Medical confidentiality on the phone: what the desk may say in France, Luxembourg, Germany

What confidentiality covers at the front desk

A breach of confidentiality does not need a medical file. It can happen at the reception counter or on the phone, when someone confirms an appointment time, spells a surname aloud or tells a caller that the doctor is running late with “your wife”. Each of these reveals that a named person is a patient, and that fact alone is covered.

The French code of medical ethics says the secret covers everything the doctor learns in practice, including what was seen, heard or understood, not only what the patient confided. The commentary from the Conseil national de l’Ordre des médecins adds that the identity of patients must be protected when they arrive, in the waiting room and when appointments are made. That last point is the phone, and it is the front desk’s daily work.

The same logic runs through all three countries this guide covers. The rules differ in who may be told what, but none of them treats a receptionist as outside the secret. Whoever answers the practice’s phone holds the secret on the doctor’s behalf.

France: the doctor answers for everyone who assists

In France, breaching professional secrecy is an offence under the Penal Code, and it applies to anyone who holds a secret through their profession or function. Secretaries are not a grey zone. The code of medical ethics requires the doctor to make sure that the people assisting them know their duty of secrecy and respect it, and the Ordre’s commentary names secretaries first in that list.

The commentary also makes the doctor responsible for any indiscretion that comes from the people around them. In practice, that means the rules your desk follows on the phone are your rules, written down and repeated, not left to each receptionist’s judgement on a busy morning.

Family members get no special right to information by default. When a diagnosis or prognosis is serious, the Ordre’s commentary says the secret does not stop relatives from receiving what they need to support the patient, unless the patient objects. That is a doctor’s decision taken with the patient, never something the desk improvises because a caller sounds worried.

Luxembourg: the companion and the trusted person

In Luxembourg, health professionals, their collaborators and students in these fields are bound by the secrecy article of the Penal Code. The guide to patients’ rights published by the Médiateur de la santé explains it plainly: they keep to themselves what they learn at work and pass nothing on outside the cases the law provides.

The patients’ rights law adds two people the desk needs to know about. A patient may choose a companion to assist them, and secrecy is lifted towards that person when the patient expressly asks. A patient may also name a trusted person in writing, to speak for them if they can no longer express their wishes, and secrecy is lifted towards that person too.

For the phone, the consequence is practical. The desk needs to know whether a companion or trusted person is recorded for a patient, and it should not take a caller’s word for it. If the name is not on file, the request goes to the team as a message, and the patient or the doctor confirms.

Germany: assistants, contractors and written undertakings

In Germany, the Criminal Code’s offence of violating private secrets covers doctors and the assistants who work for them in a professional capacity. The Bundesärztekammer’s model professional code sets out the duty of silence and allows doctors to give staff access to patient information. Doctors must explain the legal duty of secrecy and record this instruction in writing.

German law is the most explicit of the three about outside help. The Criminal Code lets a doctor disclose secrets to other persons involved in the practice’s work, but only as far as their service requires. The model professional code then requires that these persons are bound to secrecy in writing, either by the doctor or through the service company the doctor engages.

A practice that hands its phone to any external service, human or automated, should therefore have that written undertaking before the first call is routed. Beyond that circle, telling a relative or an employer anything needs the patient’s release from secrecy, outside the narrow cases where the law itself requires or permits disclosure.

What the desk can say, call by call

A patient calling about their own appointment can hear the date and time once the desk is reasonably sure who is speaking. Asking for the full name and date of birth is common, and when in doubt the desk calls back on the number the practice already holds. Results and anything clinical stay with the doctor, who decides how they are given.

A relative who asks whether someone has an appointment hears neither a confirmation nor a denial. The desk can say that it cannot give information about anyone other than the caller, offer to take a message, and pass it to the team. The same answer suits a parent calling about an adult child.

An employer, a school or an insurer asking whether an employee or pupil came in gets the same response. A sick note or a certificate goes to the patient, who decides what to hand over. If an official body calls, the desk takes the details and the request goes to the doctor, who checks what the law requires before anyone answers.

Messages, voicemail and the waiting room

Callbacks carry their own risk, because the person who picks up may not be the patient. A message left on a shared line or with whoever answers should name the practice and ask the patient to call back. Include no reason, result or doctor’s specialty that could reveal the condition. If you want help wording the practice’s own outgoing message, the phone greeting generator drafts one you can adapt.

The waiting room is the other leak. A receptionist confirming a booking aloud, repeating a date of birth or reading back the reason for a visit is heard by everyone seated nearby. Moving phone work away from the counter, or keeping identifying details out of what is said aloud, protects the patient on the line and the patients in the room.

Written traces matter as much as speech. Notes taken during a call should hold what the team needs to act and no more, and they belong in a place only the team can open. That is a confidentiality question before it is a data protection one, and our guide to voice assistants and the GDPR covers the second part.

Outsourcing the phone without widening the circle

Data concerning health is a special category under the GDPR, and the regulation allows it to be processed for care when this happens under the responsibility of a professional bound by secrecy. A provider that answers your phone acts as a processor. The GDPR requires a contract with it, which must ensure that everyone handling the data has committed to confidentiality.

So the questions to ask any provider, whether a call centre or software, are concrete. Who hears or reads the calls, where are recordings and transcripts kept and for how long, and which subcontractors process them. You also need the written commitment to confidentiality that both the GDPR and, in Germany, the professional code expect. A comparison of an AI receptionist with a medical answering service sets out how the two arrangements differ.

Where the receptionist fits

ClinicAll answers as your practice’s front desk, and it says it is the practice’s virtual receptionist whenever a caller asks. It asks for the caller’s name, date of birth and reason for calling, then books in your practice software where the integration is live, or sends your team a callback request. It does not look up a patient’s record, so it has no results or history to give away.

A caller asking about someone else gets what a careful receptionist would give: no confirmation, and a callback request for your team with the caller’s details and question. A request to change an appointment works the same way. It never moves or cancels an appointment itself: your team confirms.

It gives no medical advice and follows the urgency rules your practice defines. It transfers to the desk when it is staffed and a transfer line is configured; otherwise it takes a callback request. Its languages are French and English, verified on lines already in service, and any other language is tested on your line before it goes live. The security page lists who processes call data, where, and how long it is kept, and how it works shows a call from start to finish.

A short script for the desk

Before you change anything, write down what the desk may say and to whom. The desk shares appointment details only with the patient, after an identity check, and offers other callers a message. Messages left for patients name only the practice. Requests from officials, insurers or employers go to the doctor.

Add the local exceptions next to the script. In Luxembourg, record where to find the companion and trusted person; in France, leave information for relatives after a serious diagnosis to the doctor. In Germany, keep written undertakings for staff and outside services on file. Check that everyone covering the phone follows the script, including at lunch and after hours.

The written script is also what you hand a replacement during the holidays, so the rule does not depend on who happens to be on duty. For the next decision, when to pass a call to a person and when a callback is the safer answer, read transfer the call or take a callback, or browse the other guides for practices.