Health prevention for mutuelles and insurers: legal framework, data, formats, indicators

A supplementary health insurer (mutuelle) or an insurance company can act on prevention in three ways: funding “prevention-related benefits” in its contracts, entering into agreements with professionals and facilities, and offering programs to its members. The rule that governs everything: the organization never sees individual health data, only aggregated indicators.

Why are mutuelles and insurers investing in health prevention?

Because prevention is one of the few health expenses likely to avoid others, and because it has become a service that members and corporate clients expect. The Mutualité Française, which brings together “nearly 500 mutuelles” covering “32 million French people,” describes itself as the “leading private player in prevention” and points out that 2.3% of current health expenditure was devoted to prevention in 2023, or €7.5 billion.

Three motives come up among the supplementary insurers we meet. The first is economic: chronic diseases and mental health weigh on benefits paid out, and some of these events can be avoided or delayed; however, no return-on-investment figure can be promised without a dedicated study. The second is contractual: in group health insurance, companies now expect services beyond reimbursement, and prevention is one of the most requested; our guide on workplace health prevention details what employers can and cannot do. The third is about identity: for a mutuelle, a nonprofit member-owned organization, prevention extends its original mission. It already translates into group initiatives: the Mutualité Française focuses on four topics (diet and physical activity, mental health, environmental health, occupational health), carried out by 17 regional unions.

What legal framework governs a supplementary insurer’s prevention initiatives?

Three sets of rules frame what supplementary insurers can do: Article L871-1 of the French Social Security Code for contrats responsables, Article L863-8 for agreements with health professionals, and health data law (medical secrecy, GDPR) for anything that concerns the member themselves.

Contrats responsables and “prevention-related benefits”

Article L871-1 of the French Social Security Code, in the version in force since February 28, 2025, sets the conditions for a contrat responsable (“responsible contract,” the standard framework for supplementary health insurance in France): no coverage of the flat-rate contribution and deductibles (participation forfaitaire and franchises), direct billing (tiers payant) at least up to the reference rate, coverage of certain out-of-pocket costs, and coverage that may include “prevention-related benefits.” The organization must also inform its members every year of the ratio between benefits paid and premiums. Prevention allowances fall within this framework (non-reimbursed vaccines, smoking cessation, bone density scans, dietitian or psychologist consultations, depending on the contract).

The “solidarity-based” nature of the contract, which rules out any medical questionnaire at enrollment and any pricing based on health status, completes this framework. It has a direct consequence for prevention: a program can under no circumstances be used to learn about a member’s health status in order to adjust their coverage.

Agreements with health professionals (care networks)

Article L863-8, created by Law No. 2014-57 of January 27, 2014, allows mutuelles, insurance companies and provident institutions (institutions de prévoyance) to “enter into agreements with health professionals, health facilities or health services containing commitments relating, for the insuring organization, to the level or nature of the coverage or, for the professional, facility or service, to the services provided and to the rates or prices.” The text sets limits: these agreements “may not contain any provision infringing each patient’s fundamental right to freely choose their professional”; membership is “based on objective, transparent and non-discriminatory criteria,” with no exclusivity clause; for doctors, they may not contain pricing provisions, and “the level of coverage of medical services […] may not vary depending on whether the insured person chooses to consult a doctor who has entered into an agreement.” The organization must inform its members that such agreements exist.

For prevention, this article makes it possible to enter into agreements with health centers, laboratories or prevention services for a given pathway, provided that freedom of choice is respected and the reimbursement of medical services is not varied.

Mutualist care and support services

Mutuelles also run facilities directly: health centers, dental and optical centers, facilities for older people. The Mutualité Française (FNMF) is a signatory of the national agreement for health centers of August 28, 2025, which adds a “prevention” focus to their lump-sum payments. Our guide on the prevention pathway in health centers describes what these facilities can organize.

Health data: what can a mutuelle see, and what can it not see?

To reimburse claims, a supplementary insurer receives codes that identify the category of service and, in some cases, prescriptions; it sees no diagnosis, no result and no consultation content. For a prevention program, the rule is even stricter: individual data stays with the health professionals and the certified host; the organization receives only aggregated, anonymized indicators.

What the CNIL says

In its statement of November 14, 2022, the CNIL, the French data protection authority, points out that supplementary insurers receive “medical prescriptions and prescription forms” as well as the codes used for reimbursement (grouping codes, association codes, refined codes), and that “information sent to supplementary health insurers (OCAM) is covered by medical secrecy.” It notes that the exception to secrecy allowing direct transmission from professionals to supplementary insurers is “either very implicit or non-existent,” accepts that transmissions may continue for contrats responsables, which account for the vast majority of contracts, and “reiterates its wish for a law to be adopted” to secure the framework. In other words: even reimbursement data is health data under secrecy, to be handled with care.

