HDS (hébergeur de données de santé) certification
French certification for anyone hosting personal health data for care providers or patients, including infrastructure and operation of health information systems; data centre operators serving French health clients need it or a customer that holds it.
- 4requirementsin our own words
- 1edition Référentiel de certification HDS v2
- 1places where it is a duty of 30 assessed
- 18 Oct 2026last checkedat the sources below
Where it applies
It is a duty in 1 of 30 places. The outcome holds under the conditions shown and says nothing about any one site.
| Where | Outcome | Basis | Conditions | Authority and route |
|---|---|---|---|---|
| France | Applies | Required by law In force | Entity: host (infrastructure, operation of the health information system, backup)Sector: health care providers and patients (French health data)Exempt: health establishments running their own health information system need not be HDS certified Hosting personal health data for care providers or patients in France must be done by a certified host. | ANS (referential); COFRAC accredits certification bodies Filed with: certificate listed by ANS |
| Austria, Belgium, Bulgaria, Switzerland, Cyprus, Czechia, Germany, Denmark, Estonia, Spain, Finland, United Kingdom, Greece, Croatia, Hungary, Ireland, Italy, Lithuania, Luxembourg, Latvia, Malta, Netherlands, Norway, Poland, Portugal, Romania, Sweden, Slovenia, Slovakia | Does not apply | Required by law In force | Sector: French health data French rule; it follows French health data wherever hosted, so it matters only if you host data of French care providers. | Not stated |
What it asks for
4 requirements, each in our own words with the evidence an assessor would expect and who on a site usually owns it. Read the clause itself on the scheme owner's page.
| Requirement | Evidence expected | Owner | When |
|---|---|---|---|
| Identify which of the hosting activities in the referential you perform for health data. | Activity mapping Record, checked by document review | Compliance manager | Every year Management system, the organisation |
| Run an information security management system aligned with the referential (ISO 27001 equivalence is checked). | ISMS documents Policy, checked by document review | Security lead | Every year Management system, the organisation |
| Handle health data hosting contracts and data location rules. | Contract template and data location register Contract, checked by document review | Compliance manager | On each change Contractual, the organisation |
| Pass a two-stage audit, fix nonconformities within three months, then annual surveillance and certificate renewal at three years. | Audit reports and corrective actions Certificate, checked by document review | Quality | Each certification cycle Management system, the organisation |
Editions
Which text is in force, from when, and which one it replaced.
| Edition | Status | Published | In effect | Replaces |
|---|---|---|---|---|
| Référentiel de certification HDS v2 arrêté of 26 April 2024 amending the arrêté of 29 June 2018 | Current Transition dates for v1.1 certificates differ between ANS and COFRAC documents in search snippets; the ANS PDF is blocked by a challenge page, so they are not recorded. | 26 Apr 2024 | Not stated | None named |
Stages, levels and report types
What each one is, how long it is valid, and the claim you may make once you hold it.
| Stage or level | Report or award | Period and validity | What you may say |
|---|---|---|---|
| Certification | certificate | two-stage audit then annual surveillance3 years with annual surveillance | Say: HDS certified hosting for the named activities, per the ANS register. |
About the programme
- Scheme owner
- Agence du Numérique en Santé (ANS), France
- Assessed by
- An accredited certification body
- Scope
- hosting activity for health data
- Levels
- six hosting activities in the referential
- Certificate cycle
- Certificate valid for 3 years, surveillance every 1 year, recertification every 3 years
- Validity
- Certificate valid three years with an annual surveillance audit; two-stage audit; three months to fix nonconformities after the on-site audit.
- Accreditation route
- Certification bodies accredited by COFRAC (or a European equivalent)
- Recognised by
- COFRAC / EA MLA
- Regulator
- French Ministry of Health (arrêté of 26 April 2024); ANS
- Who asks for it
- Health-data customers, Public tenders, Regulator
- Where it is used
- FR (applies to hosting of French health data wherever the host is)
Related programmes
Sources
Official bodies behind this page, each with the date we last read it.
No official body publishes a page for this scheme. The scheme owner's own page, linked under About the programme, is where the clauses are published.
Not legal advice. Confirm each duty against the text itself.