Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
The Hébergeurs de Données de Santé (HDS) certification is required for entities such as cloud service providers that host the personal health data governed by French laws and collected for delivering preventive, diagnostic, and other health services. The HDS regulation was issued by ASIP SANTÉ which, under the French Ministry of Health, is responsible for promoting electronically based healthcare solutions in France.
Hosting of health data is regulated under French law by the French Public Health Code (Article L.1111-8), which stipulates that any healthcare organization—hospitals, pharmaceutical companies, laboratories—that handles personal medical data must use a service provider that is HDS-certified. In April 2018, new Articles R1111-8-8 to R1111-11 of the Public Health Code took effect, changing the accreditation procedure from an authorization by the French Ministry of Health to certification by an authorized body. In April 2024, a new version of the certification framework for HDS was published in the Official Journal: the Decree of April 26, 2024, amending the decree published on June 29, 2018, approves the implementation of updated accreditation and certification standards:
- The Decree opens the HDS accreditation scheme. Hosting candidates must submit their certification application to a certification body accredited by the French Accreditation Committee (COFRAC), the sole accreditation body at the national level, or any equivalent body at the European level.
- HDS certification framework version 1.1, dating from 2018, requires that service providers implement measures that keep personal health data secure, confidential, and accessible by patients. These measures include strong authentication and authorization procedures, robust backup systems, and powerful encryption methods. HDS also specifies mandatory provisions that must be included in contracts with the cloud service provider. These requirements apply no matter where the data is stored. The 2024 update of the HDS certification framework additionally mandates service providers to locate data within the European Economic Area (EEA), along with more stringent requirements for the protection of personal data in relation to data transfers outside the European Union (EU).
Microsoft and HDS
Microsoft Azure, Microsoft Dynamics 365, and Microsoft 365 have been granted the Health Data Hosting (Hébergeurs de Données de Santé, HDS) certification version 1.1, which is required for all entities hosting personal health data governed by French law. This made Microsoft the first major cloud service provider to meet the strict French standards for storing and processing health data. This certification, required by the revision to the 2018 French Public Health Code, imposes advanced security and privacy requirements on hosting services and cloud providers to ensure that the confidentiality and integrity of sensitive data is adequately protected.
With the new standard in place, a new certification in accordance with the set of requirements should be obtained by May 16, 2026 at the latest. Microsoft compliance with the requirements from HDS certification framework version 2.0 has been audited and certified by Schellman, an independent certifying body accredited by French authorities to conduct HDS audits. The new HDS certificate has been issued in October 2025.
The HDS certification enables healthcare providers in France to use Microsoft cloud services to save costs by improving clinical and operational efficiency, and it opens the door to the development of innovative, cutting-edge healthcare solutions. The scope applies to Microsoft's datacenters located within the European Economic Area (EEA). Providers are able to develop smart applications or use third-party applications hosted on Azure to implement predictive analytics to personalize healthcare, evaluate and treat patients at a distance (telemedicine), and sharpen therapeutic drug monitoring.
The rigorous audit covered the measures Microsoft has taken to secure personal health data and protect its confidentiality, including the ISO/IEC 27001:2022 Information Security Management certification of Microsoft cloud services, which are audited annually for compliance, and inclusive of the requirements from HDS certification framework version 2.0 for the following six activities, as per Article R1111-9 of the above-mentioned Public Health Code:
- Provision and maintenance in operational condition of physical sites for hosting the hardware infrastructure of the information system used to process the health data;
- Provision and maintenance in operational condition of the hardware infrastructure of the information system used to process the health data;
- Provision and maintenance in operational condition of the virtual infrastructure of the information system used to process the health data;
- Provision and maintenance in operational condition of the platform for hosting information system applications;
- The management and operation of the information system containing the health data;
- Backup of the health data.
Microsoft in-scope cloud platforms and services
- Azure. The HDS certificate applies to Azure services listed as compliant with the ISO/IEC 27001 standard in Azure Compliance offerings and provisioned in the following regions:
- France Central
- France South
- Finland Central
- Germany North
- Germany West Central
- Italy North
- North Europe
- Norway East
- Norway West
- Poland Central
- Spain Central
- Sweden Central
- Sweden South
- West Europe
- Dynamics 365. The HDS certificate applies to Dynamics 365 Core Online Services provisioned from France and European Union geographies.
- Intune
- Microsoft 365. The HDS certificate applies to Microsoft 365 Core Online Services provisioned from France and European Union geographies.
- Power BI cloud service either as a standalone service or as included in a Microsoft 365 branded plan or suite.
- Microsoft Intune
- Microsoft 365. The HDS certificate applies to Microsoft 365 Core Online Services provisioned from France and European Union geographies.
- Power BI cloud service either as a standalone service or as included in a Microsoft 365 branded plan or suite
The HDS certificate doesn't apply to Microsoft online services in preview or prerelease.
Audits, reports, and certificates
HDS certification imposes advanced security and privacy requirements on hosting services and cloud providers to ensure that the confidentiality and integrity of sensitive data that must be located within the EEA is adequately protected. Microsoft cloud services (including Azure) have been granted the HDS certification in accordance with the version 2.0 scheme, as shown on the list of HDS-certified hosts from the French Digital Health Agency ANS (Agence du Numerique en Santé, formerly ASIP Santé) portal.
Download Microsoft's ANS HDS certicate and Representation of Guarantees here: Regional Resources for France.
How to implement
- Contractual terms: The French Public Health code requires the execution of specific contractual terms between the health data hosting service or cloud service provider and its customers. Eligible customers must reach out to their Microsoft licensing point of contact to enter into these specific contractual terms before hosting health personal data on Microsoft online services.
- Health and life sciences: Case overviews, solution guides, tutorials, and other resources to help build Azure solutions.
Use Microsoft Purview Compliance Manager to assess your risk
Microsoft Purview Compliance Manager is a feature in the Microsoft Purview portal to help you understand your organization's compliance posture and take actions to help reduce risks. Compliance Manager offers a premium template for building an assessment for this regulation. Find the template in the assessment templates page in Compliance Manager. Learn how to build assessments in Compliance Manager.