HDS compliance
Hébergeur de Données de Santé compliance for European healthtech
Meet French Public Health Code obligations for hosting personal health data across all six official HDS activity certification scopes.
What HDS Certification is
HDS (Hébergeur de Données de Santé) certification is legally mandatory under Article L. 1111-8 of the French Public Health Code for entities hosting personal health data.
Administered by ANS (Agence du Numérique en Santé), HDS builds upon ISO/IEC 27001 with strict health-specific controls for patient privacy and sovereign data hosting.
It evaluates six scopes: physical sites, hardware infrastructure, application hosting, virtual infrastructure administration, application outsourcing, and health backups.
Who needs HDS Certification
You host, process, or back up personal health data for patients, hospitals, clinics, or healthcare practitioners in France or the European Union.
How TrustLynce helps with HDS Certification
Six HDS scope mapping
Select and evidence the exact HDS hosting scopes applicable to your SaaS architecture or infrastructure.
Health data access logging
Enforce traceable, non-repudiable access logs for every consultation or modification of patient health data.
ISO 27001 synergy
Reuse the controls and policies you already run for ISO 27001, then close the gaps that are specific to this standard.
HDS Certification questions
No. The cloud provider covers infrastructure scopes (1-2), but your SaaS application must achieve certification for scopes 3, 4, 5, or 6.
HDS certificates are valid for 3 years, with mandatory annual surveillance audits conducted by an accredited certification body.
Other frameworks
Evidence collected for one framework carries into the next.
SOC 2
The one your buyers ask for
ISO 27001
Recognised worldwide
HIPAA
Protect health information
GDPR
Handle EU personal data
PCI DSS
Take card payments safely
ISO 42001
Govern how you use AI
NIST CSF
A common security language
CMMC
Work with the DoD
Custom
Your own control set
ISO 27701
Privacy extension to ISO 27001
DORA
EU financial operational resilience
NIS 2
EU critical infrastructure cybersecurity
CCPA / CPRA
California comprehensive privacy
FERPA
Student education privacy standard
FDA 21 CFR Part 11
FDA electronic records & signatures
SOX ITGC
IT controls for public companies
HITRUST CSF
Assurance healthcare buyers ask for
FedRAMP
Sell cloud services to US agencies
NIST SP 800-53
The federal security control catalog
NIST SP 800-171
Protect CUI on federal contracts
Find out what your compliance program actually looks like
Thirty minutes, your real systems, no slideware. We'll show you what we'd automate first, and what you don't need us for.