Compliance for EHPAD and the medico-social sector
A nursing home processes far more than administrative data: care records, daily-life data, family and social information, sometimes CCTV. Sensitive data about vulnerable people — an area the CNIL watches particularly closely.
What is at stake for your organization
- Frame the resident’s single record (care, administrative, social) and access to it.
- Frame CCTV and resident-safety devices.
- Inform residents and families, and organize the exercise of vulnerable people’s rights.
- Frame processors (core software, remote assistance, service providers).
- Appoint a DPO when the criteria are met — public-body status, or large-scale monitoring of health data — and qualify the point in the other cases.
What triggers the need
- Installing CCTV or resident-monitoring devices
- An inspection, a visit or a request from the departmental council
- An incident affecting a resident’s record or an exchange with families
- Renewing the core software or a key service provider
Sound familiar? Now is the right time to get the subject under control — before it takes control on its own.
The most common mistake
Restricting compliance to the care record. Data about families, employees, external practitioners and technical devices (CCTV, remote assistance) belong to the same scope — and they are often the first to cause problems.
What we put in place
- Full GDPR diagnostic of the facility
- Outsourced DPO designated with the CNIL
- Record of processing, DPIAs and compliance documentation
- Framing of CCTV and protection devices
- Training for care and administrative teams
Your questions
Must a nursing home have a DPO?
Very often, yes: a public EHPAD is required to as a public body, and a private EHPAD is required to when its health-data processing reaches large scale — assessed against the number of residents, and the volume and permanence of monitoring. Groups and managing associations often share an outsourced DPO across all their facilities.
Can cameras be installed in a nursing home?
CCTV is possible but strictly framed: proportionality, areas covered (never the bedrooms except in exceptional, tightly framed circumstances), information, retention periods. Every device must be analyzed before deployment.
Who exercises the rights of a resident under guardianship?
The person in charge of the protection measure may exercise certain rights on the resident’s behalf, within the limits of their mandate. Articulating GDPR rights, medical secrecy and the legal protection of adults calls for precise framing — it is our daily work.
Let’s secure the compliance of your organization
A free first conversation to review your situation and identify your priorities.
Response within 24 business hours · No obligation