HDS: understanding France's health data hosting certification

HDS stands for hébergeur de données de santé, France's mandatory health data hosting certification for any organisation that stores or operates personal health data on behalf of a third party. It is issued for three years by an accredited certification body, based on a framework from France's Digital Health Agency, and covers six activities, from the data centre to backup. Since 16 May 2026, only the HDS 2.0 framework applies.

The obligation comes from Article L.1111-8 of the French Public Health Code. It applies to anyone who hosts personal health data collected during prevention, diagnosis, care, or social and medico-social follow-up, on behalf of the person or organisation that produced or collected it, or on behalf of the patient. That host must be certified.

The system changed in 2018. Until then, hosts obtained a ministerial approval, reviewed case by case. Since 1 April 2018, approval has been replaced by a certification issued by independent, accredited bodies against a public framework. The process is now much closer to the ISO certifications that security teams already know.

Three parties share the roles:

• the Digital Health Agency (ANS) writes the certification and accreditation frameworks and publishes the list of certified hosts;
• certification bodies, accredited by COFRAC in France or an equivalent European body, audit hosts and issue certificates;
• hosts apply for certification for the activities they carry out and undergo the audits.

HDS does not replace the GDPR. Health data is a special category of personal data: the controller (the hospital, the practice or the software vendor, depending on the case) still needs a legal basis, a record of processing and, in most cases, a data protection impact assessment (DPIA). HDS governs the host; the GDPR governs the processing.

Three conditions must all be met: personal health data, collected in a care context (prevention, diagnosis, care, social or medico-social follow-up), and hosted on behalf of a third party. If any one is missing, certification is not required, although other obligations remain. The tool below follows that reasoning.

SaaS software vendors

This is the case that raises the most questions. A vendor offering patient records, medical appointment booking or remote monitoring as SaaS hosts its clients' data. Relying on a cloud that is already certified does not exempt it: each party is certified for the activities it carries out itself. A vendor that administers the application and database usually falls under activity 5 (administration and operation of the information system).

Healthcare institutions and hospital groups

A hospital, clinic or care home that hosts its own data on its own resources does not need certification for that activity. Things change as soon as it hosts for others: a lead hospital hosting the information system of the other members of a regional hospital group, or a university hospital offering its infrastructure to partners, becomes a host under the law. Several institutions appear on the ANS list of certified hosts.

What is not automatically in scope

A wellness app, a step counter or a consumer service unrelated to care is not automatically subject to HDS. Caution is still needed: the boundary depends on how the data is used, and the GDPR applies in every case as soon as the data reveals something about a person's health.

Article R.1111-9 of the Public Health Code splits hosting into six activities, stacked like the layers of an infrastructure. A host can be certified for just one of them or for all six. The split is mainly used to allocate responsibilities in a chain that often involves a data centre, a cloud provider, a software vendor and sometimes a managed service provider.

According to the ANS, only sites located in the European Economic Area can be certified for activities 1, 2 and 6. Since the decree of 24 March 2026, activity 6 explicitly includes retention as part of electronic archiving: a third-party archiving provider that keeps health data must now be HDS certified for that activity.

The certification framework was completely overhauled in 2024, then supplemented in 2026 by a decree stemming from France's SREN law. Here is the timeline to remember, based on ANS presentations:

• 26 April 2024: order approving the HDS 2.0 framework, published in the Official Journal on 16 May 2024. New hosts are certified against this version.
• 16 November 2024: end of the transition for certification bodies, which now audit only against version 2.0.
• 24 March 2026: Decree No. 2026-209, implementing Article 32 of the SREN law of 21 May 2024, published in the Official Journal on 26 March.
• 16 May 2026: end of the transition for hosts. Certificates issued under the former version 1.1 are no longer valid.
• End of September 2026: the territoriality and transparency rules and the new contract clauses apply, six months after the decree's publication.
• Coming next: a framework 2.1 that writes the decree into the certification requirements. The ANS states that audits carried out three months after its publication in the Official Journal will follow that version.

Location: storage in the EU or EEA

Where data is stored, it must be stored exclusively in a European Union member state or a state party to the European Economic Area (new Article R.1111-9-1 of the Public Health Code). Data therefore does not have to stay in France. Access from a third country, including simple remote administration, counts as a transfer: it is only allowed on the basis of an adequacy decision or appropriate safeguards under Articles 45 and 46 of the GDPR.

