How HDS Certification Can Help Protect Your Health Data

In an increasingly data-driven healthcare landscape, protecting sensitive information has become paramount. The French health data regulation, known as Hébergeur de Données de Santé (HDS), plays a crucial role in safeguarding health data. Understanding HDS and its implications is vital for any organization that may host French health data. 

The History and Purpose of HDS Certification 

During the French Revolution, a seismic social and political upheaval led to the introduction of revolutionary ideas and the emergence of new political systems that shaped modern France and influenced revolutionary movements worldwide. 

While perhaps not on the same scale, the threats to health data and demand for additional security over that data have led to advancements of security standards. In today's fast-paced and ever-evolving healthcare industry, data security is more important than ever—especially as the threat landscape continues to evolve. 

Just as they did in the 1790s, the French have come up with a new solution, HDS certification, which provides a legal and security framework that keeps pace with the digital transformation of health data and ensure that third-party hosting providers are compliant with French data protection laws.  

Though relatively new to the data governance scene in comparison to some other security standards, HDS now presents a worthy alternative for organizations seeking to demonstrate trust that the information within their custody is safe. As one of only nine organizations accredited to provide HDS certification, we have a more detailed perspective on this option than most.  

In this article, we’re going to reiterate the criticality of protecting health data, cover what HDS certification is, and explore what types of organizations are required to be certified or should consider pursuing certification. 

The Importance of Protecting Health Information

We don’t need to tell you that if you handle sensitive health information, you must take all necessary measures to help ensure that patient data is protected and secured—personal health data is some of the most valuable and sensitive information out there. 

For that reason, it’s unfortunately also the most sought after by cyber criminals, and because patient data is now spread farther and wider than ever before, from hospitals to cloud data solution providers, the risks of exposure and other threats continue to increase every year. 

Notable data analysis by Critical Insight confirms that attackers are targeting not only hospitals but also business associates and third-party vendors, such as electronic medical record providers, lawyers, accountants, billing companies, and medical device manufacturers. 

Defending against such widespread and advancing attacks and preventing any breaches or theft requires effective and robust security measures, and that’s where HDS certification can help. 

What is HDS? 

As mentioned, HDS certification was created as a result of the French government recognizing the need to mitigate risks as they specifically pertained to health data, so they went so far as to codify it into law. 

The French Public Health Code (Article L.1111-8) mandates that all entities hosting personal health data achieve HDS certification—a process that was introduced by the Agence du Numérique en Santé (ANS) in 2018. HDS regulations and the related certification function a bit like HIPAA in the United States in that they serve to verify your compliance with a baseline set of requirements regarding all personal health data hosting. 

To obtain certification, you’ll undergo an assessment by an accredited certification body that will evaluate your adherence to HDS’s rigorous control framework, including measures such as: 

• Conformance to the ISO 27001 standard by an IAF-accredited certification body  
• Incorporation of the HDS requirements into your management system, including risk assessment and internal audit 
• Strict contractual obligations between the Host and its customers 
• Data localization requirements 
• Representation of guarantees requirement (transparency in the use of the processors involved in the hosting activity, and if they are HDS certified or not) 

After completing and passing the assessment, you’ll receive a report and an official certificate, including an HDS mark, the latter of which is valid for three years. Much like the popular ISO 27001 certification – which is a pre-requisite for HDS, annual surveillance audits are required during off-certifying years to ensure continued HDS compliance. Each assessment must be completed onsite and in-person. 

Who Needs HDS Certification?

HDS is focused on securing patient data in healthcare, but of the many different types of organizations in the sector, there are specific ones who should consider pursuing HDS certification. 

Article L.1111-8 of the French Public Health Code provides some guidance, stating the standards are for “Any natural or legal person that hosts personal health data collected during an activity of: prevention, diagnostic, social and medico-social care and monitoring for the account of natural or legal person originating the production and collection of these data on behalf of the patient itself, must be accredited and certified for this activity.” This applies regardless of location. 

Put simply, HDS applies to a wide range of entities involved in healthcare data management, so if your company falls into any of the following categories, HDS certification may be relevant or required for you: 

Moving Forward with HDS Certification 

It may not have been an uprising in the same vein as the one that introduced the guillotine and tore down the Bastille, but in these modern times, the French have channeled their revolutionary spirit into creating one of the world’s strictest governance frameworks to help protect health data. 

No matter where or how you work in the healthcare sector, HDS certification can help your organization comply with legal requirements, enhance the credibility of your services, boost your security posture, and build trust with your customers regarding the safety of their data. By implementing the strict governance and control measures, you’ll also gain a competitive advantage that can lead to increased opportunities and long-term growth. 

Despite now understanding a little more about HDS, navigating this compliance journey may still be challenging. As one of your potential partners in this endeavor, we encourage you to reach out to us with any questions—we’d be happy to provide you with a more thorough walk-through. 

As we are an experienced cybersecurity firm, we also offer a variety of related services which pair well with HDS certification, such as: 

• The aforementioned ISO 27001 certification 
• HITRUST certification 
• HIPAA audits 
• SOC 2 examinations 
• Assorted privacy services

Our team can work with you to create a customized compliance roadmap that meets the unique needs of your organization while reducing your audit fatigue—contact us today to learn more. In the meantime, discover additional HDS insights in these helpful resources:  

• The New HDS Framework Explained 
• Key Considerations for Complying with HDS Version 2 
• How to Prepare for HDS Certification