Hémistiches.Diapason
FR

DiapasonGDPR compliance for health data, by Hémistiches

Is your health data in tune with the GDPR?

Test your set-up. Ten to sixteen questions depending on your situation, and a result on three axes: the obligation that applies to you, the fragility of what you have in place, and your exposure in the event of an inspection or an incident.

Take the test See the services

Under six minutesFreeYour answers stay in your browserPrices exclude VAT

The name

A diapason, or tuning fork, gives the A: a fixed note, the same for everyone, to which every instrument tunes.

For health data, that note is written down: the General Data Protection Regulation, the French Public Health Code, the reference methodologies of the CNIL, the French data protection authority. It is the same for a pharmaceutical company, a digital health start-up or a clinic.

The test measures the gap. It does not ask whether you are compliant. It looks at what a supervisory authority asks to see, and at what, in your organisation, nobody is in charge of.

What the test reviews

Appointing a data protection officer is not enough. The officer must also be identifiable by the authority, free in the performance of their tasks and given the resources to perform them. This is where most set-ups give way: not in intention, but in structure.

  • Appointment of the officerMandatory where the core activities involve large-scale processing of health data (Art. 37 GDPR).
  • Independence and resourcesNo conflict of interests with other duties, and the time the role requires (Art. 38).
  • Contact details sent to the CNILThe simplest obligation, and one of the most often missing (Art. 37(7)).
  • Record of processing activitiesThe first document requested in an inspection (Art. 30).
  • Impact assessmentsRequired where the risk is high, which is common with health data (Art. 35).
  • Research and studiesCNIL reference methodology or CNIL authorisation: the legal basis sets the timetable.
  • Certified hostingA host holding a certificate of conformity (Article L. 1111-8 of the French Public Health Code).
  • Processors and transfersData processing agreements, safeguards outside the European Union.
  • Personal data breachesA procedure that makes it possible to notify without undue delay and, where feasible, within seventy-two hours (Art. 33).

Is your set-up in tune?

Questions about facts you know. The path adapts to your activity and to what you already have in place.

How the services fit together

Build first, then maintain

The data protection officer role only holds on a set-up that has already been built. The three services follow one another; each has its own price, and none includes the others.

  1. Step 1 · once, at the start

    Setting up the function

    From€4,500 excl. VAT, one-off

    The record of processing, the procedures, the impact assessment method, the governance, the appointment of the officer and its notification to the CNIL.

    Details
  2. Step 2 · for each study

    Compliance of a study

    From€4,500 excl. VAT per study, + €1,500 to €2,500 excl. VAT per investigation country outside France

    Each study has its own fixed fee: two studies, two fees. A study most often runs in several EU countries: each country adds its own supplement.

    Details
  3. Step 3 · every month, afterwards

    Outsourced data protection officer

    From€650 excl. VAT per month

    The data protection officer role, held over time, on the set-up built in steps 1 and 2.

    Details

The data protection officer subscription includes neither the setting up of the function nor the compliance of your studies. It starts once step 1 has been completed. If your record and procedures already exist, they are reviewed beforehand, on quotation.

What the subscription includes

  • Keeping the record of processing activities up to date
  • Advice on your new processing operations and on whether an impact assessment is needed
  • Responses to requests from data subjects
  • Assessment and notification of personal data breaches
  • Periodic progress review and annual report
  • Point of contact for the CNIL, with assistance during an inspection included up to three days per year

What it does not include

  • Setting up the function, including the appointment: step 1
  • The compliance of each study, including its impact assessment and its investigation countries: step 2, one fee per study and a supplement per country
  • Drafting impact assessments and contracts outside a study: on quotation
  • Assistance beyond three days per year, and sanction proceedings: on quotation
  • €650 excl. VAT per monthUp to one ongoing study
  • €1,200 excl. VAT per monthTwo to five ongoing studies
  • €2,000 excl. VAT per monthMore than five ongoing studies

The tier reflects the workload of the data protection officer role: each ongoing study adds processing operations to monitor, requests and exchanges. A study conducted in several countries counts as one study. The tier pays for no work on the studies themselves, which falls under step 2. Initial term of twelve months.

An example, the first year

A sponsor with no record of processing launches its first study, in France and two other EU countries: the most common case.

First-year cost for a sponsor launching a study in three countries
Step 1 · setting up the function€4,500
Step 2 · compliance of the study€4,500 to €8,000
Step 2 · two investigation countries outside France€3,000 to €5,000
Step 3 · data protection officer, €650 × 12 months€7,800
First year€19,800 to €25,300 excl. VAT

Local correspondents' fees are added, recharged at cost. A second study adds its own compliance fee and moves the subscription to the €1,200 excl. VAT per month tier.

Services

Each fixed fee is defined in writing: what it covers, what it excludes, the number of meetings and rounds of comments. The first three follow one another; the next three answer a specific situation.

