Framework National Cyber & Cloud Schemes
HDS
HDS (Hébergeur de Données de Santé) is the French certification that any organization hosting personal health data on behalf of French health actors must hold, under Article L.1111-8 of the Public Health Code and Decree 2018-137. It replaced the earlier ministerial approval (agrément) in 2018 and is administered by the Agence du Numérique en Santé (ANS).
The certification covers six activities, from physical hosting and infrastructure provision through platform hosting and outsourced management of the information system, and an applicant is certified for the activities it actually performs.
The certification standard is built on ISO/IEC 27001 with additional requirements drawn from ISO/IEC 27017, 27018, and 20000-1 and French legal requirements on health data.
Version 2 of the standard, published in 2024, became mandatory for new applicants from November 16, 2024, added stricter data location and sovereignty requirements (hosting within the European Economic Area and transparency about transfers and foreign law exposure), and required already-certified hosts to transition by May 16, 2026.
In writing, an HDS applicant needs a full ISO/IEC 27001 management system scoped to the hosting activities, a statement of applicability extended with the HDS-specific requirements, contracts with health clients that carry the mandatory clauses (including data location, reversibility, and notification), a data location and transfer register, incident notification procedures to the client and to the authorities, backup and continuity arrangements, and internal audit and management review records.
The certificate is valid for three years with annual surveillance audits.
help
Who has to comply
Any organization, in France or abroad, that hosts personal health data collected in the course of prevention, diagnosis, care, or medical-social follow-up on behalf of a French health data controller (hospitals, clinics, laboratories, software publishers, cloud providers, managed service providers).
Hosting for the controller's own account is exempt; hosting on behalf of others is not.
What the assessor asks to see
Scope by HDS activity; ISO/IEC 27001 documentation (policy, risk assessment, statement of applicability, procedures); HDS-specific requirements evidence including data location register, transfer analysis, and sovereignty disclosures; client contracts with mandatory HDS clauses; access control and privileged access records; encryption and key management; logging and traceability; backup and restoration tests; business continuity and disaster recovery tests; incident register and notification records; supplier and subcontractor management; internal audit reports and management review minutes.
Version 2 timeline
HDS v2 became mandatory for new certification applications from November 16, 2024. Hosts already certified had until May 16, 2026 to complete the transition. Key additions concern hosting within the European Economic Area, transparency about transfers and exposure to non-EU legislation, and updated audit durations and ISO/IEC 27001:2022 alignment.
Assessors
Who assesses HDS
Certification bodies accredited by COFRAC under the HDS accreditation standard (based on ISO/IEC 17021-1 and 27006). Nine bodies were reported as accredited as of the most recent ANS communication (verify the current list on the ANS site). Accredited by COFRAC (Comité français d'accréditation).
Public register of assessors: https://esante.gouv.fr/ens/offre/hds
No firm has claimed a HDS assessor listing yet. Claim yours →
Consultants
Who helps with HDS
French information security consultancies with ISO/IEC 27001 practices run HDS readiness projects: scoping by activity, gap analysis against the HDS standard, contract template updates, and pre-audits. Engagements run six to twelve months for a first certification.
Firms that name this framework in their own material. Listings we have not verified yet come from public filings and partner lists. Each firm can confirm its own.
No firm has claimed a HDS consultant listing yet. Claim yours →
Software
Tools for HDS
Tools that name this framework in their own material.
No firm has claimed a HDS tool listing yet. Claim yours →
Related reading
- V2.0 certification of French health data hosting service providers now fully effectiveExplains what the version 2.0 framework added, including EEA data location, and the deadline by which providers had to move.Squire Patton Boggs
- HDS certification explained: how to host health data in FranceClear on the point most people miss: certification is granted per activity, so a provider's scope annex decides what is actually covered.Scalingo
- HDS and ASIP Sante complianceShows how a hyperscaler's HDS scope is published and which services and regions a customer can rely on.Google Cloud
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Find a Consultant for HDS
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Not sure where to start?
Get Help with HDS
Tell us what you are trying to put in place. We will point you to the right tool, a consultant who can implement it, or both.