Key points
- Health data hosting is a major issue for any professional in the healthcare sector who handles this information in France.
- Any information relating to the physical or mental health of an identified or identifiable person is health data within the meaning of the GDPR; hosting it on behalf of third parties falls under the French Public Health Code (Code de la santé publique).
- Article L. 1111-8 of the French Public Health Code requires anyone who hosts health data on behalf of third parties to be certified; Decree No. 2018-137 of 26 February 2018 organised its implementation.
- HDS certification replaced the former approval for hosting on digital media on 1 April 2018; it is issued by a certification body accredited by COFRAC (the French accreditation committee) or an equivalent European accreditation body.
- A certified host must ensure physical and logical security, protection against file loss, traceability of access and incident management.
- Compliance goes beyond HDS certification: the GDPR requires purposes to be identified, access to be limited and retention periods to be documented.
Health data hosting is a major issue for any healthcare professional or any organisation handling this type of information in France. Between HDS certification, which replaced the former health data host approval, the demands of regulatory compliance and the pressure exerted by the GDPR, it can be hard to find your way through the many requirements to meet. Below, we set out the key points to strengthen health data security and limit legal risks.
The legal framework for health data hosting in France
The digital management of health data is governed by a strict set of legislative and regulatory texts. As soon as information relating to physical or mental health concerns an identified or identifiable person, it is health data within the meaning of the GDPR (Article 4, point 15), which places it among the special categories of data (Article 9). Hosting it on behalf of third parties is also governed by the French Public Health Code (Code de la santé publique).
Article L. 1111-8 of the French Public Health Code (in French) requires anyone who hosts health data collected during prevention, diagnosis, care or social and medico-social follow-up activities, on behalf of third parties or of the patient themselves, to hold a certificate of compliance. Decree No. 2018-137 of 26 February 2018 set the terms of this certification, and controllers who entrust hosting to a third party must check that it is certified (Article R. 1111-8-8 of the Public Health Code (in French)). The main aim of this measure is to protect the fundamental right to respect for private life and to provide health data security suited to current challenges.
HDS certification vs health data host approval: what is the difference?
HDS certification (hébergeur de données de santé, health data host) succeeded the former approval system on 1 April 2018 for hosting on digital media. Any organisation hosting this data on behalf of third parties must now obtain a certificate from a certification body accredited by the French accreditation committee (Comité français d’accréditation, COFRAC) or by an equivalent European accreditation body. Approval from the minister responsible for culture is still required for storing this data as part of an electronic archiving service or on paper. Since 26 September 2026, storage of health data by a certified host must also take place exclusively within the European Union or the European Economic Area (Article R. 1111-9-1 of the Public Health Code (in French)).
If your organisation regularly handles patient records or offers digital health solutions, it may be useful to call on expert legal services in digital health to make your contracts and the framework for hosting sensitive data legally sound. This shift from government approval to independent certification aims to strengthen trust by imposing a precise certification framework dedicated to the safety and security of health data.
How do you obtain HDS certification in France?
A host wishing to demonstrate its regulatory compliance must follow a structured process. It includes a detailed analysis of internal processes, the preparation of a complete administrative file and the choice of an accredited certification body, which assesses compliance with the HDS framework, taking into account, where applicable, any ISO 27001 certifications already obtained.
The body carries out a compliance audit in two stages: a document review, then an on-site audit. The host has three months after the on-site audit to correct any non-conformities. The outcome determines whether HDS certification is issued; it is valid for three years, with a surveillance audit every year.
What criteria set a certified host apart?
Certified health data hosts must meet demanding requirements covering the entire life cycle of the information processed:
- Physical and logical security of infrastructure
- Protection against loss, theft or corruption of files
- Strong identification safeguards and traceability of access
- Continuous backup and restore mechanisms
- Incident management and prompt notification in the event of a breach
Each criterion is based on the certification framework drawn up by the public interest group referred to in Article L. 1111-24 of the Public Health Code and approved by order of the minister responsible for health. This framework incorporates compliance with international standards such as the ISO 27001 requirements on information systems security.
What does GDPR compliance mean for health data?
