[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPyfmxsaiF0tL7aj9q-Z5rHt3TRb6vOB4g8v96CvaL4k":3},{"assets":4,"aiSystems":5,"attachments":6,"tags":7,"dataRetentionRules":20,"creatorUser":196,"creatorUserId":25,"updatedBy":197,"updatedById":25,"publishedBy":27,"publishedById":27,"areaOwnerId":27,"owners":198,"customFields":199,"area":200,"entity":204,"mergedFrom":27,"workflowStep":205,"accountables":211,"responsibles":212,"informedOwners":213,"securityMeasures":214,"personCategories":444,"id":36,"source":54,"label":37,"state":210,"versionDescription":27,"processingType":43,"parentId":27,"areaId":42,"mergeType":27,"readonly":28,"editable":209,"workflowStepId":206,"dateDeployment":27,"dateCreation":41,"dateArchived":27,"datePublication":27,"archived":28,"dateUpdate":40,"reviewDate":27,"nextReviewDate":27,"ref":27,"processingState":27,"description":38,"descriptionHtml":471,"subjectRightProcessDescription":27,"rightOfInformation":472,"rightOfAccess":473,"rightOfRectification":473,"rightOfErasure":474,"rightOfRestriction":473,"rightOfOpposition":474,"rightOfDataPortability":474,"advanceDirectives":473,"advanceDirectivesDescription":27,"rightOfInformationDescription":475,"rightOfAccessDescription":27,"rightOfRectificationDescription":27,"rightOfErasureDescription":476,"rightOfRestrictionDescription":27,"rightOfOppositionDescription":477,"rightOfDataPortabilityDescription":478,"stakeHolders":479,"assessmentScoring":28,"automaticDecision":28,"systematicMonitoring":28,"specialCategoryData":209,"largeScaleCollection":209,"crossReferencing":27,"vulnerablePeople":209,"isDPIARequired":209,"dpiaDate":27,"dpiaExemption":28,"dpiaExemptionJustification":27,"innovativeUse":28,"exclusionBenefitRightContract":28,"recipients":480,"dataControllers":544,"purposes":545,"progression":564,"quality":565,"sensitivity":566,"visible":209,"workspaceId":39,"nbReferences":30,"referenceId":27},[],[],[],[8,13,16],{"id":9,"label":10,"type":11,"color":12},"99e6f156-5bd7-4bc1-94c7-7f416665cf20","Organisme : Privé","DataProcessing","#64748B",{"id":14,"label":15,"type":11,"color":12},"5494cd34-13e6-4954-81cd-000195723eb0","Organisme : Public",{"id":17,"label":18,"type":11,"color":19},"2f7da145-e4a5-47b2-adc0-ea2734caae5b","Secteur : Santé","#0E7490",[21,87,137,166],{"customFields":22,"tags":23,"creator":24,"readonly":28,"purposes":31,"dataProcessings":34,"dataFields":44,"asset":27,"subjectCategories":75,"id":76,"ref":27,"externalId":27,"externalLastSyncDate":27,"externalSource":27,"label":77,"description":27,"dateCreation":78,"dateUpdate":79,"baseActiveOverride":28,"intermediateArchivingOverride":28,"destructionOverride":28,"baseActiveDescription":80,"baseActiveLegalBasis":81,"baseActiveRetentionDuration":82,"baseActiveMinMax":27,"intermediateArchivingLegalBasis":27,"intermediateArchivingDescription":83,"intermediateArchivingRetentionDuration":27,"intermediateArchivingMinMax":27,"destructionDescription":84,"destructionLegalBasis":27,"dataSetSource":85,"sourceDescription":86,"assetId":27,"source":54},{},[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},1602,"bc4946f8-1de1-4b70-bb67-62a0ce536160",null,false,"#4DE034",0,[32,33],"c24430bd-dbd2-4ac4-b62d-dcc4a18a37cc","334c02da-1bc0-4067-b219-d7eb92ef8060",[35],{"id":36,"label":37,"ref":27,"description":38,"workspaceId":39,"archived":28,"dateUpdate":40,"dateCreation":41,"areaId":42,"processingType":43},"c2d1635a-8c05-48b7-36bd-08df38010b74","Dossier patient informatisé (DPI) en établissement de santé","Ce modèle de traitement est relatif à l'enregistrement et à la conservation, par un établissement de santé public ou privé, des données collectées lors de la prise en charge sanitaire ou médico-sociale d'un patient, et à la coordination de cette prise en charge.",68,"2026-11-02T23:01:02.904658","2026-11-02T23:01:01.5058315",354,"Default",[45,55,62,69],{"id":46,"customFields":47,"ref":27,"archivingPolicy":27,"required":28,"label":48,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":50,"dataType":27,"dateCreation":51,"dateUpdate":27,"creator":52,"workflowStepId":53,"workflowStep":27,"source":54},"bd2fd090-88fe-4131-0200-08df38010ba5",{},"Nom, prénoms, genre, date et lieu de naissance, coordonnées","Current","CivilStatus","2026-11-02T23:00:55.7939858",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},83450,"Api",{"id":56,"customFields":57,"ref":27,"archivingPolicy":27,"required":28,"label":58,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":59,"dataType":27,"dateCreation":60,"dateUpdate":27,"creator":61,"workflowStepId":53,"workflowStep":27,"source":54},"bf086b1f-dfac-4a72-0201-08df38010ba5",{},"Identifiant national de santé (INS) et numéro de sécurité sociale (NIR)","NIR","2026-11-02T23:00:55.9747976",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":63,"customFields":64,"ref":27,"archivingPolicy":27,"required":28,"label":65,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":66,"dataType":27,"dateCreation":67,"dateUpdate":27,"creator":68,"workflowStepId":53,"workflowStep":27,"source":54},"5e8f8e89-710a-4ee7-0202-08df38010ba5",{},"Régime d'affiliation à l'assurance maladie et à la complémentaire","Other","2026-11-02T23:00:56.1774267",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":70,"customFields":71,"ref":27,"archivingPolicy":27,"required":28,"label":72,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":50,"dataType":27,"dateCreation":73,"dateUpdate":27,"creator":74,"workflowStepId":53,"workflowStep":27,"source":54},"3ebe0f7e-8b37-45c3-0203-08df38010ba5",{},"Personne de confiance, personne à prévenir, représentant légal","2026-11-02T23:00:56.405131",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],"a2e7733b-4435-4c30-dee6-08df38010b98","Données administratives du patient et de ses