What this means for a prevention program

Professional secrecy under Article L1110-4 of the French Public Health Code covers “all information concerning the person that has come to the professional’s knowledge,” and only allows exchanges between professionals “involved in the person’s care,” for information “strictly necessary for the coordination or continuity of care.” A mutuelle or an insurer is not a professional involved in the person’s care: it therefore cannot receive an identified member’s health questionnaire answers, prevention plan or test results, unless the member sends them personally, on their own initiative.

The contract with the program operator must spell all of this out: roles of data controller and processor, storage with a certified health data host (HDS), retention period, display threshold for indicators, prohibition of any cross-referencing with management files. Our commitments on these points are described on the security and data page.

Which prevention formats should you offer members?

Formats range from information to long-term individual support; the most effective build on existing reimbursed programs rather than competing with them, and reserve the supplementary insurer’s funding for what French National Health Insurance (Assurance Maladie) does not cover.

Two guidelines for choosing. First: start with what is reimbursed. The prevention check-up at the four key ages, Mon bilan prévention (France’s national prevention check-up program), is fully covered (100%) and results in a written plan; a supplementary insurer that raises awareness of it and helps its members prepare acts without spending anything on the service itself. We describe it on our page about the prevention check-up. Second: only fund a private check-up with full knowledge of the facts; our private check-up vs covered check-up comparison and our Lucis vs Zoī comparison give the prices and limits observed in 2026. Players targeting companies and insurers are examined in our Sokrate vs Kor comparison.

How do you design a prevention program for your members?

A program is built in six steps, from the target population to the data contract; the first decision, which populations to target, determines all the others.

1. Choose the populations. By age group, aligned with the key ages of the prevention check-up, or by portfolio (a corporate client’s group contract, older individual members). Avoid targeting “everyone.”
2. Define the pathway. Information, preparation, check-up with a health professional, written plan, referral, follow-up. A program that stops at information does not change behavior; a program that skips the health professional causes worry without providing support.
3. Coordinate with the regular doctor. The plan and results go to the regular doctor (médecin traitant), unless the member objects; never to the insurer. This guarantees consistency with ongoing care and is a condition for the program’s acceptability.
4. Write the data framework. Data controller, processor, health data hosting, aggregation threshold, retention period, member information, rights of access and objection.
5. Pilot on a limited scope first. One corporate client, one region, one age group: measure, adjust, then expand.
6. Communicate over time. In waves, adapted to each population, relying on relays (companies, regional unions, mutualist care services).

Which indicators should you track, and which should you avoid?

Good indicators measure the pathway and its completion, in aggregated form; bad ones promise an effect on benefits paid that nothing makes it possible to isolate in the short term.

Two kinds of indicators should be ruled out: any individual indicator, and any numerical promise of lower claims or absenteeism presented as a given. Both expose the organization, the first legally, the second in terms of credibility.

What common mistakes should you avoid?

Disappointing programs share a few causes: a promise of data that the law prohibits, a check-up disconnected from the regular doctor, targeting that is too broad and results indicators that cannot be documented.

• Buying a program that promises individual data. It is incompatible with medical secrecy and the GDPR; it is also a reason for members to reject it.
• Funding a check-up with no link to the regular doctor. The result causes worry, is not followed up, and duplicates tests already prescribed.
• Ignoring reimbursed programs. Paying for what French National Health Insurance already fully covers (100%) is a poor use of premiums.
• Targeting all members at once. The message gets diluted; the populations that need it most do not feel concerned.
• Promising a return on investment. No figure can be put forward without a comparative study; measure participation and completion, and track benefits paid as context.
• Neglecting long-term communication. A program announced once is forgotten within a few weeks.
• Forgetting the data contract. Without precise clauses on hosting, aggregation and retention, the organization carries a risk it cannot measure.

Key takeaways

• A supplementary insurer acts on prevention through the prevention benefits of contrats responsables (L871-1), agreements with professionals and facilities (L863-8, patient’s freedom of choice) and its own care and support services.
• It never sees individual health data from a program: plans and results go to the regular doctor, the organization receives aggregated, anonymized indicators; the CNIL points out that even reimbursement data is under medical secrecy.
• Start with the programs fully covered (100%) (Mon bilan prévention, preventive health examination), and reserve funding for what they do not cover.
• Target by age group or by portfolio, pilot on a limited scope, measure participation, completion, transmission to the regular doctor and referrals.
• No numerical promise of lower benefits paid without a dedicated study.

How to organize this pathway with Sokrate

Sokrate offers mutuelles, insurers and institutions a prevention pathway they can offer to their members, mutual members or policyholders, in addition to their own employees: an adaptive questionnaire completed remotely, a check-up with a health professional, a personalized plan signed by a doctor and sent to the regular doctor unless the person objects, and follow-up by a coordinating nurse. At the key ages, the pathway builds on Mon bilan prévention, fully covered (100%) by French National Health Insurance; two rollout options are available, fully remote or combined with check-ups at partner centers. The organization has an aggregated, anonymized dashboard, with a minimum group size, stored with a certified health data host (HDS); no individual data is accessible to it. Learn more on our page for companies and institutions; to explore a rollout for your members, contact us.