Healthcare industrials and software publishers are encouraged to contact Health CERT if they discover a security incident or potential malware. CERT provides assistance and support to resolve such issues. CERT also assists you in your communications to health structures.

Generally speaking, the PGSSI-S needs to be applied as soon as personal health data are being handled. It is relevant to the public sector as well as the private sector, health professionals, workers of the social-health and social sectors, healthcare establishments and service providers. 

As a patient, the PGSSI-S is a seal of guarantee on the accountability of digital health ecosystems.

Complying with the PGSSI-S frames of reference is either required by law (if the documents have been approved by a ministerial decree) or meant to be followed on a short-term basis until the documents are approved by the ministry.

There are two main reasons for the creation of IGC-Santé :

• guaranteeing the security of private keys and certificates issued by the ANS: the access to these private keys must be limited in order to prevent duplicates or their installation more than one device;
• maintaining a continuity in services: many health apps used to work on certificates issued by former CKI that ceased their activity in January 2021. These apps must be compatible with certificates issued by the IGC-Santé.

In addition, these certificates meet the security standards (risk analysis, safety policies), or “Certifying Policies” that comply with the PGSS-IS guidelines.

Upgrading your products allows you to offer your customers a solution that complies with current regulations. Failure to meet this requirement will have several impacts: 

• Your customers will not incorporate the INS into their software, which will entail possible penalties with regard to several systems (Ségur Wave 1, HOPEN, portal listing in Mon Espace Santé, etc.) ; 

• Your customers will not be in compliance with the law. They will therefore be responsible for any errors in the identification of their patients and users ; 

• Sharing health data by your customers will be more time consuming ; 

• The identity used by your customers may not be the right one, for instance if a patient uses their married name or if the patient is a child registered under their parent’s social security number.

You may divide your service into as many products as you wish to register on the platform. The appropriate segmentation must correspond to your activity and the roadmaps/processes available on the platform.  

It is important to include all the different versions associated with support or devices as different products, as they could impact the maturity level assessment of your solution.  

In order to make the identification of products easier, each edition and version of the commercialised products needs to be registered. We suggest you use this format to name your product - (Name of the Product) (OS) (Device) - with the following terms: 

• device can be named “Mobile” or “Website” 
• OS can be named “iOS”, “Android”, “Windows”, “Linux” or any other operating system. 

In addition, for registration into Mon Espace Santé (My Health Space): you must add as a product the solution that will be visible to the citizen/user in the service catalogue. The commercial name must be the same as the name visible by the citizen. 

The application for the SI-MDPH label is open to any legal entity with a software solution aimed at the departmental disability centres (MDPHs). This includes the MDPHs themselves, which develop their own solutions in conjunction with the relevant Departmental Council.  

The label application is a voluntary process: Anyone can be a candidate if they feel that their solution complies with the current requirements and the scope of the sector’s functional standards.

Yes, you need to have the ISO 9001 or the ISO 13485 certification to be eligible. You may begin the QHN certification process while you are in the course of making an application for/or renewing these ISO 9001 or the ISO 13485 certifications.

Yes, as long as the industrial remains responsible for the compliance of these processes with the requirements set out to obtain the QHN certification – regardless of hired external contractors or if some of the components are published or made by third-party companies.

Indeed, in the whole production system’s organisation, the industrial is the direct contact with a health professional or structure, and must make sure each requirement set out in the “Référentiel Qualité Hôpital Numérique” (QHN Referential, available in our Documentation section) is met.

When your software gets the label attribution, the successful candidate will receive by email the visual elements you will need to communicate about it.

The editor of the solution (or the solution range) will receive the label after signing the agreement with the ANS. They will be able to use the label on commercial publications, technical documents, with no particular restriction on the type of format used (paper, Internet, intranet, etc.) 
The recipient must mention the level of the label (1 or 2) they obtained. These specifications are set out in the Functional referential (in our Documentation section)

To access your personal account on Convergence, you will need to log in with the “User Name” (“Nom d’utilisateur”) sent to you when you register. This login may differ from the email address associated with your account. 

A user has a unique login and email address on the Platform. Therefore, it is not possible to create two accounts with the same email address or login information. 

A base product (“Produit socle”) is a solution, a service, or device sold by an eHealth industrial, which is aimed at fulfilling the needs of a particular activity, practice or profession. It is not bound to the purchase of a previous product. It may be completed with Option Products (“Produit option”) to extend its functional coverage.

An option product (“Produit option”) is a solution, service, or device sold by an eHealth industrial to meet specific needs extending the functional perimeter of one or several base products (“produits socle”) to which it adds on. This means a base product must be purchased, prior to the use of an option product.

In the case of a base product being offered as an option to another product, we suggest you first declare the product as a “produit socle”. Then you will be able, from this entry, to duplicate and convert the product as a “produit option”.

MSSanté is a secure messaging system that enables authorised professional to share sensitive patient data in a safe manner, in the context of the patient’s care monitoring. As of now, billing and invoicing data are not included in this perimeter.

There are several levels of requirements for a module’s integration into the Hospital Information System. 

The main requirements set out by the referential are: 

• Interfacing, control, security guidelines; 
• Prescription process requirements; 
• National prescription thesaurus integration requirements; 
• Requirements regarding medico-economic and decision processes; 
• Guidelines for ergonomics, functions, and notification alerts; 
• Settings function requirements. 

In total, 139 requirements are used to reach the minimal level of security needed for a solution’s integration into the hospital information system.

The current referential (2017) was written with industry experts. It introduces the particular context of this mission and the goals to reach in order to improve safety measures in neonatology and paediatric reanimation. The referential walks you through the fundamental concepts you need to grasp to understand the several requirements and protocols involved with software development for this sector.

Neonatology is a high-risk practice for two main reasons:

• The patients are extremely fragile (premature babies) 
• 50% of the drugs used in the sector have yet to receive a marketing authorisation.

A survey conducted in 2014 evidenced a risk in the prescription process across the sector. The digitalisation of prescription is among the 41 recommendations that the report issued in order to increase safety levels.

The certificates that the ANS issues are an official means to identify the players of the health sector, persons and organisations. Certificates also act as a seal of quality, making sure that the issuing cryptographic key infrastructures (CKP) are conform to the sector’s best practice standards. Certificates can be revoked in case of failure to comply.

No, a person may only have one e-CPS card at a time.

The CPS card and e-CPS are two complementary means of authentication. A person may use both at the same time, or one or the other according to their preference.

Access to the service may be restricted for the following reasons:

• you do not specialise in occupational medicine
• you work for a private insurance company
• you no longer practise
• your CPS card has expired or been revoked
• your web browser is not compatible
• you are using a mobile appliance (smartphone or tablet)
• you are not included in the following list of health professionals:
  • general practitioners and specialists (radiologists, biologists, independent, employee, Samu-Emergencies-C.15, interns)
  • biological pharmacists and interns
  • pharmacists in dispensaries or hospitals
  • dental surgeon, interns
  • midwives
  • nurses
  • physical therapist
  • pedicure-podiatrists
  • speech therapists
  • ergotherapists, psychomotor specialists, orthopists, dieticians
  • medical radiologists