French Public Health Code
In forceI.-The statutory auditor will only receive, through the intermediary of a doctor acting under his responsibility as an expert, the personal data mentioned in article R. 6113-1 which are necessary to verify, by sampling on the basis of relevant samples of files, the reliability and traceability of the data used to calculate the establishment's revenue.
II.-The doctor referred to in I who is called upon by the statutory auditor must:
1° Exercise or have exercised functions within a department responsible for medical information in another establishment;
2° Present all the guarantees of competence, independence and impartiality required for the exercise of the missions entrusted to him by this article.
The compensation due and the terms and conditions for carrying out his mission are set out in an agreement with the statutory auditor.
III.-Prior to any communication of data, the statutory auditor shall define:
1° The scope and objectives of the certification assignment justifying the communication of the personal data referred to in Article R. 6113-1;
2° The timeframe for the completion of this assignment;
3° The categories of data necessary for its completion.
IV.-After the doctor referred to in I has verified that the categories of data requested do not exceed the scope of those strictly necessary for the performance of the certification task, the statutory auditor will notify the head of the institution of the information referred to in III.
V.-The director of the institution shall individually and specifically authorise the doctor referred to in I to access the data referred to in 3° of III.
The director of the institution may refer to the doctor referred to in I, at any time, any request for information relating to the data requested.
VI.-Only the doctor mentioned in I may have direct access to the data processed by the health care institution, for consultation only and without the possibility of creating or modifying it.
Before providing the statutory auditor with the data necessary for the performance of his duties, the doctor mentioned in I shall proceed to pseudonymise it by deleting, in particular, the data mentioned in 1° of Article R. 6113-1 relating to the persons concerned and shall communicate it to the statutory auditor under secure conditions.
Any additional data shall be communicated under the same conditions.
VII -At the end of the certification mission, the establishment director terminates the access authorisation of the doctor mentioned in I. The doctor must delete, under secure conditions, any data sent to the statutory auditor as part of the audit.
