Article · November 4, 2026
HDS Certification: Framework v2, Sovereignty, and v2.1
HDS certification in 2026: scope, six activities, mandatory v2 framework, March 2026 decree, upcoming v2.1, and alignment with the GDPR.
Since May 16, 2026, all health data hosting (HDS) certificates must be based on the v2 framework. Since late September 2026, storing health data within the European Union or the European Economic Area is enshrined in the French Public Health Code. Meanwhile, version 2.1 of the framework is arriving to further strengthen contractual transparency.
What is HDS Certification?
HDS certification stems from Article L. 1111-8 of the French Public Health Code. It is mandatory for any organization hosting, on behalf of a third party, personal health data collected during prevention, diagnostic, care, or social and medico-social monitoring activities (donneespersonnelles.fr).
This is not an optional label: hosting such data without certification is a criminal offense punishable by three years of imprisonment and a €45,000 fine, which increases to €225,000 for legal entities. The v2 framework builds upon ISO/IEC 27001:2022, adding healthcare-specific requirements (donneespersonnelles.fr).
Who is Affected?
The requirement applies when three conditions are met:
- it involves personal health data;
- it was collected in the context of prevention, diagnostic, care, or social and medico-social monitoring;
- hosting is performed on behalf of a third party.
Typically affected parties include cloud providers and data center operators hosting health data for their clients, healthcare SaaS software vendors, managed service providers (MSPs), and outsourced backup or archiving providers. An institution hosting its own data on its own infrastructure does not need to be certified, though it remains subject to the GDPR (donneespersonnelles.fr).
The Six Certifiable Activities
- Provision and operational maintenance of physical sites.
- Provision and operational maintenance of hardware infrastructure.
- Provision and operational maintenance of virtual infrastructure.
- Provision and operational maintenance of the application hosting platform.
- Administration and operation of the information system containing health data.
- Backup of health data, which now includes its retention within electronic archiving.
A key point for clients: the certificate must cover the exact activities the provider actually performs on your behalf. A certificate limited to physical sites does not cover system administration (donneespersonnelles.fr).
The Timeline
| Date | Milestone |
|---|---|
| May 16, 2024 | Publication of the v2 framework in the Official Journal (decree of April 26, 2024) |
| November 16, 2024 | All new certifications follow the v2 framework |
| March 26, 2026 | Publication of Decree No. 2026-209 of March 24, 2026 (implementing the SREN law) |
| May 16, 2026 | End of transition: v1.1 certificates are no longer valid |
| Late September 2026 | Mandatory EU/EEA-only storage and new contractual terms applicable under the Public Health Code |
| December 2026 at the earliest | Expected publication of framework v2.1, enforceable three months later |
Sources: donneespersonnelles.fr, Schellman, Desmarais Avocats.
How Domyno helps
One source of truth, agents that prepare the work, and a dedicated expert who reviews it.
Sovereignty: The Core of the v2 Framework
- Location: Health data must be stored exclusively in the EEA (Requirement 28). Since the decree of March 24, 2026, this rule is also codified in the French Public Health Code (Article R. 1111-9-1).
- Remote access: Access from a third country, such as for technical support, is treated as a transfer. It must rely on an adequacy decision or appropriate safeguards under the GDPR (Requirement 29).
- Exposure to foreign laws: If the host or a subcontractor is subject to non-European legislation, the contract must name it, describe mitigation measures, and outline residual risks.
- Public transparency: The host must publish and maintain a mapping of data transfers and remote access (Requirement 31).
Two other requirements warrant attention. The risk analysis must cover at least eight predefined events, including exposure to non-European laws. The reversibility clause must specify costs, timelines, and data restitution formats (donneespersonnelles.fr).
A host subject to US law can still be certified if it stores data within the EEA. However, its legal exposure must now be clearly stated in black and white in the contract.
HDS v2.1: What is Coming
Version 2.1 aligns the framework with the SREN law and the March 2026 decree. The primary changes center on contractual agreements (Schellman, Desmarais Avocats):
- Activity 6 explicitly covers electronic archiving;
- Requirements 23-1 to 23-3 mandate describing in the contract any transfers outside the EU/EEA, applicable foreign legislation, or conversely, the absence of such legislation;
- Requirement 19 mandates listing patient rights granted by the GDPR (access, rectification, erasure, portability, restriction, objection);
- Requirement 29 specifies that data subjects must have enforceable rights in the event of a transfer based on appropriate safeguards.
The draft was notified to the European Commission in late August 2026, initiating a three-month standstill period: publication is not expected before early December 2026 (Desmarais Avocats). Audits conducted starting three months after publication will adhere to v2.1. The main priority will be amending existing customer contracts.
HDS and GDPR: Two Regimes, One Unified Effort
An HDS host is generally a data processor under Article 28 of the GDPR. Certification exempts neither party from executing a Data Processing Agreement (DPA) nor from the data controller's own obligations: securing its own perimeter, notifying breaches, and conducting Data Protection Impact Assessments (DPIAs) for large-scale health data processing.
The CNIL reiterated this in 2026 by issuing a €500,000 fine to the Hôpital privé de la Loire following unauthorized access to the data of over 520,000 patients. The breaches directly concerned the healthcare institution itself: remote access without multi-factor authentication, overly broad user permissions, and a lack of intrusion detection (donneespersonnelles.fr). Certified hosting does not protect against a compromised account.
Where to Start
If you are a host or healthcare SaaS vendor:
- Verify that your certificate complies with the v2 framework and covers all the activities you perform.
- Publish and maintain an up-to-date mapping of transfers and remote access.
- Start preparing the contractual amendments required by the decree and v2.1 now.
- Quantify your reversibility clause: costs, timelines, formats.
If you entrust health data to a host:
- Map your health data flows and all involved service providers.
- Audit the certificate of each vendor and its subcontractors: version, validity, covered activities.
- Obtain written confirmation of EU/EEA storage and the list of countries from which remote access is permitted.
- Secure your own perimeter: multi-factor authentication, least-privilege permissions, logging, and alerting.
How Domyno Supports You
The HDS framework is built on ISO 27001, and Domyno is the ideal platform to manage both in tandem. Highly flexible, it adapts to your organization whether you are a hosting provider, a healthcare SaaS vendor, or a healthcare institution outsourcing its data. With our custom framework, you can integrate HDS requirements into your ISMS and seamlessly incorporate v2.1 controls as soon as it is published, without starting over.
The control plan assigns each requirement across your teams with deadlines and audit evidence, through to your surveillance audits. Vendor management helps you track your providers' HDS certificates, business continuity and disaster recovery plans support your availability commitments, and incident and vulnerability management completes your security posture.
Optionally, our dedicated GDPR software and cyber awareness solution reinforce health data protection down to the workstation. Plus, a compliance expert supports you from day one through to certification.