# Presentation: 777126

## The French Experience onSmart Cards in Health Sector

**Jacques SAURET**
**French Ministry of **
**Health and Social Affairs**
**jacques.sauret@sante.gouv.fr**

## Agenda

**Objectives**
**System Design**
**Roll Out**
**Perspectives**
**Feed back  on French situation**

## Objectives

## Objectives

**Government Objectives : Create a real National Information System in Healthcare Sector**
- Medical control of the evolution of Health Care expenses
- Transfer of medical information between HP and HIF
- Computers are needed for such sophisticated IS
- Cards are needed for security and reliability
- Enhance quality of care through a better coordination between HP
- Direct access to emergency information
- Remote access to medical databases in a secure way (regarding habilitation and privacy)
- Secure messaging between HP

## Objectives

**HIF Objectives**
- The government ones
- Reduction of administrative costs
- Return on investments (better care management)
- Enhance the quality of their databases (identification of protected persons and HP)
- Definition of best practices

## Objectives

**HP Objectives**
- An opportunity to reorganise relationships between HP (e.g. GP vs. specialists)
- Production of medical statistics (self evaluation) and access to medical statistics
- Negotiate the introduction of cards (cards are seen as “imposed”, HP do the administrative job of HIF)

## System Design

## System Design

**HP are free to chose their computers**
- Open Systems
- Compatibility with de facto standards (Internet) and off the shelf products
- Lack of control on evolutions (market driven)
- Anticipation in system design
- Terminals should be reusable for other applications (e.g. health, payment, e-commerce)

## System Design

**Network**
- RSS as a “Public Service” (QoS, security, etc.)
- Dedicated to HP for all traffic (electronic reimbursement claims, personal mails, EDI, access to remote servers / databases, etc.)
- Compatibility with Internet de facto standard
- Close integration with Smart Cards
- RSS in competition with other ISP's

## System Design

**Registration Authorities**
- Government
- Health Insurance Funds
- HP councils
**Certification Authorities**
- GIE SESAM-Vitale for patients information
- GIP CPS for HP information
**Directories, CRL's**
- GIP CPS
- GIE SESAM-Vitale

## System Design

**Justification for Patient cards**
- Insured persons identification (NIR : unique national number + first name & last name)
- Entitlement to care
- Medical Information (emergency and more detailed data) : not a complete record
- Portability

## System Design

**Justification for smart cards (patient and HP)**
- Security tool
- Data integrity
- Cost (cards, infrastructure)
- Evolutions
- Reusability (e.g. other administrations) if the card is reliable (technology, content) : security evaluation

## Roll Out

## Roll Out

**Patient Data Card : Vitale** 40 Million cards (insured persons) by May 99
- Smart card (M9 OS, 3-4 KB EEPROM)
- Chips from Thomson and Motorola
- Providers : Bull-Orga, Gemplus, Oberthur, Schlumberger (Solaic)
- Average of 4M cards per month (up to 7M in March)
- ITSEC Certificate

## Roll Out

**Health Professional Card : CPS**
- Family of cards (CPS, CPE, CPF, CPA, CSA) 50,000 cards (mainly Physicians) by May 99
- Target : more than 1 Million cards
- Smart card (CPS OS, crytpo-chip, 4 KB EEPROM)
- Chips from Thomson
- Provider : Schlumberger
- ITSEC Certificate

## Perspectives

## Perspectives

**Vitale 2 Card :  an individual card (60 M)**
- Smart card (16 KB EEPROM)
- Medical data set
- Mandatory + Private HI
- Security tool (card & cardholder authentication, digital signature, encryption key, etc.)
**HP Card : a fully standard compliant card**
- Authentication and signature : RSA
- Encryption : RSA and DH
- X509 certificates storage

## Feed back  on French situation

## Feed back  on French situation

**Political problems**
- Many actors involved
- Reluctancy of HP for HIS (threat of control, of new technologies)
- Long term process

## Feed back  on French situation

**Organisational problems**
- Certification of all the identifiers for the whole population (60 M in France)
- HP certification process (credentials)
- Card Distribution... a chicken and egg problem
- First : Vitale cards
- Synchronisation with CPS distribution and RSS availability
- Do not wait for HP to be ready to accept cards

## Feed back  on French situation

**Technical problems**
- System Integration is complex (large scale, number of actors, etc.)
- Smart cards have to be integrated with open systems
- Smart card life cycle vs. de facto standard
- Lack of solution from the industry (e.g. PC/SC is compatible with “transparent” mono-slot terminals and MS-Windows only)
- Integration of SC / Terminals / Workstations by card issuers (GIE SESAM-VITALE, GIP CPS)

## Conclusion (1)

**Smart card is ONE component of a whole Information System**
**Smart cards are needed to reach a high level of security and for portability**
**Smart cards need to be secured (ITSEC, Common Criteria), reliable and cost effective **
**Objective : Trust by users**

## Conclusion (2)

**Issuing Cards is an industrial process not so difficult to control (mass distribution must be planned in advance)**
**Cards represent approx. 10 % of the cost of the  Security of an Information System (RA, PKI, etc.)**
**Issues are neither on technical points nore on card technology, but on information systems (PKI), organisational and financial topics**

## Conclusion (3)

**Need for national and international cooperation with other sectors**
- Services, Technical topics (cards technology, card management, terminals, TTP, etc.), Organisational topics
**Need for international cooperation in the Health Care sector : use of technology**
- Simplification of procedures for citizens
- Facilitate the secure exchange of information between HP

## Thanks for your attention

**For more information :****http://www.sesam-vitale.fr****http://www.sante.gouv.fr/sis**