France: HDS certification for health data
Anyone in France who hosts health data from prevention, diagnosis, care or social follow-up for a clinic, a practice or patients needs certification as a Hébergeur de données de santé (HDS), Art. L1111-8 Code de la santé publique. Since 16 May 2026, only the 2024 framework applies: data is kept in the European Economic Area, and access from third countries must be disclosed. For an AI service in the cloud, this means: no HDS, no health data.
Who needs HDS certification?
Art. L1111-8 of the Code de la santé publique applies to anyone who hosts personal health data on behalf of others: for a doctor, a clinic, a care home or the patient themselves. It covers data generated in prevention, diagnosis, care or social and medico-social follow-up. Anyone who hosts this data digitally needs a certificate of conformity, the HDS certificate. Hosting also requires a contract.
Certification applies per activity. Art. R1111-9 lists six:
| No. | Activity | Example |
|---|---|---|
| 1 | Provision and operation of physical sites | Data centre |
| 2 | Provision and operation of hardware | Servers, storage |
| 3 | Provision and operation of the virtual infrastructure | Virtual servers, containers |
| 4 | Provision and operation of the application hosting platform | Software layer on which the application runs |
| 5 | Administration and operation of the information system containing the health data | Remote operation, updates, incidents |
| 6 | External backup of the health data | Backup in another data centre |
What changed with the 2024 framework?
The new framework was set by an Arrêté of 26 April 2024 and published in the Journal officiel on 16 May 2024. New providers have been assessed against it since 16 November 2024; providers already certified had until 16 May 2026 to switch. The key points:
- Data in the EEA: health data is hosted exclusively in the European Economic Area.
- Disclosure to customers: if access from a state outside the EU is possible, or if the host is subject to the laws of such a state, the contract sets out the risks and countermeasures.
- Disclosure to the public: the host publishes an overview of transfers to states outside the EEA.
HDS certification protects less against access from outside the EU than SecNumCloud. SecNumCloud →
What does this mean for AI with health data?
Any AI that runs in a provider’s cloud and processes health data hosts this data, at least briefly: documents, chat histories, search index. The provider therefore needs the HDS certificate for the activities it takes over, as does every sub-processor, such as the data centre.
If the AI runs on a server on your premises and your IT operates it, you are hosting the data yourself. The French data protection authority CNIL generally prefers this route anyway when personal or confidential data is involved. If a service provider takes over operation remotely, activity 5 may apply.
| Question for the provider | Why |
|---|---|
| For which of activities 1 to 6 are you certified, and until when? | The certificate must match what the provider does |
| Which sub-processors host data, and are they certified? | The chain must have no gaps |
| Where are data and backups kept? | Only permitted in the EEA |
| Can a state outside the EU access the data? | Must be stated in the contract |
How does this work with basebox?
basebox does not yet have HDS certification; it is planned. Until then, basebox offers only the server in France, operated by your own IT. The cloud is not available in France, nor is operation of the server by basebox or a server in a basebox data centre: remote operation with access to health data would be activity 5 under Art. R1111-9 (administration and operation), and that requires the certificate.
Our hardware partner FAST LTA delivers the server to France, where it is installed on your premises. On request, the server runs without an internet connection, with the AI model, documents, apps, permissions and logs; basebox has no access to your data. The backup stays with you, using your tools.
The interface and support are available in German and English, not in French. The server →
Not legal advice: Whether an activity counts as hosting within the meaning of Art. L1111-8 depends on the individual case; the Agence du numérique en santé answers questions on this. Research as of 11 October 2026.
Frequently asked questions
Does a hospital itself need HDS certification?
Not according to the wording of Art. L1111-8, as long as it hosts its data itself: the obligation applies to those who host for others. As soon as a service provider takes over the data centre, hardware, platform, operation or backup, it must be certified for that activity.
Does HDS also apply to software installed at the customer's site?
If the vendor hosts nothing and operates nothing, it is not a host. If it takes over the administration and operation of the system containing the health data, this falls under activity 5 and requires a certificate. Where the line lies in an individual case, for example with occasional maintenance, is something to clarify with your data protection officer.
What is new in the 2024 framework?
Data must be kept in the European Economic Area. If a state outside the EEA can access the data, for example through remote access or laws with effect abroad, the host must inform its customers in the contract about the risks and countermeasures and publish an overview of the transfers.
Sources
- Code de la santé publique, Art. L1111-8 (Légifrance) ↗
- Agence du numérique en santé: Hébergement des données de santé ↗
- Agence du numérique en santé: Référentiel de certification HDS (activities under Art. R1111-9) ↗
- Agence du numérique en santé: scope of the rules on hosting health data (FAQ) ↗
- CMS Francis Lefebvre: Nouveau référentiel de certification des hébergeurs de données de santé (Arrêté of 26 April 2024, JO 16 May 2024) ↗
- CNIL: Les questions-réponses de la CNIL sur l'utilisation d'un système d'IA générative (18 July 2024) ↗
This article was created with the help of AI, based on the sources listed. Responsible for the content: basebox GmbH. Not legal advice, no liability. Research as of 11 October 2026.