Security & governance
HDS certification
HDS (Hebergeur de donnees de sante) is the French certification required of organizations that host personal health data on behalf of healthcare providers, medico-social services or patients. It is rooted in the French Public Health Code and covers six hosting activities, from running the physical site to backing up the data.
Who needs HDS certification?
Certification applies when four conditions meet: the host acts as a processor in the sense of the GDPR, the data is personal health data, the service falls within one of the listed hosting activities, and the data was collected in the course of prevention, diagnosis, care or social and medico-social follow-up. The obligation is framed around hosting on behalf of another party, so the first question for any healthcare organization is whether a third party hosts, operates or backs up its data. The roles are explained under data controller vs. data processor.
Which activities does HDS cover?
The Public Health Code lists six activities. A provider is certified for the activities it actually performs, and a contract should state which ones.
| Activity | What it covers |
|---|---|
| Physical sites | Providing and maintaining the sites that house the infrastructure |
| Hardware infrastructure | Providing and maintaining the physical servers and storage |
| Virtual infrastructure | Providing and maintaining the virtualization layer |
| Application platform | Providing and maintaining the platform that hosts applications |
| Administration and operation | Running the information system that holds the health data |
| Backup | Backing up the health data |
What changed in the revised HDS framework?
A revised certification framework was approved by an order of 26 April 2024 and published on 16 May 2024. New applicants have been assessed against it since 16 November 2024, and holders of existing certificates had until 16 May 2026 to move to it. The main additions concern sovereignty. Physical hosting must take place exclusively within the European Economic Area. If remote access is possible from a country outside the EU, or if the host is subject to non-EU law that does not offer adequate protection, the host must set out the risks and mitigation measures in the contract and publish a map of data transfers outside the EEA.
What does HDS mean for storage and backup?
Because backup is a named activity, a managed backup service that handles health data for a care provider falls inside the certification, not just the primary hosting. Storage location becomes a contractual fact: replication targets, disaster recovery sites and support access all have to stay within the stated perimeter, which is a form of data localization. The sovereignty requirements are less strict than those of the SecNumCloud qualification run by ANSSI, which is required separately for certain state and health platform data.
Frequently asked questions
Does HDS require health data to stay in France?
No. The revised framework requires physical hosting within the European Economic Area, not within France specifically.
Is backup covered by HDS certification?
Yes. Backing up health data is the sixth hosting activity on the list, so a provider that performs it on behalf of a healthcare organization needs to be certified for it.
Is HDS the same as SecNumCloud?
No. HDS is a certification for hosts of health data. SecNumCloud is a broader ANSSI qualification for cloud services with stricter requirements on protection from non-EU law.
Related terms
- ANSSI: the French cybersecurity agency.
- GDPR: the regulation that defines processors and health data.
- Data localization: keeping data within a defined territory.
- Data processing agreement (DPA): the contract between controller and processor.
- Extraterritorial data access: the risk the transfer map is meant to expose.