proches","2026-11-02T23:00:58.584168","2026-11-02T23:00:59.1248876","20 ans à compter du dernier passage dans l'établissement (hospitalisation ou consultation). Si cette durée s'achève avant le 28e anniversaire du patient, conservation prolongée jusqu'à cette date. 10 ans à compter du décès si celui-ci survient moins de 10 ans après le dernier passage.","Article R. 1112-7 du code de la santé publique, tel que rappelé par la CNIL dans son projet de recommandation (le texte de loi lui-même n'a pas pu être ouvert). Des durées plus longues s'appliquent à certains dossiers (transfusion, procréation médicalement assistée).",10512000,"Un archivage intermédiaire est possible, sans dépasser les durées ci-dessus. La destruction est décidée par le directeur de l'établissement après avis du médecin responsable de l'information médicale.","À l'issue de la durée de conservation, les données sont supprimées de manière sécurisée ou anonymisées de façon irréversible.","Direct","Durée maximale en base active rappelée par la CNIL (projet de recommandation DPI, fiche 8) à partir de l'article R. 1112-7 du code de la santé publique. La CNIL recommande de stocker ces données administratives séparément des données de santé.",{"customFields":88,"tags":89,"creator":90,"readonly":28,"purposes":91,"dataProcessings":93,"dataFields":95,"asset":27,"subjectCategories":128,"id":129,"ref":27,"externalId":27,"externalLastSyncDate":27,"externalSource":27,"label":130,"description":27,"dateCreation":131,"dateUpdate":132,"baseActiveOverride":28,"intermediateArchivingOverride":28,"destructionOverride":28,"baseActiveDescription":133,"baseActiveLegalBasis":134,"baseActiveRetentionDuration":82,"baseActiveMinMax":27,"intermediateArchivingLegalBasis":27,"intermediateArchivingDescription":135,"intermediateArchivingRetentionDuration":27,"intermediateArchivingMinMax":27,"destructionDescription":84,"destructionLegalBasis":27,"dataSetSource":85,"sourceDescription":136,"assetId":27,"source":54},{},[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[33,92],"c6963b7c-f8a7-4b20-9296-4cbc055ac18f",[94],{"id":36,"label":37,"ref":27,"description":38,"workspaceId":39,"archived":28,"dateUpdate":40,"dateCreation":41,"areaId":42,"processingType":43},[96,103,109,115,121],{"id":97,"customFields":98,"ref":27,"archivingPolicy":27,"required":28,"label":99,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":100,"dataType":27,"dateCreation":101,"dateUpdate":27,"creator":102,"workflowStepId":53,"workflowStep":27,"source":54},"253a0363-e7ab-4453-0204-08df38010ba5",{},"Observations médicales et paramédicales, actes, diagnostics","HealthData","2026-11-02T23:00:56.6473344",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":104,"customFields":105,"ref":27,"archivingPolicy":27,"required":28,"label":106,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":100,"dataType":27,"dateCreation":107,"dateUpdate":27,"creator":108,"workflowStepId":53,"workflowStep":27,"source":54},"8d61c0ad-10ae-4665-0205-08df38010ba5",{},"Antécédents personnels et familiaux, allergies","2026-11-02T23:00:56.8387109",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":110,"customFields":111,"ref":27,"archivingPolicy":27,"required":28,"label":112,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":100,"dataType":27,"dateCreation":113,"dateUpdate":27,"creator":114,"workflowStepId":53,"workflowStep":27,"source":54},"fb138acb-a8f1-43e0-0206-08df38010ba5",{},"Prescriptions et produits de santé administrés","2026-11-02T23:00:57.0725883",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":116,"customFields":117,"ref":27,"archivingPolicy":27,"required":28,"label":118,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":100,"dataType":27,"dateCreation":119,"dateUpdate":27,"creator":120,"workflowStepId":53,"workflowStep":27,"source":54},"c9304911-6483-440c-0207-08df38010ba5",{},"Documents du dossier (comptes rendus, courriers, résultats, imagerie)","2026-11-02T23:00:57.3268503",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":122,"customFields":123,"ref":27,"archivingPolicy":27,"required":28,"label":124,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":125,"dataType":27,"dateCreation":126,"dateUpdate":27,"creator":127,"workflowStepId":53,"workflowStep":27,"source":54},"233f8899-6cd2-49c6-0208-08df38010ba5",{},"Données génétiques strictement nécessaires aux soins (selon le contexte)","GeneticData","2026-11-02T23:00:57.5859467",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],"cdf6381f-5140-4294-dee7-08df38010b98","Données de santé liées à la prise en charge","2026-11-02T23:00:59.2757141","2026-11-02T23:00:59.7469851","20 ans à compter du dernier passage dans l'établissement (hospitalisation ou consultation), avec prolongation jusqu'aux 28 ans du patient s'il est mineur, ou 10 ans à compter du décès selon les cas.","Article R. 1112-7 du code de la santé publique, tel que rappelé par la CNIL dans son projet de recommandation (texte de loi non ouvert).","Archivage intermédiaire possible pendant cette durée. Destruction décidée par le directeur de l'établissement après avis du médecin responsable de l'information médicale.","Durée rappelée par la CNIL (projet de recommandation DPI, fiche 8) à partir de l'article R. 1112-7 du code de la santé publique. D'autres règles spécifiques peuvent imposer plus long, et les règles sur les archives publiques peuvent s'appliquer aux établissements