Transparency about extraterritorial laws

This is the decree's most visible change. If the host or one of its subcontractors is subject to the law of a country outside the EU/EEA, the contract must name that law, state whether an adequacy decision exists and, if not, describe the mitigation measures and residual risks. The host must also publish and keep up to date a map of transfers and access from third countries. As Acteurs publics pointed out back in 2024, HDS does not require full immunity from foreign law: that is the key difference with SecNumCloud.

More complete contracts

The clause on data subjects' rights now covers access, rectification, erasure, restriction and objection, not just portability. According to the analysis by Vigier Avocats, these new clauses only take effect six months after the decree's publication in the Official Journal, on 27 September 2026: amendments to existing contracts need to be planned ahead.

The process follows the usual pattern of a management system certification:

1. Define the scope: the activities (1 to 6) you actually carry out, the sites, the services, the subcontractors.
2. Set up or extend an information security management system compliant with ISO 27001 over that scope (see our article on the ISMS), with a risk assessment, a statement of applicability and the related controls.
3. Cover the HDS-specific requirements: contract clauses, location, handling of access from third countries, publication of the transfer map, patients' rights.
4. Choose an accredited certification body from the list published by the ANS, then go through the initial audit (document review and on-site audit).
5. Address any non-conformities, then obtain the certificate, valid for three years.
6. Maintain it: annual surveillance audit, then a renewal audit after three years.

How long should you plan for? At its SantExpo workshop in May 2026, the ANS reported nine to twelve months of compliance work on average, then at least three to four months for the certification, plus three to six months if non-conformities are found. The agency counted 411 certified hosts at the time. Cost depends on scope and starting maturity: certification body fees, internal time, technical work and surveillance audits.

Not to be overlooked: under Article L.1115-1 of the Public Health Code, hosting without certification is punishable by three years' imprisonment and a €45,000 fine.

These three schemes often come up together in healthcare tenders. They do not answer the same question, and none of them replaces the others.

ISO 27001 is the foundation: the HDS framework builds on it and adds its own requirements, so a host already certified to ISO 27001 has covered much of the ground. To manage that common base, a compliance assessment tool saves you from documenting the same controls twice. SecNumCloud goes further on sovereignty but does not replace HDS: a qualified cloud hosting health data must also be certified. According to the ANS, eight of the ten SecNumCloud-qualified providers listed in May 2026 were also HDS certified. We cover that framework in our article SecNumCloud: ANSSI's trusted cloud framework.

For a healthcare organisation or vendor entrusting its data to a host, the HDS certificate is a starting point, not a sufficient guarantee. Before signing, check at least:

• the legal entity on the certificate, which must be the one signing the contract;
• the activities and sites covered, against the service actually purchased;
• the validity dates and the framework version (2.0 since 16 May 2026);
• the list of subcontractors and their own certification;
• the map of transfers outside the EU/EEA published by the host;
• the reversibility clauses: return of data in a usable format and no copies kept.

These checks are part of third-party risk management: they happen at signature, then at each renewal. A well-designed vendor security questionnaire lets you collect this information consistently from every provider.

HDS, PGSSI-S and NIS 2: the other pieces of the puzzle

In a healthcare organisation, HDS is part of a wider whole. The health information systems security policy (PGSSI-S), published by the ANS, brings together the sector's security frameworks and guides, some of which are binding (electronic identification, accountability, and more). Healthcare is also one of the sectors covered by the NIS 2 directive. The same CISO therefore has to track several frameworks, often across several sites.

How Phinasoft helps

Phinasoft lets healthcare organisations run compliance assessments (HDS, ISO 27001, NIS 2, your security policy and more) and compliance campaigns by site or institution, assess their providers on a dedicated portal, and keep their DPIAs and record of processing up to date. It is listed with French healthcare purchasing bodies, including Resah and CAIH, and can be hosted as SaaS on a French sovereign cloud (OVH or Outscale) with a SecNumCloud option, as SaaS on AWS in Europe, or on-premise. To see how you can monitor your hosts' compliance, you can request a demo.