Software for group psychology practices in France: records, access and confidentiality

Software for a group psychology practice is the tool in which several psychologists who share premises, a receptionist or costs keep their patient records, with access rules that protect each practitioner's professional confidentiality. Sharing a practice does not mean sharing records. This guide is based on French law, with a short note for Belgium and Switzerland.

Group practice: who is responsible for the data?

The CNIL text closest to your situation is its reference framework for medical and allied health practices (July 2020). According to its announcement page, it covers private practitioners working "in an individual or group practice, or in health centres" (our translation). It names neither psychologists nor roles within a group, but remains a good benchmark.

The controller decides why and how data are processed. When several people decide together, GDPR article 26 makes them "joint controllers", who set out their respective obligations "by means of an arrangement between them". Our reading for each way of working:

• Partners in an SCM (a company that only pools resources): each psychologist remains the controller for their own patients' records. For the shared tool the SCM chooses and pays for (calendar, reception), the situation looks like joint control: write down who decides what.
• Associate (collaboration libérale) contract: the associate, who has their own patients, is the controller for those records, even in the main practitioner's tool.
• Sub-letting a room: two independent practices, so separate software or fully separate spaces.

One threshold to know: according to the framework, a data protection impact assessment (DPIA) and a data protection officer "should be necessary" (our translation) for practitioners in a group practice who share a common information system, from 10,000 patients a year. For the rest, see our guide to GDPR obligations in private practice.

Confidentiality: same practice does not mean same care team

Section I of article L1110-4 of the Public Health Code sets the principle: confidentiality covers all information about the person, and it applies to every professional working in the health system. Section III allows members of the same care team to share the information strictly needed for coordination or continuity of care; that information is then deemed entrusted by the person to the whole team. Outside the care team, sharing requires the person's prior consent.

Paragraph 1 of article L1110-12 covers, among others, professionals working within a cooperation, shared-practice or coordination structure that appears on a list set by decree. That list, set by decree no. 2016-996 of 20 July 2016 (article D1110-3-4), names in particular health centres and legal entities bringing together private health professionals when their purpose is coordinated medical care. A group practice, or an SCM that only pools premises and a receptionist, is not listed as such. This is our reading, not a written rule: no text says a group practice can never be a care team, and a practice organised for coordinated care may be in a different position. As a precaution, we recommend assuming that sharing a practice does not allow you to read your colleagues' records, nor them yours.

The French code of ethics for psychologists (2021 version) points the same way. Article 7: professional confidentiality covers everything the psychologist learns in the course of their work. Article 8: the psychologist shares only the information strictly necessary for the professional purpose. For exchanges with a doctor, see our article on shared confidentiality and the care team.

For peer supervision between partners, we recommend presenting cases without identifying details: no access to records is needed.

Who can see which record: the grid

The CNIL framework recommends giving each user an access profile suited to their role, separating administrative from medical data, and removing outdated permissions. According to it, reception staff access only what they need for their tasks, mainly appointments. The grid we recommend:

• The psychologist treating the patient: the whole record. Article 18 of the code states that only the psychologist who wrote a document may sign, change or cancel it.
• A partner or colleague in the practice: no access to clinical content. At most, the shared calendar if the practice has one.
• The locum: records of the patients they see, during the cover only, with a named account closed at the end.
• Reception: identity, contact details, appointments, payments. No notes, no reason for consultation, no reports.
• The software vendor and host: technical access governed by the contract. The host is itself bound by professional confidentiality (article L1111-8, section V).

One account per person, never a shared password. The 2018 CNIL and Medical Council guide says plainly that you must never give your passwords to your staff.

Access log, HDS hosting and the vendor contract

The access log

The log shows who opened which record, and when. It lets you answer a patient who asks whether a colleague looked at their file. The CNIL framework expects software vendors to provide a logging system, and asks the practice to inform its users that it exists. It sets no retention period; the sample register in the 2018 CNIL and Medical Council guide gives "logging of user access over 6 months" (our translation) as an example.

HDS hosting

If the software keeps your records on its servers, article L1111-8 requires a host holding a certificate of conformity, known as HDS certification. At the end of the service, the host returns the data without keeping a copy. See our article on HDS-certified hosting.

The processing contract

The vendor is your processor. GDPR article 28 requires a contract stating in particular that the vendor processes data "only on documented instructions from the controller", controls its own sub-processors, "deletes or returns all the personal data" at the end of the contract, and allows audits. Check that the signatory (the SCM, each psychologist, or both) is the controller you have designated.

