HDS certification (health-data hosting, France)
Mandatory: any entity hosting personal health data on behalf of third parties (collected through prevention, diagnosis or care) must hold HDS certification.
Issued by: Accredited certification bodies, against the HDS framework published by the French digital-health agency (public-health code, art. L.1111-8)
Hosting and managed-service providers, health SaaS vendors, telemedicine platforms, and indirectly any e-health player that must pick a certified host.
What this scheme covers
- C.1A certification framework built on ISO 27001, with health-specific additions, broken into certifiable hosting activities.
- C.2A certificate issued for three years, with surveillance audits.
- C.3An obligation that also shapes subcontracting: a health SaaS must rely on certified hosts for the covered activities.
The link with Qualiopi
Outside vocational training: it certifies health-data infrastructure and services. Same underlying logic as Qualiopi though: a public framework, accredited certifiers, and a market closed to the uncertified.
The process, summarised
- 1.Determine the hosting activities concerned and the scope to certify.
- 2.Bring the system into line (ISO 27001 base + HDS additions) and build the evidence.
- 3.Pass the audit with an accredited certifier, then maintain the certificate (surveillance, three-year renewal).
FAQ — HDS
+Must a health SaaS vendor hold HDS itself?
It depends on which hosting activities it performs itself: if it merely uses a certified host, part of the obligation sits with that host; if it operates listed activities itself (managed services, backup…), it must be certified for them.
+What is the legal basis of the HDS obligation?
Article L.1111-8 of the French public-health code, which requires certification to host health data on behalf of third parties, under the digital-health agency's framework.
+HDS and ISO 27001: do you need both?
The HDS framework builds in the ISO 27001 base: the two are generally pursued together, with HDS embodying the compliance the health market requires.
- HDS Subcontracting: When Must a Health SaaS Vendor Be Certified Itself?7 min
- The 2024 HDS framework: what changes for certified health-data hosts7 min
- HDS certification cost: the real budget lines to plan for7 min
- How to obtain French HDS certification: steps, audits, timelines8 min
- HDS certification vs ISO 27001: differences, overlap, strategy7 min
- Is French HDS certification mandatory? Who actually needs it7 min
- ISO 27001Voluntary
- HAS certificationMandatory