What is SNDS?

The National Health Data System (SNDS) brings together the main existing French public health databases in a strictly anonymous manner (Law Article 1461-1-1).

 

Managed by CNAM, the SNDS includes the following data in particular:

• the SNIIRAM database containing health insurance data (data derived from the processing of healthcare reimbursements, electronic or paper care sheets) ;
• the PMSI database, containing data derived from the activity of healthcare establishments;
• the CepiDC database, managed by INSERM, containing data on causes of death;
• disability-related data from the maisons départementales des personnes handicapées.

 

SNDS data processing is subject to the provisions of the French Data Protection Act (Loi Informatique et Libertés), the European Data Protection Regulation (RGPD) and the French Public Health Code.

 

How does EPI-PHARE access the SNDS?

EPI-PHARE, a scientific interest grouping between ANSM and Cnam, does not collect health data.

 

EPI-PHARE studies are carried out in compliance with French regulations governing access to and processing of personal data of the SNDS. EPI-PHARE accesses the SNDS via the permanent accesses of its supervisory bodies, in application of the provisions of Decree n°2016-1871 of December 26, 2016 relating to the processing of personal data known as the “Système National des Données de Santé”, the articles of law Art. R.1461-13 and R.1461-14 of the French Public Health Code and the deliberation CNIL-2016-316 of the Commission nationale de l’informatique et des libertés (CNIL).

 

In accordance with this permanent regulatory access by ANSM and CNAM, the work carried out by EPI-PHARE does not require an opinion from CESREES or specific authorization from CNIL.

 

Data processing by EPI-PHARE

All SNDS processing is carried out by duly trained and authorized staff in profile 30 or 108, via direct access to the SNDS portal, without extracting native data locally, and following strong security and authentication measures.

 

Data processing operations are declared in the EPI-PHARE register of data processing operations requiring use of the SNDS.

 

Data processors.

The data controllers are Ms Catherine PAUGAM-BURTZ, Director General of ANSM, and Mr Thomas FATÔME, Director General of CNAM.

 

Processing objectives.

The purpose of the SNDS data processing implemented by EPI-PHARE is to carry out and manage pharmaco-epidemiological studies to investigate the use, misuse, benefits and risks of healthcare products, and to measure the impact of healthcare decisions, with a view to informing the decision-making of public authorities.

 

Purposes of processing.

The processing carried out by EPI-PHARE falls within the scope of one of the following purposes: Information on health and healthcare provision / Definition, implementation and evaluation of health and social protection policies / Knowledge of healthcare expenditure, information for healthcare professionals and establishments on their activity / Surveillance, monitoring and health safety / Research, study, evaluation.

 

Data used.

EPI-PHARE mainly uses data from the French National Health Data System (SNDS). EPI-PHARE may occasionally use other health data in addition to SNDS data. EPI-PHARE does not collect health data.

 

Data categories.

EPI-PHARE may use the following sensitive SNDS variables: Year and month of birth / Municipality of residence or sub-municipal location data / Date of care / Date of death / Municipality of death.

 

Data retention period.

EPI-PHARE accesses data via the SNDS portal and does not extract any native data locally. Remote tables are kept for as long as necessary to meet the health security requirements of its supervisory bodies.

 

Data recipients.

For each study, data are processed exclusively by the personnel assigned to the study. Apart from the people assigned to a study, no other person inside or outside EPI-PHARE is a data recipient.

 

Data transfer outside the EU.

No data is transferred outside the European Union.

 

Security measures.

Access to the SNDS portal via a secure https url, unique SNDS identifiers and unique codes generated by a personal calculator, professional computers managed by ANSM or CNAM and protected (personal access after strong authentication, security updates, anti-virus, firewall…).

 

Can EPI-PHARE distribute SNDS data?

EPI-PHARE cannot distribute SNDS data.

 

However, any person or organization, public or private, profit-making or not, may access SNDS data with authorization from the Commission Nationale de l’Informatique et des Libertés (CNIL) via the French Health Data Hub in order to carry out a study, research or evaluation of public interest.

 

Right of access and opposition

Although SNDS data is “pseudonymized” to protect the privacy of individuals, its confidentiality is guaranteed by law.

Data subjects have rights of access, rectification, opposition to re-use and deletion, as set out in article R. 1461-9 of the French Public Health Code.

 

To exercise these rights, the person concerned must send his or her request, providing proof of identity by any means, to the Director of the Plateforme des Données de Santé or to the Director of the compulsory health insurance organization to which he or she belongs.

 

Complaints to a supervisory authority

In accordance with regulations, any person concerned has the right to lodge a complaint with a supervisory authority.