Digital health infrastructure is no longer limited to teleconsultation. We are witnessing a convergence of digital identity, regulatory interoperability, and cybersecurity constraints that is reshaping the daily management of care pathways. Understanding these mechanisms allows for the real exploitation of available tools, beyond marketing promises.
Cybersecurity of health data: the constraint that conditions everything else
No digital health tool stands without a security foundation. On September 3, 2026, the CNIL imposed a fine of 500,000 euros on the Private Hospital of the Loire after an attacker accessed the data of 524,867 patients and 202,246 trusted third parties. The decision highlights structural flaws: lack of detailed access logging, overly broad authorizations, and insufficient control over the publisher’s access to the electronic patient record.
This type of sanction changes the game for institutions and software publishers. The CNIL now requires a strict limitation of authorizations by professional profile, which necessitates a review of access matrices in each hospital information system. For patients, this means that the reliability of a digital health service directly depends on the rigor of its operator, not its interface.
We recommend checking, before using a patient portal or connected application, whether the publisher publishes its access management policy and whether it has undergone recent audits. The resources available regarding health with Virtual Papyrus allow for tracking these regulatory developments and their concrete impacts on the digital management of care pathways.
My health space: activation, feeding, and real usage
My health space perfectly illustrates the gap between technical deployment and real adoption. According to a report from the Health Insurance published in September 2026, nearly 97% of the population has a profile. However, only 24 million profiles are activated.
The figure that deserves attention: more than 70% of French people have received at least one document in their space over the past twelve months. The service is therefore fed by healthcare professionals, even when patients do not consult it. Prescriptions, hospitalization reports, and laboratory results are already being transmitted to these spaces.
The problem is not the tool, but the usage loop. A patient who does not activate their profile receives no notifications, consults no documents, and does not benefit from the digital health record. Activation remains a voluntary process, which mechanically hinders ownership. For doctors, systematic feeding represents a setup burden in practice management software, sometimes poorly compensated by gains in coordination.
What an activated profile changes
- Centralized access to medical history: test results, prescriptions, specialist letters, without relying on a single institution or practice.
- Secure health messaging: direct exchanges with professionals, traceability of requests, reduction of phone calls for simple information.
- Management of wishes and advance directives: an often-overlooked aspect, but one that avoids complex situations in emergencies.
European regulation on health data: cross-border interoperability
The European regulation on the European health data space, referenced EU 2025/327, came into effect on March 26, 2025. It provides for a gradual implementation with the first priority cross-border exchanges starting in March 2029.
This text transforms interoperability into a legal obligation. Health software publishers will need to ensure that structured data (diagnoses, treatments, allergies) are readable by the systems of another Member State. In practice, this requires the adoption of standardized formats and common terminologies.
For patients, the impact will be realized during stays in another European country: a doctor will be able to consult a summary of the file without the patient having to carry paper documents. The challenge lies in the timeline. Institutions must adapt their information systems by 2029, which involves investments in infrastructure and training for technical teams.
Consequences for publishers and professionals
Publishers of electronic patient records will need to certify the compliance of their solutions with the European exchange format. Those who do not comply risk losing hospital markets. For private practitioners, the update will go through practice management software publishers, with costs and timelines yet to be specified.
Telemedicine and everyday digital tools: beyond video consultation
Telemedicine has established itself in practices, but its scope goes beyond simple videoconferencing. The digital tools used daily by patients include online appointment booking, electronic prescription renewals, and remote monitoring of clinical parameters (blood sugar, blood pressure, heart rate).
We observe that adoption varies significantly according to pathologies and age groups. Patients with chronic illnesses benefit the most from telemonitoring, as it reduces travel and allows for more responsive therapeutic adjustments. In contrast, first-line consultations remain predominantly in-person.
- Telemonitoring: regular transmission of biometric data to the treating physician, with automatic alerts in case of threshold exceedance.
- Tele-expertise: a general practitioner seeks the opinion of a specialist on a patient file, without the patient having to travel.
- Digital prescriptions: direct transmission to the pharmacy, reducing transcription errors and automatic archiving in My health space.
The main barrier remains the digital divide. Patients without suitable equipment or sufficient digital skills find themselves excluded from these circuits. Institutions and local authorities are beginning to deploy digital health mediators to support these populations, but coverage remains uneven.
The digital management of health on a daily basis relies on three technical pillars that progress at different rates: data security, regulatory interoperability, and patient adoption. The most fragile link remains voluntary activation by the user, without which the entire infrastructure loses its purpose.
