HDS (Hébergeur de Données de Santé)
French certification, granted by ANS, that any organization hosting personal health data on behalf of a French controller must hold.
HDS — Hébergeur de Données de Santé, “health-data host” — is a French certification scheme administered by ANS (Agence du Numérique en Santé) that any organization hosting personal health data on behalf of a French data controller must obtain. The legal basis is Article L.1111-8 of the French Code de la santé publique; the operational baseline is the Référentiel de certification HDS maintained by ANS.
The current referential builds on top of ISO/IEC 27001, adding sector-specific requirements: physical separation of health-data environments, French data-residency clauses, traceability of access, and personnel commitments. An HDS audit is delivered by a COFRAC-accredited certification body and runs on the same three-year cycle as ISO 27001, with annual surveillance audits.
Who needs it:
- Any SaaS, hosting provider, or managed-services vendor that stores, processes, or operates health data for a French entity — even if the vendor itself is not French and the infrastructure sits outside France.
- Six activity scopes are defined (physical hosting, infrastructure hosting, platform hosting, administration, backup, external archiving) — the certificate names which ones apply.
- B2B procurement gate. French hospitals, mutuelles, and HealthTech buyers are legally barred from contracting with a non-HDS provider for in-scope workloads.
Where awareness fits: the referential explicitly requires that personnel involved in hosting activities be trained on the specific obligations of handling health data — and that the operator can demonstrate it. The format is not prescribed, which means an LMS completion log or a behavioral evidence trail both qualify on paper. The latter ages better, because the auditor returning in year two will ask whether anything changed — and a completion log shows the same flat 100% it always has.
HDS coexists with the European GDPR and is sometimes mapped against US HIPAA when a vendor sells into both markets, though the schemes are not equivalent.
Related terms
- SOC 2AICPA attestation framework based on five Trust Services Criteria — the de facto B2B SaaS sales gate for North American buyers.
- ISO/IEC 27001International standard for an Information Security Management System (ISMS) — the closest thing to a global certification mark for security.
- HIPAAUS federal law governing protected health information — the Security Rule explicitly mandates a security awareness and training program for the workforce.
- Behavioral evidenceThe audit artifact a risky behavior was detected, the employee was nudged, and the behavior was corrected — increasingly demanded over training completion certificates.