HDS (Hébergeurs de Données de Santé) is the French certification required for any provider that hosts personal health data on behalf of French patients. The scheme is run by the Agence du Numérique en Santé and audited by accredited bodies. It applies to cloud, colocation, and managed-hosting providers touching patient records.
What does HDS certification actually require?
Certification means passing an accredited audit against a published reference framework that maps to ISO 27001 plus health-data-specific clauses.
The current v2.0 reference, published May 16, 2024 in the Official Journal, contains 31 requirements organized around protection of health data, transparency obligations to patients, and contractual duties between hoster and customer (Agence du Numérique en Santé).
Why is HDS a hard line for non-EEA cloud providers?
The v2.0 framework restricts storage of certified health data to EEA member states and demands transparency on any processing outside the EEA.
By May 16, 2026, every active HDS certificate must migrate from the 2018 version to v2.0 or be withdrawn (ANS transition notice). AWS, Azure, and GCP all maintain HDS-certified scopes in their EU regions; selling French health data to a non-EEA-only stack is operationally a non-starter.
How does HDS show up in security questionnaires?
If a French healthcare customer is buying, HDS sits as a gating control in pre-contract due diligence, often before SOC 2 or ISO 27001 review.
Most teams selling into French healthcare underestimate the lead time. HDS audits run on accredited-body schedules, and the v2.0 transition is squeezing audit capacity through the May 2026 deadline. The certification slots into the same vendor-review motion as SOC 2, ISO 27001, and the broader TPRM workflow.
Related terms
These adjacent terms cover the privacy and vendor-review concepts that travel with HDS in any French or EU healthcare deal cycle.
- GDPR - the EU privacy regulation HDS sits on top of for any patient data
- DPA - the Data Processing Agreement HDS hosters sign under GDPR Art. 28
- Sub-processor - HDS v2.0 requires explicit disclosure of any sub-processor outside the EEA
- ISO 27001 - the ISMS baseline the HDS framework extends with health-specific clauses