Glossary
HDS (Health Data Hosting)
A mandatory certification in France for any host processing personal health data. HDS certification guarantees enhanced security: encryption, traceability, and business continuity planning. It is issued by organizations accredited by COFRAC.
Who needs HDS certification
The French HDS (Hébergeur de Données de Santé) certification is mandatory for any entity hosting personal health data on behalf of third parties (Article L.1111-8 of the French Public Health Code). It covers six activities, from infrastructure provision to managed services. For a SaaS vendor the key question is: do you process health data? Sick leave, work incapacity, disability status (RQTH), occupational health visits — data commonly found in HRIS or payroll software — can bring your product into the health scope.
What it means for an HR SaaS
Two main paths: host with an HDS-certified cloud (OVHcloud, Scaleway, AWS, Azure and GCP offer certified options), making sure the contract actually covers your use case, or get certified yourself — a heavy undertaking (ISO 27001 audit plus HDS-specific requirements) reserved for vendors who make it a commercial argument. The often-missed point: your host's certification does not certify your application. Hospital clients, insurers, or occupational health services will ask for both: HDS-compliant hosting and demonstrated application security.
Where a security audit fits
CleanIssue is not an HDS certification body, but our audits work upstream and alongside it: verifying that health data is actually segregated and encrypted as your documentation claims, that access is restricted, and that the application surface doesn't contradict your commitments. An external audit report is also a strong attachment for healthcare clients' security questionnaires.
Frequently asked questions
My HR software handles sick leave: does HDS apply to me?
Potentially, yes. Data about work stoppages, incapacity, or medical visits can qualify as health data. The analysis depends on exactly what you store (medical reason versus mere administrative status). A precise legal qualification is needed before concluding — and out of caution, many HR vendors choose HDS-certified hosting.
Is using an HDS-certified cloud enough?
No. The host's certification covers the infrastructure and contracted activities, not your application. An application flaw (IDOR, misconfigured RLS) exposes health data even on certified hosting. You need both levels: compliant hosting and demonstrated application security.
How do HDS and GDPR relate?
GDPR classifies health data as a special category (Article 9) with reinforced requirements. HDS is the French framework specific to hosting that data. Being HDS-certified waives no GDPR obligation: the two frameworks stack.