France HDS — Healthcare Data Hosting Certification

Why does it matter?

HDS is not a voluntary assurance label. Hosting personal health data for a third party in France without a certificate is unlawful, so hospitals, health software vendors and public bodies can only buy hosting from the ANS list of certified hosts. Version 2.0 raised the bar on sovereignty: data must stay in the European Economic Area, exposure to non-European laws must be disclosed in the contract, and each host must publish its transfer map.

Key benefits include:

• A statutory duty, not a preference

Article L.1111-8 of the Code de la santé publique requires certification for anyone hosting personal health data on behalf of the data producers or the patient.

• Six defined activities

Article R.1111-9 lists the activities a certificate can cover, from physical sites to backup, so scope is explicit on every certificate.

• EEA storage

Requirement 28 of v2.0 obliges the host and its subcontractors to store health data inside the European Economic Area.

• Contract transparency

Requirements 29 and 30 make the host document transfer safeguards, the non-European laws it is exposed to, mitigation measures and residual risks in the contract.

• Public transfer map

Requirement 31 makes the host publish a URL with its transfer map or a statement that no third-country law imposes access, relayed by the certifier to the ANS.

How does it work?

Article R.1111-9 defines hosting as carrying out, for the data controller, all or part of six activities: (1) providing and maintaining physical sites for the hardware infrastructure, (2) providing and maintaining the hardware infrastructure, (3) providing and maintaining the virtual infrastructure, (4) providing and maintaining the application hosting platform, (5) administering and operating the information system containing health data, and (6) backing up health data. A host chooses the activities in its scope, and v2.0 defines activity 5 as control over interventions on the resources provided, including nominative access rights with annual review, secured access procedures, access logging with reasons, and prior validation of interventions.

The host builds an information security management system aligned with ISO/IEC 27001:2022, documents the HDS-specific requirements and contracts with a COFRAC-accredited certification body. Under v2.0 the host must map its subcontractors and show that they meet the same sovereignty constraints, update customer contracts for requirements 17 to 27 (the ANS reported these contract updates as the longest lead-time item in the 2024 to 2026 transition), and keep the published transfer URL current. Only sites located in the EEA can be certified for activities 1, 2 and 6.

Since the SREN law 2024-449 of 21 May 2024 (article 32), an electronic archiving service that keeps personal health data collected during care, for a third party, also needs HDS certification, applying from 31 July 2025 to hosts that create an archiving activity. Decree 2026-209 of 24 March 2026 carried the v2.0 sovereignty requirements into articles R.1111-9 to R.1111-11 of the Code without adding new ones.

Key Elements

• Legal basis (article L.1111-8 CSP)

Certification is mandatory for hosting personal health data for third parties; Decree 2018-137 organized the move from ministerial approval to certification.

• Six hosting activities (article R.1111-9)

Physical sites, hardware infrastructure, virtual infrastructure, application platform, system administration and operation, and backup, including electronic archiving.

• Référentiel v2.0 (arrêté of 26 April 2024)

Published in the Journal officiel on 16 May 2024; built on ISO/IEC 27001:2022 with HDS-specific requirements; the only basis for certificates since 16 May 2026.

• Sovereignty requirements 28 to 31

EEA storage, adequacy or article 46 GDPR safeguards for remote access from outside the EEA, contractual disclosure of non-European law exposure, and a public transfer map.

• Accredited certification

Certification bodies accredited by COFRAC audit the host; the ANS publishes the list of certified hosts and the hosts' transfer URLs.

• Transition calendar

Certification bodies moved to v2.0 by 16 November 2024; hosts certified under v1.1 had until 16 May 2026; after that date v1.1 certificates are no longer valid.

What does it cover?

HDS applies to every natural or legal person hosting personal health data on behalf of the persons who produce or collect it, or of the patient, in France, across the six activities of article R.1111-9. It covers cloud and traditional hosting, software vendors operating their own platforms, managed service providers administering health information systems, and electronic archiving services. A health establishment hosting only its own data for itself is outside the obligation; hosting for another establishment brings it in.

What are its objectives?

HDS sets the conditions under which personal health data may be hosted for third parties in France.

Make certification a precondition for hosting personal health data for third parties (article L.1111-8).

Define the hosting activities precisely so that scope is explicit on every certificate (article R.1111-9).

Keep health data inside the European Economic Area and make any remote access from outside it rest on GDPR adequacy or article 46 safeguards (requirements 28 and 29).

Disclose exposure to non-European laws, mitigation measures and residual risks in the hosting contract (requirement 30).

Publish each host's transfer map so customers and the ANS can see where data goes (requirement 31).

Framework in Context

HDS sits under the GDPR and the Code de la santé publique: the GDPR governs lawful processing, and HDS governs who may host and under what security and sovereignty conditions. The référentiel reuses the ISO/IEC 27001:2022 management system and adds HDS-specific requirements, so a host usually runs one ISMS for both. Requirement 31 recognizes a SecNumCloud 3.2 qualification as proof that no third-country law imposes access. In Germany, section 393 SGB V plays a comparable gatekeeping role for cloud services in healthcare through the BSI C5 attestation.

Common Framework Mappings

The HDS référentiel is built on ISO/IEC 27001 and sits alongside the GDPR, so hosts map its requirements to the frameworks below to reuse audit evidence and to show customers how health-data hosting controls line up with international assurance.

Mapped frameworks include:

SOC 2

GDPR

HITRUST CSF v11.5

ISO 27001:2022

ISO 27002:2022

ISO 27017

ISO 27701

ISO/IEC 27799