publics.",{"customFields":138,"tags":139,"creator":140,"readonly":28,"purposes":141,"dataProcessings":142,"dataFields":144,"asset":27,"subjectCategories":158,"id":159,"ref":27,"externalId":27,"externalLastSyncDate":27,"externalSource":27,"label":160,"description":27,"dateCreation":161,"dateUpdate":162,"baseActiveOverride":28,"intermediateArchivingOverride":28,"destructionOverride":28,"baseActiveDescription":163,"baseActiveLegalBasis":164,"baseActiveRetentionDuration":27,"baseActiveMinMax":27,"intermediateArchivingLegalBasis":27,"intermediateArchivingDescription":164,"intermediateArchivingRetentionDuration":27,"intermediateArchivingMinMax":27,"destructionDescription":84,"destructionLegalBasis":27,"dataSetSource":85,"sourceDescription":165,"assetId":27,"source":54},{},[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[33,92],[143],{"id":36,"label":37,"ref":27,"description":38,"workspaceId":39,"archived":28,"dateUpdate":40,"dateCreation":41,"areaId":42,"processingType":43},[145,152],{"id":146,"customFields":147,"ref":27,"archivingPolicy":27,"required":28,"label":148,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":149,"dataType":27,"dateCreation":150,"dateUpdate":27,"creator":151,"workflowStepId":53,"workflowStep":27,"source":54},"92da7d51-f0d5-4559-0209-08df38010ba5",{},"Nom, prénom, titre, fonction, service","ProfessionalLife","2026-11-02T23:00:57.7567861",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":153,"customFields":154,"ref":27,"archivingPolicy":27,"required":28,"label":155,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":149,"dataType":27,"dateCreation":156,"dateUpdate":27,"creator":157,"workflowStepId":53,"workflowStep":27,"source":54},"276318eb-72a5-4e03-020a-08df38010ba5",{},"Numéro RPPS ou ADELI et coordonnées professionnelles","2026-11-02T23:00:57.975726",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],"9aa3b111-a979-4742-dee8-08df38010b98","Données administratives des professionnels intervenant dans la prise en charge","2026-11-02T23:00:59.9574781","2026-11-02T23:01:00.4134053","Durée du dossier du patient auquel ces informations sont rattachées.","","Durée indicative, non imposée par un texte : fixée par le responsable de traitement selon la finalité (art. 5.1.e du RGPD). Aucune source officielle retrouvée. La CNIL recommande de stocker ces données séparément des données de santé.",{"customFields":167,"tags":168,"creator":169,"readonly":28,"purposes":170,"dataProcessings":172,"dataFields":174,"asset":27,"subjectCategories":188,"id":189,"ref":27,"externalId":27,"externalLastSyncDate":27,"externalSource":27,"label":190,"description":27,"dateCreation":191,"dateUpdate":192,"baseActiveOverride":28,"intermediateArchivingOverride":28,"destructionOverride":28,"baseActiveDescription":193,"baseActiveLegalBasis":194,"baseActiveRetentionDuration":82,"baseActiveMinMax":27,"intermediateArchivingLegalBasis":27,"intermediateArchivingDescription":164,"intermediateArchivingRetentionDuration":27,"intermediateArchivingMinMax":27,"destructionDescription":84,"destructionLegalBasis":27,"dataSetSource":85,"sourceDescription":195,"assetId":27,"source":54},{},[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[171],"de530f76-14ae-4d40-9577-4a82cc9bfa8a",[173],{"id":36,"label":37,"ref":27,"description":38,"workspaceId":39,"archived":28,"dateUpdate":40,"dateCreation":41,"areaId":42,"processingType":43},[175,182],{"id":176,"customFields":177,"ref":27,"archivingPolicy":27,"required":28,"label":178,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":179,"dataType":27,"dateCreation":180,"dateUpdate":27,"creator":181,"workflowStepId":53,"workflowStep":27,"source":54},"2687adef-6879-43b1-020b-08df38010ba5",{},"Identifiant de l'utilisateur, date et heure de connexion","ConnectionData","2026-11-02T23:00:58.168492",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":183,"customFields":184,"ref":27,"archivingPolicy":27,"required":28,"label":185,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":179,"dataType":27,"dateCreation":186,"dateUpdate":27,"creator":187,"workflowStepId":53,"workflowStep":27,"source":54},"8f8d34e0-9d0b-40ec-020c-08df38010ba5",{},"Recherches, consultations, créations, modifications et suppressions dans le dossier","2026-11-02T23:00:58.3957605",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],"ecd792f0-039d-4cc8-dee9-08df38010b98","Traces d'accès et d'actions sur le dossier","2026-11-02T23:01:00.6985244","2026-11-02T23:01:01.2312182","Traces liées au parcours de soins : même durée que le dossier (20 ans après la dernière visite), selon le projet de la CNIL. Traces techniques : durée à fixer par le responsable de traitement.","Recommandation CNIL (projet de recommandation DPI, fiche 13). La CNIL renvoie aussi à sa recommandation sur la journalisation, non consultée ici.","Recommandation de la CNIL, non obligation légale : les traces liées au parcours de soins suivent la durée du dossier. Aucune durée n'est fixée pour les traces techniques dans les passages lus.",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],{},{"dpo":27,"referent":27,"owner":27,"representative":27,"dataProtectionAuthority":27,"id":42,"type":201,"parentId":27,"ref":27,"label":202,"description":27,"logoUrl":27,"address":27,"zipCode":27,"city":27,"region":27,"countryCode":203,"immatriculationNumber":27,"phoneNumber":27,"mailAddress":27,"dpoId":27,"referentId":27,"ownerId":27,"representativeId":27,"dataProtectionAuthorityId":27},"Entity","Entité","FR",{"dpo":27,"referent":27,"owner":27,"representative":27,"dataProtectionAuthority":27,"id":42,"type":201,"parentId":27,"ref":27,"label":202,"description":27,"logoUrl":27,"address":27,"zipCode":27,"city":27,"region":27,"countryCode":203,"immatriculationNumber":27,"phoneNumber":27,"mailAddress":27,"dpoId":27,"referentId":27,"ownerId":27,"representativeId":27,"dataProtectionAuthorityId":27},{"id":206,"label":207,"color":208,"order":30,"itemLimit":27,"type":11,"finalStep":28,"initialStep":209,"authorizedRole":27,"authorizedRoleId":27,"descriptionHtml":27,"mappedState":210},9439,"A