Since 2024, the CNIL has issued 45 sanctions for “failure to cooperate”, including against private-practice healthcare professionals.
๐๐ก๐๐ญ ๐ข๐ฌ ๐ข๐ญ ๐๐๐จ๐ฎ๐ญ? According to the CNIL, a healthcare professional fails to meet their duty to cooperate when they don’t respond, or don’t respond fully enough, to its requests during an investigation opened after a patient’s complaint.
Mathilde Croze, our partner in the Tech/Data practice with strong expertise in the healthcare sector, explains this often-underestimated risk for Egora:
โช๏ธ ๐๐ง ๐จ๐๐ฅ๐ข๐ ๐๐ญ๐ข๐จ๐ง ๐๐ข๐ฌ๐ญ๐ข๐ง๐๐ญ ๐๐ซ๐จ๐ฆ ๐ญ๐ก๐ ๐ซ๐ข๐ ๐ก๐ญ ๐จ๐ ๐๐๐๐๐ฌ๐ฌ
๐ A patient exercises their right to access their medical record. If they think the response is incomplete, late or missing, they can refer the matter to the CNIL, which then contacts the doctor directly. The doctor must respond both to the patient and to the CNIL.
โช๏ธ ๐ ๐ฌ๐ญ๐๐ง๐๐๐ฅ๐จ๐ง๐ ๐ฌ๐๐ง๐๐ญ๐ข๐จ๐ง
๐ Failing to respond to the CNIL’s requests, or responding late or incompletely, is enough to count as a failure to cooperate, even if the patient’s original request was handled properly.
โช๏ธ ๐ ๐ซ๐๐๐ฅ ๐๐ข๐ง๐๐ง๐๐ข๐๐ฅ ๐ซ๐ข๐ฌ๐ค
๐ Fines are capped at โฌ20,000 under the simplified procedure, rising to โฌ4,000 when the failure to cooperate comes on top of a proven breach of the right of access.
๐๐๐ฒ ๐ญ๐๐ค๐๐๐ฐ๐๐ฒ: when you receive a right-of-access request or a letter from the CNIL, the key is to respond transparently. A prompt, well-documented response often ends the procedure without any sanction.
