A right built on consent
French health data law rests on a clear principle: patients hold the right to control access to their own information. That principle is encoded in the Code de la santé publique and reinforced by GDPR, which treats health data as a "special category" requiring explicit protections. In practice, it means no professional — however qualified — opens your file simply because they're treating you.
The main digital vehicle for this is Mon Espace Santé, the national health space launched in 2022 and assigned by default to every person with health insurance. Within it, each holder can mask individual documents — a test result, a hospital discharge summary — so that a given professional cannot see them. The choice is theirs, not the clinician's.
How access actually works
When a professional opens Mon Espace Santé, they authenticate through a dedicated professional card (the Carte de Professionnel de Santé, or CPS). That card establishes their legal identity and their role — a pharmacist does not hold the same access rights as a GP. The system then checks whether the patient has granted access and whether the specific document falls within that professional's scope.
Your médecin traitant — your declared GP — typically has the broadest routine access, because the entire reimbursement architecture encourages a continuous relationship with one doctor. Other professionals see what you, or the logic of care, permits. Emergency services sit in a separate category: for genuine emergencies, a limited accès bris de glace ("break-glass" access) allows clinicians to read essential information — blood type, allergies, serious diagnoses — even when a patient cannot consent in the moment.
Shared-care structures such as maisons de santé pluriprofessionnelles (multi-professional health centres) involve agreed local protocols, but patient consent still governs what the team sees. Hospitals use their own internal systems (dossiers patients informatisés) that do not automatically connect to Mon Espace Santé, though documents can be imported with the patient's agreement.
The gap between right and reality
The consent framework is real, but exercising it requires awareness. Most people have never visited their Mon Espace Santé account, let alone adjusted its privacy settings — adoption has been slow. A document uploaded by a hospital exists in the system whether or not the patient knows it's there. The right to mask it is genuine; the chance that someone will use it is lower. Understanding that you have these controls is, practically speaking, the first step to using them.