compléter","#CCCCCC",true,"Draft",[],[],[],[215,229,241,252,265,276,287,297,307,318,329,339,349,360,371,382,392,402,412,422,433],{"date":216,"state":217,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":218,"id":219,"ref":27,"label":220,"type":221,"description":222,"relatedRisk":27,"moreDetailsUrl":223,"dateCreation":224,"dateUpdate":27,"tags":225,"attachments":226,"creatorUser":227,"workflowStepId":228,"workflowStep":27},"2026-11-03T11:39:38.811797Z","Done",{},"beba9da4-69b2-451b-69b0-08df38010b92","Pilotage de la sécurité des données","Organizational","L’intégration de la protection des données personnelles dans les processus de décision de l’organisme permet d’en assurer la prise en compte dans la durée et aux moments clés d’arbitrages des budgets et des projets. Les précautions élémentaires Impliquer la direction et formaliser des objectifs généraux en matière de sécurité et de protection des données personnelles, validés par la direction de l’organisme.","https://www.cnil.fr/fr/securite-piloter-la-securite-des-donnees","2026-11-02T20:57:37.2709862",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},90384,{"date":230,"state":217,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":231,"id":232,"ref":27,"label":233,"type":221,"description":234,"relatedRisk":27,"moreDetailsUrl":235,"dateCreation":236,"dateUpdate":237,"tags":238,"attachments":239,"creatorUser":27,"workflowStepId":240,"workflowStep":27},"2026-11-03T11:39:38.8117995Z",{},"cde1cad2-4195-4ffe-9406-08dd823909d1","Cadre d'usage des utilisateurs","La charte doit rappeler les règles de protection des données et les sanctions possibles, définir son champ d’application (interventions informatiques, moyens d’authentification) et énoncer les règles de sécurité : signaler toute tentative d’intrusion, garder ses identifiants secrets, ne pas installer ni modifier de logiciels sans autorisation, verrouiller son poste en cas d’absence, n’accéder qu’aux informations utiles et respecter la procédure pour copier des données sur supports amovibles. Elle précise aussi les conditions d’usage des équipements informatiques et télécoms (poste de travail, matériels nomades, stockage, réseaux, appareils personnels, Internet, messagerie, téléphonie), les modalités d’administration du système (filtrage, traçabilité, gestion des postes) ainsi que les responsabilités et sanctions en cas de manquement.","https://www.cnil.fr/fr/securite-definir-un-cadre-pour-les-utilisateurs","2025-04-25T07:14:13.031896","2026-11-02T20:57:14.658541",[],[],90385,{"date":242,"state":217,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":243,"id":244,"ref":27,"label":245,"type":221,"description":246,"relatedRisk":27,"moreDetailsUrl":247,"dateCreation":248,"dateUpdate":249,"tags":250,"attachments":251,"creatorUser":27,"workflowStepId":240,"workflowStep":27},"2026-11-03T11:39:38.8118Z",{},"d77a94b8-cd42-409c-a02e-323ffad3924a","Sensibilisation et formation des utilisateurs","Les erreurs humaines et les attaques par ingénierie sociale sont à l’origine d’un nombre important d’incidents de sécurité. Les solutions techniques ne sont pas suffisantes pour assurer la protection des données personnelles détenues par un organisme.","https://www.cnil.fr/fr/securite-impliquer-et-former-les-utilisateurs","2019-01-01T00:00:00","2026-11-02T20:57:16.1776695",[],[],{"date":253,"state":217,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":254,"id":255,"ref":27,"label":256,"type":257,"description":258,"relatedRisk":259,"moreDetailsUrl":260,"dateCreation":261,"dateUpdate":262,"tags":263,"attachments":264,"creatorUser":27,"workflowStepId":240,"workflowStep":27},"2026-11-03T11:39:38.8118006Z",{},"6c2ddc74-6750-4e76-bdad-317c6c0305ce","Authentification des utilisateurs","Technical","Avant toute utilisation des moyens informatiques, un utilisateur doit être doté d’un identifiant qui lui est propre et doit s’authentifier afin de permettre de contrôler son identité et ses accès aux données dont il a besoin. Les mécanismes permettant de réaliser l’authentification des personnes sont catégorisés selon qu’ils font intervenir :","Accès non autorisé, mots de passe partagés.","https://www.cnil.fr/fr/securite-authentifier-les-utilisateurs","2021-10-19T15:35:32.3166158","2026-11-02T20:57:18.0371731",[],[],{"date":266,"state":217,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":267,"id":268,"ref":27,"label":269,"type":221,"description":270,"relatedRisk":27,"moreDetailsUrl":271,"dateCreation":272,"dateUpdate":273,"tags":274,"attachments":275,"creatorUser":27,"workflowStepId":240,"workflowStep":27},"2026-11-03T11:39:38.8118013Z",{},"f54ac346-ee7b-45de-9cc0-39506032df7e","Gestion des habilitations","Respecter le principe de moindre privilège, à travers la gestion des profils d’habilitation, permet de limiter les conséquences d’une usurpation de comptes ou d’une erreur de manipulation.","https://www.cnil.fr/fr/securite-gerer-les-habilitations","2021-10-19T15:35:32.1054015","2026-11-02T20:57:19.3398542",[],[],{"date":277,"state":217,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":278,"id":279,"ref":27,"label":280,"type":257,"description":281,"relatedRisk":27,"moreDetailsUrl":282,"dateCreation":283,"dateUpdate":284,"tags":285,"attachments":286,"creatorUser":27,"workflowStepId":240,"workflowStep":27},"2026-11-03T11:39:38.8118019Z",{},"f748340f-fe32-47c4-983c-135130915929","Sécurité des postes de travail","Les risques d’intrusion dans les systèmes informatiques sont multiples et les postes de travail constituent un des principaux points