Regulatory compliance is not limited to HDS certification. The General Data Protection Regulation also provides an essential set of safeguards for each “processor” and “controller” within the meaning of the European text. Given the complexity of the GDPR, working with a firm that advises on personal data protection means you can be effectively assisted through every step of compliance.
It requires the purposes of processing to be clearly identified, access to be strictly limited and maximum retention periods for records to be defined. Any handling of sensitive data must be justifiable and documented, in particular through the record of processing activities required by the GDPR.
What technical measures does the GDPR require?
Protecting incoming and outgoing data flows relies on many technological tools:
- Systematic encryption at rest and in transit
- Automatic alerts in the event of abnormal access
- Periodic review of user access rights
- Regular penetration testing and appropriate response plans
For any health data breach, a procedure for notification to the CNIL and, depending on the seriousness of the incident, to the data subjects, completes this preventive and corrective toolkit.
How can security and compliance be built into day-to-day management?
Each employer or service provider is advised to train its teams on the risks relating to the confidentiality of the information handled. Drawing up internal policies that set out individual responsibilities, combined with annual compliance audits, raises the overall level of protection.
Regular software updates, combined with precise segmentation of access rights, help avoid the most common human or technical weaknesses in health data security.
HDS certification vs GDPR requirements: comparison of obligations
To give a clearer view of the specific features of each set of obligations governing health data hosting, this table brings together the main differences between HDS certification and GDPR compliance.
| Obligations | HDS certification | GDPR |
|---|---|---|
| Scope | Organisations that host health data on behalf of third parties or of the patient | Controllers and processors established in the Union, as well as those established outside the Union that target or monitor individuals located in the Union (Article 3 GDPR) |
| Main framework | HDS certification framework incorporating the ISO 27001 standard | General Data Protection Regulation |
| Audits/Inspections | Initial audit, then annual audits by the certification body | Inspection by the CNIL, updating of the record of processing activities |
| Penalty for non-compliance | Hosting without a certificate of compliance: three years’ imprisonment and a €45,000 fine (Article L. 1115-1 of the Public Health Code) | Fines of up to €20 million or 4% of total worldwide annual turnover, whichever is higher (Article 83 GDPR) |
| Period of validity | 3 years with annual surveillance | Depends on compliance actually being maintained |
This visual summary makes it easier to understand the different layers of control surrounding health data security. Each organisation must combine these two frameworks to achieve the widest possible coverage against legal and operational risks.
FAQ on health data hosting compliance and HDS certification
Who must use an HDS-certified host?
Healthcare institutions, laboratories, private practices, digital solution providers and other healthcare professionals who entrust a third party with hosting health data collected during prevention, diagnosis, care or social and medico-social follow-up activities must make sure that this third party is HDS-certified. The certification obligation lies with the host: an organisation that hosts its own health data itself does not need to be certified.
Hosting health data on behalf of third parties without holding a certificate of compliance is punishable by three years’ imprisonment and a €45,000 fine (Article L. 1115-1 of the Public Health Code (in French)). A controller who entrusts its data to a non-certified host fails, for its part, to meet the duty to check laid down in Article R. 1111-8-8 of the same code.
What steps lead to HDS certification?
To be recognised as compliant, a host must apply to a certification body that has received official accreditation. The main steps include:
- Preparing a technical file demonstrating internal procedures and the security policy
- Document assessment and analysis of existing processes
- On-site audit carried out by independent experts against the certification framework
- Annual follow-up by the same body and full renewal every three years
Close monitoring of regulatory developments remains necessary throughout the certification period to stay eligible.
What role does ISO 27001 certification play?
ISO 27001 is an international information security standard, not specific to healthcare, on which the HDS framework relies to define health data security requirements. It requires an information security management system to be set up, ensuring the confidentiality, integrity and availability of data.
It serves as a reference point during the compliance audit: the certification body checks in particular the equivalence of the ISO 27001 certifications already obtained by the host against the HDS certification framework, which also contains requirements specific to health data hosting.
How do you prepare for a health data hosting compliance audit?
Preparing for this audit requires a structured preparation plan. The key points to check before the auditor arrives include:
- An inventory of the IT assets concerned
- Updating internal security policies
- Comprehensive documentation of all data processing carried out
- Active awareness-raising among the staff involved
A preliminary diagnosis by a law firm can help to quickly correct any gaps identified against the applicable framework.
