AI for French Doctors: Medical Secrecy Under Pressure

The answer fits in one line. AI can help draft and summarise, but never with identifying patient data. A report, a letter, a synthesis: the clinician is tempted to paste the full record into a consumer ChatGPT. Yet that record holds a name. Symptoms. A diagnosis. This is health data, the most sensitive there is. Two French rules stand against it. Le secret médical, medical secrecy, a duty of public order. And the HDS regime, the hosting of health data. There is a clean method: ask your questions, but anonymise before you send.

Medical secrecy is a legal duty, not an internal policy

Le secret médical is not a matter of courtesy. It is a legal duty at the heart of practice. Its basis is article L.1110-4 of the Code de la santé publique (CSP), the French public health code. The code of medical ethics restates it in article R.4127-4 CSP. The Conseil National de l'Ordre des Médecins (CNOM), the French medical council, publishes it as « article 4 ». This duty binds every professional in the health system.

Its reach is very broad. The secret covers all information that comes to the doctor's knowledge. Not only what the patient confides. Also what is seen, heard or understood during care. A name tied to a reason for consultation already falls inside this scope. Pasting such information into a third-party tool not meant for it steps outside the legal frame.

Sharing between clinicians is itself framed. It is allowed only within a strict scope. Between identified professionals who take part in the same patient's care. And only for information strictly necessary to the coordination or continuity of care. A consumer AI meets none of these conditions.

The distinctive French point: HDS hosting

France adds a rule of its own. Hosting personal health data requires a certified HDS host (Hébergeur de Données de Santé, a certified health-data host). The basis is article L.1111-8 CSP. Since 2018, this certification has replaced the old ministerial approval.

The certification is not a mere declaration. It is issued by a body accredited by COFRAC, the French accreditation authority. It rests on frameworks steered by the Agence du Numérique en Santé (ANS), the French digital health agency. These frameworks build on ISO-type security requirements, including the ISO 27001 standard. The revised framework even tightens rules on transferring data outside the European Union.

The consequence is clear. A general consumer AI is not a certified HDS host. Pasting patient data into it is not only a confidentiality leak. It is also a breach of the HDS regime. This point is specific to French health law. It adds to medical secrecy, it does not replace it.

Under the GDPR: special-category data

European law points the same way. Health data is special-category data under article 9 of the GDPR. It is also called « sensitive ». Its processing is prohibited in principle. It is allowed only in framed cases, one of which is care.

The CNIL is France's data protection regulator. It publishes frameworks and guides dedicated to health to frame these processing operations. It urges caution on AI, but it did not ban ChatGPT in France. It was the Italian authority, the Garante, that ordered a temporary block in 2023. The CNIL chose instead a path of guidance and recommendations.

In plain terms: pasting a patient record into a consumer AI is not a harmless move. It is processing health data, the most protected category under the GDPR. Medical secrecy keeps binding you, whatever the tool.

The fix: anonymise before you send

Good news: AI is still useful for a clinician's work. It can help structure a report. Reword a letter to a patient. Summarise a body of literature. For that, it needs no identifying data. Ask the request in general terms. Keep the name, the date of birth, the address and the diagnosis out of the prompt.

When a concrete case is truly needed, anonymise it first. Replace each identifying field with a token. The AI reasons about the clinical shape, without ever seeing the real values. You restore the real values afterwards, locally. For hosting health data, reserve it for vetted, HDS-certified tools.

1. 1Spot the identifying fields: name, date of birth, address, diagnosis.
2. 2Replace them with reversible tokens, in the browser.
3. 3Send only the anonymized text to the AI.
4. 4Restore the real values in the reply, locally.

• Never paste an identifying patient record into a consumer AI.
• Check that a health tool is HDS-certified before trusting it with data.
• Remember that medical secrecy binds you, whatever the tool.

That's what ONYRI Sanitize is for. The engine detects sensitive data — name, date of birth, address, clinical details — and replaces it with reversible tokens before sending. Detection and the mapping stay in your browser. Only anonymized text reaches the model. The AI finds only tokens, never your patient's identity. You get the help, without breaking the medical secrecy the law requires of you.