HDS certification for companies hosting health data in France.
If you host personal health data on behalf of healthcare providers, health software vendors or patients, HDS certification is a legal requirement in France. We define the right scope, build the HDS requirements on an ISO 27001 foundation and prepare you for the audit.
Are you concerned by HDS certification?
You host health data for others
Hosting, cloud and managed service providers that store or operate personal health data on behalf of a healthcare actor need HDS certification.
You run a health software platform
SaaS and health software vendors that host or operate their customers' health data, even on rented infrastructure, are usually in scope for part of the HDS activities.
Your cloud provider is HDS certified
That covers the activities your provider performs, not necessarily yours. If you administer, operate or back up the data yourself, you may still need your own certificate.
Not sure where you stand? It's the most common question we get. Bring your architecture to a free 30-min call and leave with a clear answer.
Book a free callWhat HDS certification involves
Built once, on the same management system as ISO 27001.
Scope and HDS activities
Your services mapped to the HDS hosting activities, so you certify what you really do: no more, no less.
Gap analysis
A review against ISO 27001 and the HDS-specific requirements, with a prioritised, dated plan.
HDS-specific requirements
Health data requirements on top of ISO 27001, including data location in the European Economic Area and transparency on access from outside it.
Contracts with your customers
The contractual commitments the HDS framework requires, aligned with what you actually deliver.
Risk, SoA and evidence
One risk assessment and Statement of Applicability covering ISO 27001 and HDS, with evidence ready for sampling.
Internal audit and readiness
An independent internal audit against both frameworks before the certification body arrives.
One project, whatever your starting point.
Starting from zero
We build the ISO 27001 management system and the HDS requirements together, as one project, so both can be audited together.
Already ISO 27001 certified
We extend your existing management system with the HDS scope and requirements, then prepare you for the HDS audit.
ISO 27001 and HDS certification
Built their information security management system and the HDS requirements from scratch, then supported them through to the certification audit.
Result: certified ISO 27001 and HDS.
“He supported us throughout our ISO 27001 implementation, from prioritizing clauses and controls to shaping our documentation approach and preparing for the external audit. What stood out beyond his technical expertise was his style: responsive, genuinely supportive, and always available when we needed guidance.”
A dated plan from the very first call
Scoping call
30 minutes, free. Your services, your hosting set-up, what HDS covers for you.
Gap analysis
A clear picture of the ISO 27001 and HDS gaps and a dated, prioritised plan.
Build
Regular check-ins, ready-to-use deliverables, and your team stays in ownership.
Certification
Internal audit, management review, then support during the certification audit.
HDS questions
Is HDS certification mandatory?
Yes, in France, for anyone hosting personal health data collected during prevention, diagnosis, care or medico-social follow-up, on behalf of the people or organisations that produced it, or of the patient. The obligation comes from article L.1111-8 of the French Public Health Code.
Our cloud provider is HDS certified. Are we covered?
Only for the activities your provider performs. If you administer, operate or back up the environment holding the data, you may need your own certificate for those activities. We check this with you on the first call.
Do we need ISO 27001 first?
No. HDS is built on ISO 27001 requirements, extended with health data specific ones. Both can be built in one project and audited together.
How much does it cost?
Pricing is on request. After a free scoping call, we send a fixed-fee proposal based on your activities and starting point.
Can you also run our HDS certification audit?
No. Impartiality rules prevent anyone from certifying a system they helped build. We prepare you, and an independent accredited certification body certifies you.
Let's talk about your certification deadline.
30 minutes, free, no commitment. You leave with a timeline and scope estimate.
- Your context, your deadline, a realistic scope
- ISO 27001, HDS or both: what applies to you
- In English or French, by video call