Why your customers ask for HDS
Article L.1111-8 du Code de la santé publique (French Public Health Code) requires certification for anyone who hosts personal health data on behalf of a third party.
Three situations come up again and again:
- The hospital requires a certified host. Its tender says so. No proof, no bid.
- The software vendor has to outsource hosting. You host nothing yourself? Your customer will check that your host is certified for the right activities.
- The health insurer audits its suppliers. It sends a security questionnaire. An HDS certificate covers a good share of the answers.
In due diligence, investors check your hosting too. And being listed, that is, appearing on the public list of certified hosts, can be checked in one click.
A healthcare organization is waiting for your answer?
Check your situation in 30 minutesHDS explained: what the framework really requires
Three acronyms, three different things:
- GDPR: the European law on personal data. It always applies.
- ISO 27001: an international security standard, voluntary.
- HDS: a French certification, mandatory to host health data on behalf of others.
The HDS framework, that is, the document that sets the requirements, is written by the ANS (Agence du Numérique en Santé, France's digital health agency, formerly ASIP Santé).
It is built on ISO/IEC 27001. So you set up an ISMS (Information Security Management System): the rules, roles and routines that run your security. The HDS framework adds health-specific requirements:
- Health data stays hosted in the European Economic Area.
- Your customers are told about any possible access from outside that area.
- The hosting contract sets out each party's responsibilities and guarantees.
An accredited certification body audits you. Accreditation is the official recognition of its competence, granted by the COFRAC (the French accreditation body) or a European equivalent. The ANS then publishes the list of certified hosts.
What HDS certification is not:
- Not a marketing label. It is a legal obligation, checked by an audit.
- Not a certification of the whole company. It covers a precise scope of activities.
- Not a substitute for the GDPR. Your personal data obligations stay in full.
Are you in scope for HDS?
Two cases:
- You host the health data yourself. Host, infrastructure provider or software vendor that keeps its customers' data: you are in scope for each activity you perform.
- You are a software vendor and outsource hosting to a certified host. If you perform none of the six activities, the obligation falls on the host. Still check that its certificate covers the right activities. Your customer will.
Watch out for the second case. Do you administer and operate the application or platform that holds the data? You may be performing activities 4 or 5. You may then need certification for them, even on a certified cloud. The ouwba assessment settles this point.
The six hosting activities in the framework
activities 3 to 6
activities 1 and 2
- Physical sites: the premises that house the servers.
- Hardware infrastructure: servers, storage and network.
- Virtual infrastructure: the virtual machines.
- The application hosting platform: the environment where applications run.
- Administration and operation of the information system that holds the health data.
- Off-site backup of the health data.
Activities 1 to 4 consist of providing and maintaining the item listed. Activities 1 and 2 fall under the « hébergeur d'infrastructure physique » (physical infrastructure host) certificate. Activities 3 to 6 fall under the « hébergeur infogéreur » (managed services host) certificate.
Certification is granted activity by activity. You set your scope of activities, that is, the list of activities covered, before the audit.
How long does HDS certification take?
- Getting compliant is the work. Scoping, analyzing risks, writing, rolling out, collecting evidence.
- The audit is the validation. An accredited body checks your ISMS and the health-specific requirements. Work already done for ISO 27001 is reused. ouwba prepares you for the audit, the certification body decides.
Why so many projects slip:
- A poorly defined scope of activities. You certify too much, or not enough.
- Evidence collected by hand, at the last minute.
- An uncertified downstream subcontractor, that is, a provider to whom you or your host hand part of the hosting.
HDS, ISO 27001, GDPR, NIS 2: which one do you need?
- You host health data for a third party: HDS, for the activities you perform.
- You also sell outside healthcare: ISO 27001 is the expected standard. HDS builds on it without replacing it. See our ISO 27001 certification support.
- You process personal data: the GDPR always applies, HDS certified or not.
- Your customers are American: they often ask for a SOC 2 report (System and Organization Controls 2). Discover our SOC 2 support.
- You are an essential entity, that is, an organization deemed critical by the European NIS 2 directive (security of network and information systems): stronger obligations apply. See our NIS 2 support.
Unsure between HDS alone and HDS with ISO 27001?
Ask an expertYour questions about HDS certification
What is HDS certification?
HDS (Hébergeur de Données de Santé) certification shows that a host properly protects the health data it hosts on behalf of others. An accredited body audits it against the HDS framework, written by the ANS (Agence du Numérique en Santé). This framework builds on ISO 27001 and adds health-specific requirements. Certification covers specific activities, not the whole company.
Is HDS mandatory?
Yes, for anyone who hosts personal health data on behalf of a third party: a healthcare organization, a health professional or a patient. Article L.1111-8 du Code de la santé publique requires it. If you only process your own data, or perform no hosting activity, the obligation does not target you directly. The ouwba assessment settles your case.
Who needs to be listed as an HDS host?
Being listed means appearing on the public list of certified hosts, published by the ANS. It includes infrastructure hosts, cloud providers and health software vendors that perform a hosting activity themselves. A vendor that outsources all its hosting is not necessarily on it. It must then check that its host's certificate covers the right activities.
Which hosting activities does HDS cover?
The framework lists six: providing physical sites, hardware infrastructure, virtual infrastructure and the application hosting platform, then administering and operating the information system, and finally off-site backup. The first two fall under the « hébergeur d'infrastructure physique » certificate. The other four fall under the « hébergeur infogéreur » certificate. You are certified activity by activity.
How long does it take to get listed as an HDS host?
Timing depends mostly on getting compliant, not on the audit. With ouwba, allow a few weeks, depending on your scope of activities and your teams' availability. Once certified, you appear on the public list of certified hosts. Projects mostly slip when the scope is poorly defined or a subcontractor is not certified.
What is the difference between HDS and ISO 27001?
ISO 27001 is a voluntary international standard. It structures security for any organization, in any sector. HDS is a French certification, mandatory to host health data on behalf of others. The HDS framework builds on ISO 27001, then adds health-specific requirements, such as data location. ISO 27001 certification helps a lot, but it is not enough.
Does a health software vendor that outsources hosting need HDS?
Not if it performs none of the six activities itself: the obligation then falls on its host, whose certificate it checks. But if it administers and operates the application or platform that holds the data, it may be performing activities 4 or 5. It may then need certification for them, even on a certified cloud. The ouwba assessment settles this point in 30 minutes.
How long does HDS listing last and how is it maintained?
The certificate is valid for three years. You stay on the public list of certified hosts while it is valid. Each year, the certification body runs a surveillance audit. After three years, a renewal audit starts a new cycle. Evidence collected automatically by ouwba stays up to date, which makes these successive audits much lighter.
Where do I start?
Start by mapping your health data. Who do you process it for? Where is it hosted? What does your host do, and what do you do yourself? The ouwba assessment answers these questions in 30 minutes with an expert. You leave with your scope of activities, your priorities and a first estimate of the timeline. If your deadline is tight, you will also know whether it is realistic.