The digital tools of a medical practice or healthcare facility are no longer limited to patient management software and secure messaging. The enforcement of the European regulation on the European Health Data Space (EHDS) on March 26, 2025, combined with the obligations related to the European regulation on artificial intelligence since February 2, 2025, reshapes the requirements that every healthcare professional must meet in their daily practice.
Interoperability of health software: what the EHDS changes concretely
Interoperability is no longer a selling point for software publishers. It is a European regulatory obligation with a fixed deadline. The EHDS timeline provides for cross-border exchanges of patient summaries and e-prescriptions starting in March 2029, followed by an extension to medical imaging and discharge reports in March 2031.
For a practicing physician, the direct consequence affects the choice of professional software. A software not listed in the Ségur digital program will not be able to comply with future exchange standards. We recommend checking three points before any renewal or migration of solutions:
- Ségur compliance and the ability to feed Mon espace santé via the DMP, without manual re-entry of documents
- Native support for European exchange formats (CDA R2, FHIR) to anticipate the EHDS deadlines of 2029 and 2031
- Hosting with a certified health data host (HDS), a sine qua non condition for any outsourced medical data processing
Professionals who centralize their digital tools on dedicated platforms, such as those found on the AllP Santé website for professionals, gain visibility on solutions compatible with these regulatory requirements.
Generative AI in medical practices: governance before adoption
Generative AI is appealing for its ability to produce reports, synthesize a patient file, or assist in drafting letters. The regulatory framework mandates systematic human validation of each output generated. No generic AI tool (like ChatGPT or equivalent) can receive health data without prior legal analysis and specific contractual guarantees.
Recommendations converge towards establishing an internal charter for the use of generative AI, including in small structures. This charter covers at least the prohibition of entering personal data into unapproved tools, the traceability of uses, and the designation of a referent.
Selection criteria for a health AI tool
Time savings are no longer sufficient as a selection criterion. We observe that the best-prepared professionals evaluate an AI tool based on its hosting location, contractual confidentiality guarantees, and level of traceability. A tool hosted outside the European Union without standard contractual clauses (CCT) exposes the professional to direct legal risk under the GDPR.
The European regulation on AI, introduced in February 2025, imposes an AI culture obligation for individuals using affected systems. For an establishment, this translates into targeted training, distinct from simple software onboarding.
Medical activity management software: beyond the vital card
The teletransmission of care sheets via the vital card remains the foundation of billing in private practice. Current solutions go well beyond this: shared agenda management among professionals within the same structure, integrated online appointment scheduling within the professional software, and automatic SMS reminders to reduce missed appointments.
The most frequent friction point concerns synchronization between management software and national core services. The digital health roadmap 2023-2027 aims precisely to improve the integration and ergonomics of these services within daily tools. Software that requires switching between multiple interfaces to consult the DMP, send a digital prescription, and teletransmit an act generates significant time loss.
Telemedicine and outpatient monitoring
Teleconsultation tools have become commonplace, but digitally assisted outpatient monitoring remains underutilized. Connected medical devices (blood pressure monitors, glucometers, oximeters) can automatically feed the patient file when the professional software supports the appropriate communication protocols. This allows for remote monitoring of chronic patients without manual re-entry, with configurable alerts in case of abnormal values.
Tele-expertise, less visible than teleconsultation, offers a concrete lever for geographically isolated doctors. A general practitioner can seek the opinion of a specialist asynchronously, directly from their software, without the patient needing to travel.
Patient data security: NIS 2 obligations applied to healthcare professionals
The NIS 2 directive, gradually transposed into French law, expands the scope of entities subject to cybersecurity obligations. Healthcare facilities are among the identified critical sectors. For professionals in private practice, the requirements mainly focus on protecting workstations, managing backups, and encrypting exchanges.
A technical point often overlooked: the secure health messaging (MSSanté) is the only compliant channel for exchanging medical data between professionals. Using personal messaging or a public instant messaging application to transmit a report or medical image constitutes a violation of the GDPR and medical confidentiality.
The convergence of EHDS, AI regulation, and NIS 2 outlines a demanding but coherent regulatory landscape. Professionals who structure their digital tools now around compliant, interoperable solutions hosted within a certified framework position themselves to absorb these transitions without disruption to their activities.