d’entrée.","https://www.cnil.fr/fr/securite-securiser-les-postes-de-travail","2021-12-15T14:06:35.2861825","2026-11-02T20:57:20.9746731",[],[],{"date":288,"state":217,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":289,"id":290,"ref":27,"label":291,"type":257,"description":292,"relatedRisk":27,"moreDetailsUrl":293,"dateCreation":248,"dateUpdate":294,"tags":295,"attachments":296,"creatorUser":27,"workflowStepId":240,"workflowStep":27},"2026-11-03T11:39:38.8118034Z",{},"ac192187-f8f9-42aa-9111-814f4a321407","Protection du réseau informatique","Le réseau interne interconnecte l’ensemble des composants des systèmes d’information d’un organisme et dispose souvent de points de connexion avec l’extérieur. Il s’agit tout autant d’un point d’entrée que d’un support de propagation des attaques. Il est donc primordial de sécuriser le réseau interne.","https://www.cnil.fr/fr/securite-proteger-le-reseau-informatique","2026-11-02T20:57:22.9977424",[],[],{"date":298,"state":217,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":299,"id":300,"ref":27,"label":301,"type":257,"description":302,"relatedRisk":27,"moreDetailsUrl":303,"dateCreation":248,"dateUpdate":304,"tags":305,"attachments":306,"creatorUser":27,"workflowStepId":240,"workflowStep":27},"2026-11-03T11:39:38.8118039Z",{},"ed9bf5c2-97d3-4505-9b42-adabf6e7bd1d","Sécurité des serveurs","La sécurité des serveurs doit être une priorité car ils centralisent un grand nombre de données et hébergent les services permettant d’y accéder et de les manipuler. Les précautions élémentaires Désinstaller ou désactiver les services et interfaces inutiles. Limiter l’accès aux outils et interfaces d’administration aux seules personnes habilitées. Utiliser des comptes de moindres privilèges pour les opérations courantes.","https://www.cnil.fr/fr/securite-securiser-les-serveurs","2026-11-02T20:57:24.1598199",[],[],{"date":308,"state":217,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":309,"id":310,"ref":27,"label":311,"type":312,"description":313,"relatedRisk":27,"moreDetailsUrl":314,"dateCreation":248,"dateUpdate":315,"tags":316,"attachments":317,"creatorUser":27,"workflowStepId":240,"workflowStep":27},"2026-11-03T11:39:38.8118043Z",{},"56e975ff-1611-4612-b85c-c7efcdd47c2c","Protection des locaux","Physical","L’accès aux locaux doit être contrôlé pour éviter ou ralentir un accès direct, non autorisé, que ce soit aux fichiers papier ou aux matériels informatiques, notamment aux serveurs. Les locaux doivent également être protégés contre les autres types de menaces (ex. : incendie, inondation). Les précautions élémentaires Restreindre les accès aux locaux au moyen de portes verrouillées. Installer des alarmes anti-intrusion et les vérifier périodiquement leur bon fonctionnement périodiquement.","https://www.cnil.fr/fr/securite-proteger-les-locaux","2026-11-02T20:57:28.139351",[],[],{"date":319,"state":217,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":320,"id":321,"ref":27,"label":322,"type":221,"description":323,"relatedRisk":27,"moreDetailsUrl":324,"dateCreation":325,"dateUpdate":27,"tags":326,"attachments":327,"creatorUser":328,"workflowStepId":228,"workflowStep":27},"2026-11-03T11:39:38.8118048Z",{},"637227f2-e809-4991-69b1-08df38010b92","Encadrement de la maintenance et de la fin de vie des matériels et logiciels","Les opérations de support doivent être encadrées pour maitriser l’accès aux données par les prestataires. Les données doivent être préalablement effacées des matériels destinés à être mis au rebut.","https://www.cnil.fr/fr/securite-encadrer-la-maintenance-et-la-fin-de-vie-des-materiels-et-logiciels","2026-11-02T20:57:38.8686714",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"date":330,"state":217,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":331,"id":332,"ref":27,"label":333,"type":257,"description":334,"relatedRisk":27,"moreDetailsUrl":335,"dateCreation":248,"dateUpdate":336,"tags":337,"attachments":338,"creatorUser":27,"workflowStepId":240,"workflowStep":27},"2026-11-03T11:39:38.8118052Z",{},"c8b527e2-07bc-4677-8c00-d222be26d357","Traçabilité des opérations","Afin de pouvoir identifier un accès frauduleux ou une utilisation abusive de données personnelles, ou de déterminer l’origine d’un incident, il convient d’enregistrer certaines des actions effectuées sur les systèmes informatiques. Les traces alors collectées sont également des éléments de preuve utiles pour la démonstration de la conformité.","https://www.cnil.fr/fr/securite-tracer-les-operations","2026-11-02T20:57:33.4681365",[],[],{"date":340,"state":217,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":341,"id":342,"ref":27,"label":343,"type":257,"description":344,"relatedRisk":27,"moreDetailsUrl":345,"dateCreation":248,"dateUpdate":346,"tags":347,"attachments":348,"creatorUser":27,"workflowStepId":240,"workflowStep":27},"2026-11-03T11:39:38.8118057Z",{},"cae348c2-e9f2-4e49-8d60-ab56e438d5a4","Sauvegarde","Des copies de sauvegarde doivent être réalisées et testées régulièrement pour être disponibles en cas de besoin. Les précautions élémentaires S’agissant de la sauvegarde des données","https://www.cnil.fr/fr/securite-sauvegarder","2026-11-02T20:57:34.7827534",[],[],{"date":350,"state":217,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":351,"id":352,"ref":27,"label":353,"type":257,"description":354,"relatedRisk":27,"moreDetailsUrl":355,"dateCreation":356,"dateUpdate":27,"tags":357,"attachments":358,"creatorUser":359,"workflowStepId":228,"workflowStep":27},"2026-11-03T11:39:38.8118061Z",{},"6eddff0a-1378-4160-69b2-08df38010b92","Continuité et reprise d'activité","Pour limiter le temps d’indisponibilité du système, il faut anticiper les incidents les plus courants. Assurer la continuité d’activité consiste à prévoir des moyens de continuer de fonctionner, en général de manière dégradée, malgré des dysfonctionnements. La reprise d’activité, quant à elle, englobe toutes les actions nécessaires pour