HDS hosting: choosing a certified health data hosting provider in France — the 2026 guide

Any organization that hosts personal health data on behalf of a third party must use an HDS-certified hosting provider. This obligation, derived from the French Public Health Code, now structures the entire digital-health ecosystem — and it is evolving: version 2.1 of the standard, expected in October 2026, will apply from December 2026.

v2.1: what changes by December 2026

The Agence du Numérique en Santé has announced the publication of standard v2.1 for October 2026, with entry into application three months later, in December 2026. The changes are targeted: they strengthen transparency about possible data transfers and about the provider’s exposure to the laws of countries outside the European Union. No additional audit is required: the check and the issuance of the new certificate take place at the annual surveillance audit or at renewal.

The very practical consequence on the customer side: hosting contracts — including those already signed — will, where relevant, have to be amended to reflect this transparency about non-European laws. If you are a healthcare organization or a software vendor, now is the time to re-read your contracts, not December.

Who is concerned?

Healthcare facilities that outsource their infrastructure, but also software vendors that host their customers’ data, are directly concerned. The question arises from the moment the product is designed.

Determining whether you are a controller, a processor or a hosting provider is the first step — and the one that determines all the obligations that follow.

Framing a compliant project

A compliant hosting project rests on a risk analysis, a precise hosting contract and a clear allocation of responsibilities. Compliance support upstream avoids costly rework.

The framework: Article L.1111-8 of the French Public Health Code

Since 2018, the former approval regime has given way to a certification issued by bodies accredited by COFRAC (or by the national accreditation body of another EU Member State), on the basis of a standard published by the Agence du Numérique en Santé and built on ISO 27001 and ISO 20000. The certificate is valid for three years, with annual surveillance audits; since May 16, 2026, only version v2 of the standard (order of 26 April 2024, published on 16 May 2024) is authoritative.

The principle is simple to state: anyone who hosts health data collected in the course of prevention, diagnosis, care or social and medico-social follow-up activities, on behalf of a third party, must be certified. The whole difficulty lies in applying it: who hosts “on behalf of a third party”?

Are you a hosting provider without knowing it?

The SaaS vendor that stores the health data of its healthcare customers is a hosting provider — the most frequent case, and the one most often discovered late, sometimes on the back of a lost tender. The managed-services provider that administers an information system containing health data performs activity 5. Conversely, a facility that hosts its own data for its own account does not need to be certified — but the day it pools its infrastructure for the benefit of other organizations, the question arises again.

For a software vendor, two routes: get certified (a heavy investment, but a differentiator) or rely on a certified hosting provider while keeping a crystal-clear allocation of responsibilities. The choice is made at the product architecture stage — redoing it afterwards costs ten times more.

How to verify that a provider really is HDS-certified

Never settle for an “HDS” logo on a sales brochure: certification is verified against documents, at the source. The Agence du Numérique en Santé publishes the official list of certified hosting providers — that is the first reflex, before any signature.

Three checks in practice. One: the provider appears on the official list, with a certificate in force (three years, annual surveillance audits) issued by an accredited body. Two: the scope of the certificate covers exactly the activities you are buying — the standard distinguishes six certifiable activities, from the provision of physical premises (activity 1) to infrastructure (2–3), the application hosting platform (4), administration and operation (5) and outsourced backup (6); a provider certified for activities 1 to 3 is not certified to operate your system. Three: the certified legal entity is the one that signs your contract — not a parent company, not an uncovered subsidiary.

Ask for the certificate itself (number, scope, dates) and record its reference in your record of processing activities, with an annual review scheduled: certificates get suspended, and they expire.

The 6 contract clauses to demand from your hosting provider

The provider’s certification never replaces the contract: Article 28 of the GDPR and the requirements of the Public Health Code come on top of it. Six clauses make the difference between a protective contract and an empty shell. One — scope: the HDS activities covered, annexed to the contract, aligned with the certificate. Two — location: where the data is hosted, an EEA commitment, and transparency about any exposure to non-European laws — precisely the point v2.1 will strengthen; anticipate it now. Three — the subcontracting chain: the identity of sub-hosting providers, their own certification, and your right to object to changes. Four — security and incidents: technical measures, and breach notification within timeframes compatible with your own obligations under Article 33 of the GDPR. Five — reversibility: return of the data in an exploitable format, quantified deadlines, and a test clause — reversibility that has never been tested does not exist. Six — audit: your right to verify, the transmission of relevant reports, and an obligation to inform you immediately if the certificate is suspended or withdrawn.

One frequently overlooked point: test and acceptance environments. Copying real patient data into them without the same hosting and security guarantees is one of the most common gaps we encounter in audits.

The questions we are asked most often

“Does my medical practice need to be certified?” No: a professional who hosts their own records for their own practice is not a hosting provider within the meaning of the law — but their SaaS software vendor must be. “Is a US cloud provider with HDS certification compliant?” The v2 certification requires it: hosting in the EEA and transparency about third-country access; formal compliance exists, the risk analysis still has to be done and documented — and v2.1 will strengthen this transparency requirement further. “What about backups?” Outsourced backup is certifiable activity no. 6: a backup provider that receives health data must be certified for that activity. “Does my provider’s certification exempt me from a contract?” Never: Article 28 of the GDPR and the requirements of the Public Health Code come on top of certification, they do not replace it. “Will my existing contracts have to change with v2.1?” Where relevant, yes: the transparency requirements about non-European laws will also apply to contracts already in force — all the more reason to re-read them now.

A compliant hosting project, step by step

Step 1 — qualify: who is the controller, who is the processor, who hosts what. Step 2 — map the data and the flows, test environments included. Step 3 — select the hosting provider on documentary evidence: v2 certificate, scope of activities, location, subcontracting chain, reversibility. Step 4 — contract: Article 28 DPA, Public Health Code clauses, service levels, audit and data return. Step 5 — document: record of processing, risk analysis, DPIA where the processing warrants it. Step 6 — monitor: annual review of the certificate and of subprocessors, reversibility test. Allow several weeks for a simple project, several months when a data migration is involved — and always cheaper upstream than in remediation.