Hosting health data in France is governed by the HDS certification, version 1.1 of whose framework was published by the ANS in July 2024. The GDPR classes health data as sensitive categories (article 9), under firm CNIL oversight. The recent controversy over the hosting of the Health Data Hub has put the question of extraterritorial immunity applied to medical data back at the centre of the debate. The EHDS regulation, adopted in 2025, is preparing a unified European space for 2027.
Who this framework is for
Public hospitals
- EHR, PACS, laboratory systems: complex information systems deeply embedded in operations.
- HDS certification mandatory as soon as business IT is outsourced.
- Formalised emergency plans (plans blancs), continuity plans and reversibility.
Private clinics and GHTs
- Pooling within Groupements Hospitaliers de Territoire (regional hospital groups).
- Convergence of information systems onto cloud or hybrid platforms.
- Inherited HDS requirements, audited by accredited certification bodies.
Research laboratories
- Clinical research data often pseudonymised or anonymised.
- CNIL authorisation or CESREES opinion depending on the flows.
- Alignment with the SNDS and the future EHDS framework.
Healthtech and software vendors
- Vendors of software medical devices subject to the MDR regulation (EU 2017/745).
- HDS certification held by the hosting provider.
- Multi-tenant architectures requiring strict segregation of patient data.
The applicable references
HDS certification
Mandatory certification for hosts of personal health data, governed by the French Public Health Code and the HDS 1.1 framework published by the ANS in July 2024. Public list of certified hosts on esante.gouv.fr. Six activities covered (provision of infrastructure, platform, etc.).
GDPR article 9 (sensitive data)
Regulation (EU) 2016/679, article 9: processing of health data prohibited in principle except with explicit consent, on grounds of substantial public interest or other limited exceptions. The CNIL exercises oversight. The Schrems II judgment (CJEU, 2020) tightens transfers outside the EEA.
Mon espace santé and SNDS
Mon espace santé (MES) has been open to every insured person since 2022. The SNDS (Système National des Données de Santé, national health data system) centralises data on reimbursements, hospital stays and medical causes of death. Access requires a reasoned CNIL authorisation and a CESREES opinion.
EHDS (European Health Data Space)
Regulation (EU) 2025/327 published on 5 March 2025. Creates a European health data space with two strands: primary use (cross-border exchange for care) and secondary use (research, public policy, innovation). Gradual roll-out from 2027.
Four recurring situations
Electronic health record (EHR)
Requirements
- HDS certification for the six relevant activities.
- Data, metadata and audit logs hosted in France or in the EU.
- Traceability of record access, alerts on atypical access.
Candidate providers: qualified HDS hosts, ideally also qualified SecNumCloud for public university hospitals.
Medical imaging (PACS, DICOM archiving)
Requirements
- Large volumes (several TB per year per facility).
- Real-time access for reading, long-term regulatory archiving.
- Encryption at rest and granular access control.
Candidate providers: HDS object storage with DICOMweb-compatible access, multi-site EU redundancy.
Multi-centre clinical research
Requirements
- Pseudonymisation and segregation by study arm.
- Cryptographic trail of data changes (eCRF).
- Controlled access for CRAs, investigators and supervisory authorities.
Candidate providers: specialist clinical HDS platforms with eCRF workflows and eIDAS qualified signatures.
Telemedicine and teleconsultation
Requirements
- End-to-end encryption of video and messaging flows.
- HDS retention of automatically generated reports.
- ANSSI compliance for strong authentication of professionals (CPS, eCarte CPS).
Candidate providers: healthcare SaaS vendors hosted with a qualified HDS partner, with CPS/PSC integration.