relancer un système arrêté.","https://www.cnil.fr/fr/securite-prevoir-la-continuite-et-la-reprise-dactivite","2026-11-02T20:57:39.8112993",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"date":361,"state":217,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":362,"id":363,"ref":27,"label":364,"type":221,"description":365,"relatedRisk":27,"moreDetailsUrl":366,"dateCreation":367,"dateUpdate":27,"tags":368,"attachments":369,"creatorUser":370,"workflowStepId":228,"workflowStep":27},"2026-11-03T11:39:38.8118066Z",{},"10c6151c-c44c-46df-69b3-08df38010b92","Gestion des incidents et des violations","Il convient d’être préparé à l’éventualité d’un incident pour intervenir à temps et de manière appropriée, en intégrant l’objectif de limiter les effets pour les personnes dont les données sont concernées. Le responsable de traitement peut être amené à notifier la CNIL ou informer les personnes concernées de l’incident en fonction du risque pour celles-ci.","https://www.cnil.fr/fr/securite-gerer-les-incidents-et-les-violations","2026-11-02T20:57:40.7676498",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"date":372,"state":217,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":373,"id":374,"ref":27,"label":375,"type":221,"description":376,"relatedRisk":27,"moreDetailsUrl":377,"dateCreation":378,"dateUpdate":27,"tags":379,"attachments":380,"creatorUser":381,"workflowStepId":228,"workflowStep":27},"2026-11-03T11:39:38.8118075Z",{},"e064565b-514e-4755-69b4-08df38010b92","Analyse de risques","En parallèle de la mise en conformité aux précautions élémentaires présentées dans ce guide, il est pertinent, voire obligatoire selon la criticité des traitements, de réaliser des analyses de risques relative à la protection des données. Ces analyses permettent de décider des mesures de sécurité complémentaires, adaptées au contexte, permettant de limiter l’impact sur les personnes concernées par le traitement.","https://www.cnil.fr/fr/securite-analyse-de-risques","2026-11-02T20:57:42.2940193",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"date":383,"state":217,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":384,"id":385,"ref":27,"label":386,"type":257,"description":387,"relatedRisk":27,"moreDetailsUrl":388,"dateCreation":248,"dateUpdate":389,"tags":390,"attachments":391,"creatorUser":27,"workflowStepId":240,"workflowStep":27},"2026-11-03T11:39:38.8118079Z",{},"eaf489b5-7441-4bb3-8aee-0b894f6ade51","Chiffrement, hachage et signature","Moyens mis en œuvre pour assurer la confidentialité des données conservées (en base de données, dans des fichiers plats, dans les sauvegardes, etc.) ainsi que les modalités de gestion des clés de chiffrement (création, conservation, modification en cas de suspections de compromission, etc.).\n\nDétaillez les moyens de chiffrement employés pour les flux de données (VPN, TLS, etc.) intégrés dans le traitement.","https://www.cnil.fr/fr/securite-chiffrement-hachage-signature","2026-11-02T20:57:36.4902402",[],[],{"date":393,"state":217,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":394,"id":395,"ref":27,"label":396,"type":221,"description":397,"relatedRisk":27,"moreDetailsUrl":398,"dateCreation":248,"dateUpdate":399,"tags":400,"attachments":401,"creatorUser":27,"workflowStepId":240,"workflowStep":27},"2026-11-03T11:39:38.8118083Z",{},"47c52bcb-a6e9-487b-a958-f027b20dbd87","Encadrement de la sous-traitance","Les traitements de données réalisés par un sous-traitant pour le compte du responsable de traitement doivent bénéficier de garanties suffisantes, notamment en matière de sécurité.","https://www.cnil.fr/fr/securite-gerer-la-sous-traitance","2026-11-02T20:57:31.4211019",[],[],{"date":403,"state":217,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":404,"id":405,"ref":27,"label":406,"type":221,"description":407,"relatedRisk":27,"moreDetailsUrl":408,"dateCreation":248,"dateUpdate":409,"tags":410,"attachments":411,"creatorUser":27,"workflowStepId":240,"workflowStep":27},"2026-11-03T11:39:38.8118088Z",{},"49230bff-1cd3-46bd-85f5-e43809136dc9","Sécurité des échanges avec l'extérieur","Sans mesure complémentaire, les canaux de transmission de données grand public (ex. : messagerie électronique, messagerie instantanée, plateforme de dépôt de fichiers) constituent rarement un moyen de communication sûr pour transmettre des données personnelles. Une simple erreur d’inattention peut conduire des personnes non habilitées à prendre connaissance de données personnelles, ce qui porte atteinte au droit à la vie privée des personnes concernées.","https://www.cnil.fr/fr/securite-securiser-les-echanges-avec-lexterieur","2026-11-02T20:57:29.3610605",[],[],{"date":413,"state":217,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":414,"id":415,"ref":27,"label":416,"type":257,"description":417,"relatedRisk":418,"moreDetailsUrl":164,"dateCreation":419,"dateUpdate":27,"tags":420,"attachments":421,"creatorUser":27,"workflowStepId":240,"workflowStep":27},"2026-11-03T11:39:38.8118092Z",{},"e71c1bfd-bbe5-4443-aa6b-e45b07a6f1c4","Hébergeur de données de santé agréé au sens de l’art L.1111-8 du code de la santé publique","Utiliser des hébergeurs de données de santé certifiés pour stocker les informations médicales.","Compromission des données de santé, non-conformité réglementaire.","2022-03-31T08:26:29.0136244",[],[],{"date":423,"state":217,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":424,"id":425,"ref":27,"label":426,"type":221,"description":427,"relatedRisk":27,"moreDetailsUrl":428,"dateCreation":429,"dateUpdate":27,"tags":430,"attachments":431,"creatorUser":432,"workflowStepId":228,"workflowStep":27},"2026-11-03T11:39:38.8118095Z",{},"ed5a21e9-b108-48fe-69b9-08df38010b92","PGSSI-S : référentiels de