Compliance for EHPAD and the medico-social sector
A nursing home processes far more than administrative data: care records, daily-life data, family and social information, sometimes CCTV. Sensitive data about vulnerable people — an area the CNIL watches particularly closely.
What the regulations require of you
Each obligation is cited with its legal reference — so you know exactly where it comes from and what it demands of your organization.
Keep a record covering the full perimeter
Residents, families, staff, external providers, technical devices: the record documents all of the facility's processing — not just the care file.
Appoint a DPO
A public EHPAD is required to as a public body; a private one is required to when its health-data processing reaches large scale — assessed against the volume and permanence of monitoring.
Carry out a DPIA
Health data processed at scale and vulnerable persons: two criteria which, combined, make the impact assessment almost systematically required in an EHPAD.
Strictly frame CCTV
Proportionality, filmed areas (never bedrooms except in strictly framed exceptional circumstances), information of the persons, retention periods: every system is analyzed before deployment.
Notify data breaches
Notification to the CNIL within 72 hours when the breach presents a risk, and information of residents or their representatives when the risk is high.
What is at stake for your organization
- Frame the resident’s single record (care, administrative, social) and access to it.
- Frame CCTV and resident-safety devices.
- Inform residents and families, and organize the exercise of vulnerable people’s rights.
- Frame processors (core software, remote assistance, service providers).
- Appoint a DPO when the criteria are met — public-body status, or large-scale monitoring of health data — and qualify the point in the other cases.
What triggers the need
- Installing CCTV or resident-monitoring devices
- An inspection, a visit or a request from the departmental council
- An incident affecting a resident’s record or an exchange with families
- Renewing the core software or a key service provider
Sound familiar? Now is the right time to get the subject under control — before it takes control on its own.
The most common mistake
Restricting compliance to the care record. Data about families, employees, external practitioners and technical devices (CCTV, remote assistance) belong to the same scope — and they are often the first to cause problems.
What we put in place
- Full GDPR diagnostic of the facility
- Outsourced DPO designated with the CNIL
- Record of processing, DPIAs and compliance documentation
- Framing of CCTV and protection devices
- Training for care and administrative teams
Expertise backed by the NELSE technology
EHPAD & medico-social: our support relies on the tools developed by NELSE: each processing activity is qualified by written, sourced legal rules, the register stays up to date version after version, and the files handed over can be verified by a third party. The DPO assesses, advises and documents their opinions; your organisation keeps its decisions.
In practice, for you: the residents' care record (vulnerable individuals, health data) and CCTV in common areas do not have the same regime: the engine says so rule by rule; reports are documented and the applicable notification deadlines are made visible.
Discover our softwareYour questions
Must a nursing home have a DPO?
Very often, yes: a public EHPAD is required to as a public body, and a private EHPAD is required to when its health-data processing reaches large scale — assessed against the number of residents, and the volume and permanence of monitoring. Groups and managing associations often share an outsourced DPO across all their facilities.
Can cameras be installed in a nursing home?
CCTV is possible but strictly framed: proportionality, areas covered (never the bedrooms except in exceptional, tightly framed circumstances), information, retention periods. Every device must be analyzed before deployment.
Who exercises the rights of a resident under guardianship?
The person in charge of the protection measure may exercise certain rights on the resident’s behalf, within the limits of their mandate. Articulating GDPR rights, medical secrecy and the legal protection of adults calls for precise framing — it is our daily work.
Let’s secure the compliance of your organization
A free first conversation to review your situation and identify your priorities.
Response within one business day · No obligation