or private actors in the medical (health, wellness), social-medical, or social fields. The services must be included the definition set out by the L. 1111-13-1 bill:  

These services may include mobile apps, websites, connected objects, medical devices. They may be free services or not.  

Services in the realm of the EU regulation 2017/745 relating to medical devices must be conform to security and performance requirements. If your solution passes the conformity requirements, it will receive the CE label for medical devices.

Health CERT operates on weekdays between 9am and 6pm. Aside from these working hours, it is possible to contact the ANSSI to signal risks. 

CERT Santé 
+33 (0)9 72 43 91 25 
Agence du Numérique en Santé 
9 rue George Pitard, 75015 Paris

Yes. The ANS has a video platform with training material, including cybersecurity support. You will find information about cybersuveillance auditing, how to signal a security risk, how to increase your password security, and how to identity malicious email.

Your level of access to the ROR data depends on the nature of the data you wish to use (public/restricted) and the perimeter you wish to cover (one ROR or several ROR directories).

The ROR data in public access:

• is available as opendata since mid-2022;
• will be available directly on the national ROR with no specific procedure in early 2023.

The ROR data in restricted access (professional access):

• for one regional ROR, you must complete a request form to join the regional circle of trust and send it to the region’s GRADeS;
• for several ROR directories, you must complete a request form to join the national circle of trust and send it to the ROR program team.

Healthcare industrials and software publishers are encouraged to contact Health CERT if they discover a security incident or potential malware. CERT provides assistance and support to resolve such issues. CERT also assists you in your communications to health structures.

PLATINES is a platform dedicated to interoperability tests for eHealth. It stimulates a ROR (version 2.4) and gives you the opportunity to use “test” data via several professional cases (a total of 94 test scenarios are available). These test scenarios are valid for the current ROR as well as the national ROR.

You must contact the ROR program team to request access to PLATINES.

In order for your service to be referenced in the My Health Space database, it must comply with the eHealth doctrine.

The doctrine is re-edited each year and defines the base rules of good practice for security, interoperability, and ethics applicable to eHealth services.

My Health Space includes the following health data: 

• The medical profile entered by the patient, in an unstructured format (preconditions, allergies); 
• Health measurements (weight, height, BMI, temperature, waist size, heart rate, blood pressure, glycemic index, level of pain) in FHIR format;  
• Health documents (for example: test and diagnosis results, hospitalisation reports, medical treatments).