sécurité des systèmes d'information de santé","Appliquer les référentiels et guides de la politique générale de sécurité des systèmes d'information de santé (PGSSI-S), tenue par l'Agence du numérique en santé.","https://esante.gouv.fr/produits-services/pgssi-s","2026-11-02T20:57:47.544449",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"date":434,"state":217,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":435,"id":436,"ref":27,"label":437,"type":221,"description":438,"relatedRisk":27,"moreDetailsUrl":439,"dateCreation":440,"dateUpdate":27,"tags":441,"attachments":442,"creatorUser":443,"workflowStepId":228,"workflowStep":27},"2026-11-03T11:39:38.8118099Z",{},"eba73701-684c-4de3-69ba-08df38010b92","RGS : référentiel général de sécurité des autorités administratives","Appliquer le référentiel général de sécurité (RGS) de l'ANSSI : homologation de sécurité des systèmes d'information des autorités administratives (ordonnance n° 2005-1516).","https://cyber.gouv.fr/le-referentiel-general-de-securite-rgs","2026-11-02T20:57:48.3845718",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[445,454,462],{"subjectCategory":446,"displayName":448,"id":452,"subjectCategoryId":447,"comment":27,"dataSubjectVolumeMax":27,"readonly":28,"purposes":453},{"id":447,"label":448,"ref":27,"dateCreation":449,"dateUpdate":27,"creatorUserId":27,"creatorUser":27,"description":27,"minorConcerned":209,"workflowStepId":450,"workflowStep":27,"dataRetentionRules":451},"bcf7ff52-d7f9-4aa0-26a2-08dac757bbf1","Patients","2022-11-15T22:22:36.6908658",97319,[],"968db70d-5db2-4575-e6b7-08df38010be0",[],{"subjectCategory":455,"displayName":457,"id":460,"subjectCategoryId":456,"comment":27,"dataSubjectVolumeMax":27,"readonly":28,"purposes":461},{"id":456,"label":457,"ref":27,"dateCreation":458,"dateUpdate":27,"creatorUserId":27,"creatorUser":27,"description":27,"minorConcerned":28,"workflowStepId":450,"workflowStep":27,"dataRetentionRules":459},"3138b131-c552-4f03-26b7-08dac757bbf1","Professionnels de santé","2022-11-15T22:24:43.5885768",[],"17518e45-d3ab-49f0-e6b8-08df38010be0",[],{"subjectCategory":463,"displayName":465,"id":469,"subjectCategoryId":464,"comment":27,"dataSubjectVolumeMax":27,"readonly":28,"purposes":470},{"id":464,"label":465,"ref":27,"dateCreation":466,"dateUpdate":27,"creatorUserId":467,"creatorUser":27,"description":27,"minorConcerned":28,"workflowStepId":450,"workflowStep":27,"dataRetentionRules":468},"d0b5b5f8-c58e-4172-b66b-ff3a2792ff2a","Utilisateurs des SI","2023-03-22T17:20:52.655827",31,[],"1095037e-fa9d-46db-e6b9-08df38010be0",[],"\u003Cblockquote>\u003Cp>\u003Cstrong>Modèle à adapter\u003C/strong>\u003C/p>\u003Cp>Modèle de traitement fourni à titre indicatif, à adapter à votre organisation. Les finalités, les données, les durées de conservation, les destinataires, les mesures de sécurité et l'analyse d'impact y sont des valeurs de départ, établies à partir des textes et référentiels cités ci-dessous. \u003Cstrong>Ce modèle ne constitue pas un avis juridique\u003C/strong> : faites-le valider par votre DPO ou votre conseil.\u003C/p>\u003C/blockquote>\u003Cblockquote>\u003Cp>\u003Cstrong>Point d'attention\u003C/strong> : Ce modèle repose sur le projet de recommandation de la CNIL sur le dossier patient informatisé (mars 2025) : la version définitive est à confronter avant utilisation. Les durées de conservation (20 ans, 28 ans pour un mineur, 10 ans après le décès) sont reprises de ce projet : à confirmer sur le Code de la santé publique en vigueur.\u003C/p>\u003C/blockquote>\u003Ch3>Sources\u003C/h3>\u003Cp>\u003Cem>Classement selon le guide pratique CNIL « Les durées de conservation ».\u003C/em>\u003C/p>\u003Cul>\u003Cli>\u003Cstrong>Doctrine CNIL (durée recommandée)\u003C/strong> : \u003Ca href=\"https://www.cnil.fr/sites/cnil/files/2025-03/projet_de_recommandation_dossier_patient_informatise.pdf\">CNIL, Projet de recommandation Dossier patient informatisé (DPI), mars 2025, soumis à consultation publique\u003C/a>. Périmètre, responsabilité, base légale (art. 6.1.c et 9.2.h du RGPD), AIPD annuelle, catégories de données, cloisonnement des données administratives, durées de conservation (20 ans, 10 ans après décès), traces, habilitations, authentification multifacteur, hébergement HDS, sous-traitants et destinataires.\u003C/li>\u003Cli>\u003Cstrong>Doctrine CNIL\u003C/strong> : \u003Ca href=\"https://www.cnil.fr/fr/conformite-et-securite-des-dossiers-medicaux-la-cnil-lance-une-consultation-publique-sur-un-projet\">CNIL, Conformité et sécurité des dossiers médicaux : consultation publique sur un projet de recommandation\u003C/a>. Confirme que le texte retrouvé est un projet soumis à consultation (clôturée le 16 juin 2025) et ne mentionne pas de version définitive.\u003C/li>\u003C/ul>","Automatic","ManualOrOnDemand","NonApplicable","Les personnes sont informées au moment de la collecte (art. 13 du RGPD) ou, en cas de collecte indirecte, au plus tard dans un délai d'un mois (art. 14).","Droit à l'effacement non applicable : le traitement est nécessaire au respect d'une obligation légale (art. 17.3.b du RGPD).","Droit d'opposition non applicable : il ne vise que les traitements fondés sur l'intérêt légitime ou une mission d'intérêt public (art. 21.1 du RGPD) ou la prospection (art. 21.2). Ici le traitement repose sur une obligation légale, un contrat ou le consentement. Le consentement se retire à tout moment (art. 7.3).","Droit à la portabilité non applicable : il ne vise que les traitements automatisés fondés sur le consentement ou un contrat (art. 20 du RGPD).",[],[481,489,495,501,516,523,530,537],{"purposes":482,"dataRetentionRules":27,"parentId":27,"children":483,"displayName":484,"label":484,"transfers":485,"recipientType":486,"type":487,"jobTitle":27,"id":488,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Équipe