Legal news

Non-compliance to the interoperability, ethics, and security standards may be penalized

On March 4, 2026, Decree No. 2026-153 [1] (“Decree”) was published, defining the procedures under which the Minister of Health may impose financial penalties on publishers of digital health services (services numériques en santé - "DHS") in the absence of a certificate of compliance with the interoperability, ethics, and security standards referred to in Article L. 1470-5 of the French Public Health Code ("FPHC"), or for failure to comply with the requirements set forth in those standards.

The Decree assigns the Digital Health Agency (Agence du Numérique en santé - "DHA") a central role in the system, as it is specifically tasked with :

  • administering a portal for collecting reports of failures by DHS publishers to meet their obligations to comply with these standards and to hold a certificate of compliance ;
  • defining an annual program to monitor compliance with the standards ;
  • maintaining, on its website, a list of DHS that do not comply with the obligations set forth in the standards.

The Decree further provides that the National Health Insurance Fund must inform the DHA of any non-compliance it identifies among professionals and facilities using DHS, and that the DHA may conduct on-site visits to verify compliance with these standards and obtain demonstrations of the relevant DHS and their specifications.

When a non-compliance identified by the DHA persists after an order to remedy it, the DHA proposes to the Minister of Health that a sanctioning procedure be initiated. The party responsible for the non-compliance is then invited to submit written comments within one month, after which the Minister may impose a sanction, which may be accompanied by a formal notice to comply with the requirements of Articles L. 1470-5 and L. 1470-6 of the FPHC, along with a daily penalty.

When the party responsible for the violation is a publisher of DHS :

  • the publisher is also required to report to the Minister the amount of pre-tax revenue generated in France for the most recent fiscal year, within fifteen days of receiving notification of the penalty. Failure to do so may result in the financial penalty being increased to one million euros ;
  • the sanction must be published on the DHA’s website.