If you pool IT resources, the framework also recommends writing an IT charter and making it binding.

When a partner leaves

Under article 19 of the code of ethics, a psychologist who stops practising strives to ensure continuity, and the documents related to their work may be passed on or destroyed under conditions that protect confidentiality.

The French national advisory committee on psychologists' ethics (CNCDP) dealt with a real case in opinion no. 19-10 of 27 July 2019, issued under the former code (1996, revised in 2012). A psychologist under an "assistant libéral" contract was leaving a colleague's practice; her contract said that documents relating to the patient list remained the property of the practice holder. The committee found that her personal notes could not be treated as such documents, and that she could write reports only for patients wishing to continue at the practice, after informing them.

The procedure we recommend:

• Ask each patient whether they will continue with the departing psychologist, with a colleague in the practice, or elsewhere.
• For each patient who stays, pass on to the colleague, with the patient's agreement, a handover report rather than raw notes.
• Export the departing psychologist's records in a readable format, then close their account on the day they leave.
• Decide who keeps the records of patients who do not continue with anyone, and for how long (see our article on patient record retention periods).
• Write these rules down when the practice is set up (SCM articles, associate contract).

Choice grid and questions to ask the vendor

This grid adds to our general criteria for choosing psychologist practice software. It keeps only what changes when there are several of you.

• Named accounts: does every person (psychologist, locum, receptionist) get an account in their own name?
• Separation by practitioner: does each psychologist see only their own patients, by default?
• Reception profile: can you set up a profile with no access to notes or reports?
• Locum: can access be limited in time and to certain patients?
• Access log: can the practice view it, and how long is it kept?
• Hosting: who is the host, is it HDS-certified, and where are the data?
• Contract: do you provide an article 28 processing contract, and who should sign it on our side?
• Export and end of contract: can we export one practitioner's records, and what happens to the data at the end?
• AI: where are data processed, are they pseudonymised, are they used to train a model?
• Price: what is the price per practitioner, and from how many practitioners does a discount apply? (see our article on psychologist software pricing)

Fictional example: a practice of 4 psychologists

The Tilleuls practice (fictional) brings together four psychologists. Claire and Julien are partners in an SCM that rents the premises and employs Sophie, a part-time receptionist. Inès is Claire's associate. Marc sub-lets a room two days a week.

• Responsibility: each of the four is the controller for their own patients' records. Claire and Julien sign a written arrangement (article 26) for the SCM's shared calendar and reception.
• Tools: a shared calendar run by Sophie. For records, Claire, Julien and Inès each have their own account and see only their own patients. Marc keeps his own software.
• Reception: Sophie sees names, contact details, appointments and payments. She sees no notes and no reasons for consultation.
• Cover: when Julien is away for three weeks, his locum gets an account in her own name, limited to the patients of Julien she sees, closed on his return.
• Log: Claire, manager of the SCM, reviews the access log once a quarter.
• Departure: Inès's contract says that when she leaves, she informs her patients, exports her records, and her account is closed the same day.
• Documents: an IT charter signed by everyone, and a processing contract with each vendor.

Common mistakes

• A single "practice" account shared by everyone.
• Letting partners see all records "to help out".
• Giving the receptionist access to notes so she can file letters.
• Keeping records in consumer cloud storage that is not HDS-certified.
• Signing the vendor contract in the SCM's name before deciding who the controller is.

Why Delta fits a group practice

Delta is the clinical assistant for mental health professionals. Each psychologist in the practice gets their session reports and an up-to-date record for each of their patients, with a summary of the therapy and its goals. Data are hosted in France with an HDS-certified host, identifying details are pseudonymised before the AI, no audio file is kept, and data are never used to train a model. Delta does not handle scheduling or billing: it sits alongside the practice's shared tool. For practices with 5 or more practitioners, volume pricing is available on request. To learn more: what is Delta and our clinical document templates.

In Belgium and Switzerland, the French Public Health Code articles cited here do not apply: check your country's rules with the data protection authority (APD in Belgium, FDPIC in Switzerland). With Delta, data stay in Europe, in France, on infrastructure certified for health data.

Sources

• French Public Health Code, on Légifrance (accessed 6 November 2026): article L1110-4, article L1110-12, article L1111-8.
• CNIL, reference framework for medical and allied health practices (July 2020) and CNIL and Medical Council guide (June 2018).
• GDPR, articles 26 and 28, on the CNIL website.
• French code of ethics for psychologists (2021).
• CNCDP, opinion no. 19-10 of 27 July 2019, published by the FFPP.