de soins de l'établissement",[],"InternalService","Recipient","6a806837-dd6b-4812-a0a0-08df38010bcb",{"purposes":490,"dataRetentionRules":27,"parentId":27,"children":491,"displayName":492,"label":492,"transfers":493,"recipientType":486,"type":487,"jobTitle":27,"id":494,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Département d'information médicale (DIM)",[],"0bb4f3da-1e10-4c74-a0a1-08df38010bcb",{"purposes":496,"dataRetentionRules":27,"parentId":27,"children":497,"displayName":498,"label":498,"transfers":499,"recipientType":486,"type":487,"jobTitle":27,"id":500,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Direction des systèmes d'information et sécurité",[],"d83376de-1b2b-41da-a0a2-08df38010bcb",{"purposes":502,"dataRetentionRules":27,"parentId":27,"children":503,"displayName":504,"label":505,"transfers":506,"recipientType":507,"type":487,"jobTitle":27,"id":508,"actorId":509,"actor":510,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Sous-traitant à préciser","Éditeur du logiciel DPI et prestataires de maintenance",[],"Vendor","4562142d-2051-452f-a0a3-08df38010bcb","1af96d46-eb9e-45f3-64bc-08df38010bd1",{"label":504,"id":509,"ref":27,"dateCreation":511,"dateUpdate":27,"reviewDate":27,"nextReviewDate":27,"logoUrl":27,"state":512,"actorType":513,"description":514,"countryCode":27,"readonly":28,"email":27,"phoneNumber":27,"contactName":27,"contactPosition":27,"immatriculationNumber":27,"websiteUrl":27,"address":27,"zipCode":27,"city":27,"region":27,"workflowStepId":515,"areaId":27,"source":54},"2026-11-02T20:57:51.2801474","New","Morale","Acteur générique des modèles de traitement : à remplacer par le prestataire retenu (sous-traitant au sens de l'article 28 du RGPD).",76516,{"purposes":517,"dataRetentionRules":27,"parentId":27,"children":518,"displayName":504,"label":519,"transfers":520,"recipientType":507,"type":487,"jobTitle":27,"id":521,"actorId":509,"actor":522,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Hébergeur de données de santé certifié HDS",[],"dffe2158-f793-4b44-a0a4-08df38010bcb",{"label":504,"id":509,"ref":27,"dateCreation":511,"dateUpdate":27,"reviewDate":27,"nextReviewDate":27,"logoUrl":27,"state":512,"actorType":513,"description":514,"countryCode":27,"readonly":28,"email":27,"phoneNumber":27,"contactName":27,"contactPosition":27,"immatriculationNumber":27,"websiteUrl":27,"address":27,"zipCode":27,"city":27,"region":27,"workflowStepId":515,"areaId":27,"source":54},{"purposes":524,"dataRetentionRules":27,"parentId":27,"children":525,"displayName":526,"label":526,"transfers":527,"recipientType":528,"type":487,"jobTitle":27,"id":529,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Professionnels de santé extérieurs participant à la prise en charge (médecin traitant, autre établissement)",[],"ThirdParty","f077cdec-e4bd-4c43-a0a5-08df38010bcb",{"purposes":531,"dataRetentionRules":27,"parentId":27,"children":532,"displayName":533,"label":533,"transfers":534,"recipientType":535,"type":487,"jobTitle":27,"id":536,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Autres établissements en responsabilité conjointe (ex. groupement hospitalier de territoire)",[],"JointController","4a313e09-2125-44c4-a0a6-08df38010bcb",{"purposes":538,"dataRetentionRules":27,"parentId":27,"children":539,"displayName":540,"label":540,"transfers":541,"recipientType":542,"type":487,"jobTitle":27,"id":543,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Patient (accès à son dossier)",[],"DataSubject","dcd5e27e-aefe-4821-a0a7-08df38010bcb",[],[546,552,556,560],{"id":547,"key":33,"label":548,"description":549,"legalBasis":550,"legalBasisText":551,"legalBasisDescription":27,"readonly":28},"3654a8d1-30a6-43cf-107b-08df38010b80","Prise en charge et suivi du patient","Enregistrer les données nécessaires aux soins (diagnostic, traitement, suivi) et les conserver dans le dossier. Le projet de recommandation de la CNIL retient l'obligation légale (art. 6.1.c du RGPD) car les établissements doivent tenir et conserver un dossier (art. R. 1112-2 et R. 1112-7 du code de la santé publique), et l'art. 9.2.h du RGPD pour les données de santé.","LegalCommitment","Obligation légale",{"id":553,"key":92,"label":554,"description":555,"legalBasis":550,"legalBasisText":551,"legalBasisDescription":27,"readonly":28},"fa4fa982-545c-4880-107c-08df38010b80","Coordination des soins et échanges avec les professionnels de santé","Partager les informations utiles avec l'équipe de soins et avec les professionnels extérieurs qui interviennent dans le parcours du patient (médecin traitant, lettre de liaison). Même fondement que la prise en charge (art. 6.1.c et 9.2.h du RGPD), selon le projet de recommandation de la CNIL.",{"id":557,"key":32,"label":558,"description":559,"legalBasis":550,"legalBasisText":551,"legalBasisDescription":27,"readonly":28},"e3b42d3d-d9d5-4041-107d-08df38010b80","Identification du patient et gestion administrative du dossier","Identifier correctement le patient (identifiant national de santé, identitovigilance) et gérer les données administratives du dossier. La facturation et le remboursement sont hors du périmètre de la recommandation de la CNIL et doivent faire l'objet d'un traitement distinct.",{"id":561,"key":171,"label":562,"description":563,"legalBasis":550,"legalBasisText":551,"legalBasisDescription":27,"readonly":28},"f5435e34-8198-481c-107e-08df38010b80","Traçabilité et sécurité des accès au dossier","Journaliser les connexions, consultations et modifications pour détecter les accès illégitimes et documenter le dossier. La CNIL recommande cette traçabilité au titre de l'obligation de sécurité (art. 5.1.f et 32 du RGPD).",100,56,45]