Step 1 · once, at the start

Setting up the function

From

€4,500 excl. VAT

Giving the function what it lacks: the record of processing, the procedures, the impact assessment method, the governance.

  • Record of processing activities drawn up or taken over (Art. 30)
  • Breach procedure and impact assessment method
  • Appointment of the officer and notification to the CNIL
  • Officer's engagement letter and reporting line

€4,500 excl. VAT up to ten processing operations, €7,500 excl. VAT from eleven to twenty-five, above that on quotation. Excludes studies and technical security audits.

Step 2 · for each study

Compliance of a study

From

€4,500 excl. VAT per study

+ €1,500 to €2,500 excl. VAT per investigation country outside France

Placing a study on the right legal basis before it starts, and documenting what the authority, the sites and your partners will ask of you.

  • Qualification: reference methodology or authorisation
  • Participant information notice, data section
  • Clauses with the contract research organisation, the sites and the service providers (Art. 28)
  • Impact assessment of the study

€4,500 to €8,000 excl. VAT per study, for France and overall coordination. Each investigation country outside France: €1,500 to €2,500 excl. VAT; local rules are checked there by a correspondent in that country, whose fees are recharged at cost. One fee per study.

Step 3 · every month, afterwards

Outsourced data protection officer

From

€650 excl. VAT per month

The data protection officer role, held over time, once the function has been set up.

  • Record kept up to date, advice on your new processing operations
  • Data subject requests, personal data breaches
  • Assistance during a CNIL inspection, three days per year included

Includes neither the set-up (step 1) nor the studies (step 2). €650 up to one ongoing study, €1,200 from two to five, €2,000 above that; a multi-country study counts as one. Initial term of twelve months. Details

To get started

Flash consultation

€490 excl. VAT

Deductible from the fee for the service taken up next

One hour with a lawyer to understand where your set-up stands and which step to start with.

  • Prior reading of your result
  • Sixty-minute video call
  • Written guidance note: points of attention, priorities, next steps

Video call within ten days. Excludes document review and written opinions taking a legal position.

If you already have an officer

Review of the appointment

From

€1,900 excl. VAT

Finding out whether the appointment of your in-house officer holds: the person, their other duties, their resources, their visibility to the authority, and what needs correcting.

  • Review of the appointment and its notification to the CNIL
  • Analysis of combined duties (Art. 38(6))
  • Signed note, corrections in order of priority

€1,900 to €2,900 excl. VAT depending on the number of combined duties. Excludes the record and impact assessments.

If a matter is open

Inspection, complaint or breach

On quotation

Included in the data protection officer subscription, up to three days per year

An open matter is best handled early, before positions harden.

  • Assistance during a CNIL inspection or request
  • Assessment and notification of a breach
  • Response to a complaint or to a data subject request

Best-efforts obligation: no outcome can be guaranteed. This is not representation in court.

Prices exclude VAT. French VAT at 20% is added for clients established in France; for a business client established in another Member State, VAT is self-accounted for by the client under the reverse-charge mechanism. If we agree to work together, the chosen service is set out in a fee agreement signed before any work begins, which defines the scope, its exclusions and how the price is determined. It is preceded by a conflict-of-interest check.

Scope of advice. The firm advises on French law and on European Union law as applicable in France. It gives no opinion on the national laws of other Member States or on non-EU laws; a question governed by a foreign law is handled, where appropriate, with a local correspondent, under a separate quotation.

And for your whole legal function? Diapason covers the protection of health data. For contracts, corporate housekeeping, regulatory matters and the rest of the legal function: Cadence, Hémistiches' outsourced legal department (site in French).

Portrait of François Césure

Who gives the A

“I spent more than ten years as general counsel in the healthcare industry before becoming a lawyer, and I am a certified data protection officer. I know what an authority asks to see, and what it costs when nobody has kept the documents.”
François Césure
  • AvocatParis Bar, since 2012
  • Data protection officercertified
  • General counselmore than ten years, healthcare industry

Terms

What is settled before any engagement

  • The test is not legal adviceThe result is an indicative preliminary analysis, based solely on your answers. It does not determine the legal regime applicable to your processing. Legal advice begins with the lawyer, under a fee agreement.
  • A single point of contactThe data protection officer role, legal advice and assistance during a CNIL inspection are all provided by the same lawyer, who knows your processing operations.
  • A best-efforts obligationNo outcome is guaranteed, in particular not compliance itself, which also depends on your processing, your teams and your service providers. The commitment covers a scope, a method and timelines agreed in writing.
  • A price per step, confirmed in writingSet-up, studies, data protection officer subscription: each step has its price and scope, written down before work begins. No additional work without your agreement.
  • Conflict-of-interest checkBefore any engagement. If there is one, you are told, and the file is not opened.
  • Your answers stay with youThe questionnaire runs in your browser. Only your email address and the summary of your result are sent to me.