Confidentiality Policy (ASF-GOV-004)

Version History

1. Purpose

1.1Confidence in confidentiality is essential to the integrity of the accreditation process. Applicants and accredited organisations must be able to share sensitive operational, clinical, and financial information with ASF surveyors and decision-makers, knowing this information will be used solely for accreditation purposes and will not be disclosed without consent.

1.2This policy establishes ASF’s requirements for protecting confidential information across all accreditation activities: survey conduct, decision-making, standards development, appeals, and post-accreditation monitoring. Confidentiality obligations are indefinite — they do not expire at the end of an engagement.

2. Scope of Application

This policy applies to all ASF surveyors, committee members, the ASF President, external experts and consultants, and any administrative or support staff with access to accreditation records. The obligation is effective from the moment confidential information is received and continues indefinitely.

3. Classification of Confidential Information

3.1The following categories are classified as confidential by default:

3.2Where there is doubt as to whether information is confidential, it is treated as confidential until ASF confirms otherwise.

4. What Is Publicly Disclosed

4.1ASF publishes the following for each accredited organisation (with consent or as a condition of accreditation): name and address of the accredited facility; the ASF standard assessed against; accreditation status; effective dates; and certificate number.

4.2The following governance documents are publicly disclosed on france-asf.fr: all published accreditation standards; this policy and all other published governance documents (GOV, OPS, QMS series); ASF-EV-001 through ASF-EV-004; and the ASF ISQua accreditation certificate on receipt. No other information is disclosed without express written consent.

5. Confidentiality Obligations of Personnel

All persons subject to this policy must: (a) use confidential information only for the accreditation purpose for which it was received; (b) not disclose it to any third party without ASF’s express written authorisation; (c) take reasonable precautions against unauthorised access; (d) return or securely destroy confidential documents on completion of their engagement; and (e) immediately report any suspected or actual breach. These obligations do not expire.

6. Permitted Disclosures

Permitted disclosures include: (a) disclosure within the ASF team as necessary for accreditation activities; (b) disclosure to ISQua EEA assessors of anonymised/de-identified records (no facility identification without consent); (c) disclosure required by court order or applicable law (minimum necessary, advance notice to affected party where legally permitted); (d) disclosure with express written consent; and (e) aggregate anonymised data for research or public reporting where no individual is identifiable. All permitted third-party disclosures are documented and the recipient is required to agree to equivalent confidentiality obligations.

7. Data Protection and Personal Data

7.1ASF processes personal data in accordance with: GDPR (EU) 2016/679 (as a controller established in France); Loi n° 78-17 du 6 janvier 1978 (French Data Protection Act); and Law of Georgia No. 5669 on Personal Data Protection (for Georgian data subjects).

7.2Legal bases include: performance of a contract (accreditation agreement, engagement agreement); legitimate interests (operating the accreditation programme); and compliance with a legal obligation.

7.3ASF does not process special category personal data beyond what is strictly necessary. Surveyors reviewing patient records during surveys note only what is necessary to assess the criterion in question and do not record identifying patient information in reports.

7.4Data subjects have GDPR rights including access, rectification, erasure (subject to legal retention requirements), and objection. Requests are addressed to ASF at the contact details on france-asf.fr.

8. Records Retention and Destruction

At the end of retention periods, records are securely destroyed (physical: shredded; electronic: deleted and overwritten). Destruction is documented in the ASF records destruction log. Surveyors and committee members do not retain confidential documents beyond their immediate engagement.

9. Confidentiality Breach Response

9.1–9.2A confidentiality breach is any actual or suspected unauthorised disclosure, access, loss, destruction, or alteration of confidential information. Any person who becomes aware must report to the ASF President within 24 hours. Where the breach involves the President personally, report to the SDC Chair.

9.3Response steps: (a) Containment — stop ongoing disclosure, secure affected information; (b) Assessment — determine nature, scope, categories affected, and likely consequences; (c) Notification — notify affected organisations without undue delay; where the breach involves personal data meeting the GDPR Article 33 threshold, notify the CNIL within 72 hours; (d) Remediation — implement measures to prevent recurrence; (e) Documentation — record the breach, assessment, notifications, and remediation in the ASF breach register.

9.5Intentional unauthorised disclosure: permanent removal from all ASF activities. Negligent handling resulting in a breach: formal warning and possible suspension. Decisions may be appealed under ASF-GOV-005.

10. ISQua EEA Alignment

This policy meets the requirements of ISQua EEA Principle 6 (Confidentiality) and the data protection requirements of ASF’s operating jurisdictions. The ASF ISQua EEA Crosswalk (ASF-EV-004) maps these provisions to the applicable EEA criteria.

11. References

Document code: ASF-GOV-004  ·  Version: V3.0  ·  Effective: 2026-09-30  ·  Next review: September 2031  · 
All governance documents

Download the approved document

ASF-GOV-004 — Confidentiality Policy · Version V3.0

Download PDF Full ASF Standards Package 2026