One vendor, 15 million patients — the Cegedim Santé (MLM) breach in France and why the free-text box mattered most

According to Cegedim, affected doctors were contacted in early January and, if they wished, helped to notify the CNIL and inform their patients as data controllers under the GDPR. In other words, the formal notice to patients comes from your own doctor or practice. The CNIL says it cannot check whether your data is in a leaked file, and it does not recommend third-party sites that claim to. If you are worried, ask your doctor directly through the contact details you already use.

With a name, date of birth, phone number, address and email, someone can write a convincing "This is Dr X's practice" or "You are due a health insurance refund" message. The CNIL's advice: do not open attachments, do not reply, do not click links, and type the official website address yourself. How to spot these messages is covered in What is phishing?.

Because a small share of patients had sensitive notes in the free-text field, a message that shows knowledge of your health or private life and pressures you to pay or act cannot be ruled out. Do not reply or pay, keep screenshots and emails as evidence, and, as the CNIL advises, file a complaint (plainte) with the police or gendarmerie. You have done nothing wrong.

If you suspect identity theft (usurpation d'identité), the CNIL advises checking cybermalveillance.gouv.fr for guidance, filing a complaint with the police or gendarmerie as soon as possible, alerting your bank(s), and checking whether accounts have been opened in your name, for example through FICOBA (via impots.gouv.fr).

Under the GDPR right of access (droit d'accès), you can ask the practice what information it holds about you. According to the CNIL, the organization must reply within one month at the latest (extendable in complex cases). Knowing what the free-text field says about you also helps you judge any message that later claims to know it.

Cegedim says it helped affected doctors, as data controllers under the GDPR, notify the CNIL and inform their patients. According to the CNIL, a controller must notify it within 72 hours of becoming aware of a breach and, where the risk is high, inform the people concerned. A processor (the software vendor) must alert the controller immediately when it discovers a breach. Check your contract: within how many hours, and through which contact, will the vendor tell you?

Anything about a patient's health or private life belongs in the appropriate part of the medical record, not in the administrative comment. Write a one-page rule for what may and may not go into comment fields, and share it with reception staff and locum doctors. You can start by rereading the comment fields of a few dozen of your own patients to see what is already there.

How the accounts came to be used has not been published, but the impact ran through individual doctors' accounts. Do not share one login between reception and doctors; turn on multi-factor authentication for everyone if the software offers it; disable a leaver's account the same day. For choosing a method, see Choosing multi-factor authentication.

What Cegedim detected was abnormal request behaviour on doctors' accounts. A small practice cannot run its own monitoring, so ask the vendor three questions: (1) Is there an alert when one account opens far more patient files than usual? (2) Is the practice told when it fires? (3) Can the practice see its own account's access history? For example, a doctor who sees a few dozen patients a day should never have an account reading thousands of patient records. A threshold set at a volume no human consultation could produce is a realistic first rule.

Besides notifying the CNIL, healthcare organizations can turn to CERT Santé, the health sector's security response team (reporting portal: signalement.social-sante.gouv.fr). A single page saying who reports what, where and within how many hours means no hesitation when the vendor calls.