What Is HDS? Health Data Hosting vs Other Meanings Explained

Type "what is hds" into a search box and the results blend three unrelated things together: a French health data hosting certification with a legal basis and a named certifying body, a loose clinical abbreviation that different hospitals use for different things, and a commercial brand name that shows up in scam-checking forums outside Europe. Only the first of these has a defined scope, an accredited auditor and a public attestation a buyer can actually check. This article separates the three, then shows what a real HDS attestation looks like when it appears next to a vendor's other evidence in the HDS vendors with public evidence index.

The acronym collision search engines don't resolve

Search volume for "what is hds" comes from at least three different audiences, and a single page rarely serves all of them well. Healthcare IT buyers operating in or selling into France need to know whether a cloud provider or SaaS vendor is permitted to host patient data under French law, and who is accountable if it isn't. Clinical students and some hospital staff encounter "HDS" as informal chart shorthand that varies between departments, wards and even individual clinicians, with no single governing definition behind it. A third group, often outside Europe, searches "is HDS legit" after encountering a company, trading platform or retail brand that happens to use the same three letters, with no connection to health data hosting at all. CertReports only tracks the first meaning, because it is the only one with a defined scope and public, checkable evidence attached to it.

What HDS actually is: France's health data hosting certification

HDS stands for Hébergeur de Données de Santé, literally "host of health data". It is a certification required under France's Code de la santé publique, Article L1111-8, for any organisation that stores, hosts or processes personal health data on behalf of a healthcare provider, health insurer, laboratory or health technology company operating in France. The requirement applies regardless of where the hosting infrastructure physically sits. A cloud region outside France that serves a French hospital's patient records still needs an HDS-certified hosting arrangement somewhere in the chain, whether that is the infrastructure layer, the platform layer or both.

The certification itself is issued by a certification body accredited by COFRAC, France's national accreditation body, against a reference framework maintained by the Agence du Numérique en Santé, the French government's digital health agency, formerly known as ASIP Santé. The HDS referential builds on ISO 27001's management system structure and adds requirements specific to health data hosting activities: physical and infrastructure hosting, platform hosting, application hosting for health software, and data backup, recovery and archiving services. A vendor can hold a certificate covering some of these activities without covering all of them, which is why the scope line matters more than the badge itself.

The HDS certification attests that a health data hosting provider meets the technical and organisational requirements set out in the reference framework, assessed by an accredited third-party certification body.
— Agence du Numérique en Santé

What's on a real HDS attestation

An HDS attestation is a formal certificate, not a self-declared badge. When one appears on a vendor's trust page or in the CertReports index, it should carry the same structural elements as any other third-party audit outcome: a named auditor, a defined scope, a legal entity and a set of dates.

Field	What it tells a buyer
Certifying body	Name of the COFRAC-accredited auditor that issued the certificate, separate from the vendor itself
Certificate holder	The legal entity operating the data centre or hosting service, which can differ from the software vendor's parent company
Scope	Which hosting activities are covered: infrastructure, platform, application hosting or archiving, since a certificate can cover one without the others
Reference framework version	The ANS referential edition the audit was assessed against
Validity period	Typically a multi-year cycle with interim surveillance audits, after which recertification is required

Fields a genuine HDS certificate should show, compared with a vague hosting claim.

The scope line is where most confusion happens in practice. A vendor might truthfully hold an HDS certificate for infrastructure hosting through its cloud provider, while its own application layer, where patient data is actually processed, has never been assessed. That is a materially different position from end to end HDS coverage, and a buyer who only sees the word "HDS" on a page has no way to tell the two apart without the actual certificate.

Diagram showing the layers of an HDS certification: infrastructure hosting, platform hosting, application hosting and data archiving — HDS scope can cover one hosting layer or several; the certificate should state which.

HDS vs HIPAA: different legal systems, different kind of proof

Buyers comparing European and US healthcare requirements often assume HDS is "the French HIPAA". The comparison breaks down quickly. HIPAA is a US federal law, not a certification scheme, and there is no government body that issues a "HIPAA certified" stamp to a vendor. What HIPAA requires instead is a signed Business Associate Agreement between a covered entity and anyone handling protected health information on its behalf, plus the administrative, physical and technical safeguards set out in the Security Rule. See what HIPAA asks of your vendors for the full list of obligations, and the HIPAA vendors with public evidence page for how vendors actually document this today. HDS, by contrast, is a pass or fail audit outcome against a published French government framework, structurally closer to ISO 27001 than to HIPAA's legal requirement for a signed contract. A vendor can hold both: an HDS certificate for hosting data destined for French healthcare entities, and a signed BAA for US customers, and the two prove completely different things. Before accepting either claim at face value, run through the BAA checklist and the distinction covered in HIPAA Eligible vs HIPAA Compliant.

The phrase to watch for

If a vendor's marketing page says "HIPAA certified", treat it as a sign the page has not been checked carefully. HIPAA has no certificate to hold. Ask for the signed BAA instead, and check it names the specific services you are buying.

Where this shows up on real vendor trust pages

Trust centres rarely separate "certified" from "contracted" clearly, which is exactly where HDS and HIPAA get confused in practice. The card below is a useful comparison case: look at how the HIPAA row is presented next to frameworks that do carry an actual certificate, and whether a signed BAA is listed as captured evidence or only referenced as available on request. The same reading technique applies when checking that an HDS line is a certificate and not a sales claim; see how to read a trust centre for the full method.

Intercom · Trust report

Customer support · Public evidence as of 19 Oct 2026

Visit trust centre Full evidence

Framework overview

CertReports state for each framework with public evidence: 1 verified, 10 vendor-stated.

2 more frameworks on the evidence page

2Documents and agreements

Legal and review documents Intercom publishes or offers, as of 30 Sep 2026.

Subprocessor list · Public
Privacy policy · Public

1Security practices

Public statements from Intercom, shown as statements, not attestations, as of 30 Sep 2026.

Penetration testing · annual

14Subprocessors

Named on Intercom's public subprocessor list, last seen 30 Sep 2026.

Intercom's trust centre lists a HIPAA badge alongside eleven frameworks, with no BAA shown as captured. Every line is a dated public record from the Data Privacy Framework list and Intercom's trust centre. A framework not shown means no public evidence was found, not that Intercom lacks it.CertReports

Other things people mean by HDS

Outside health data hosting, "HDS" is used loosely enough that no single definition applies. In clinical documentation, different hospitals and specialities use "HDS" as shorthand for different local terms, and there is no equivalent of ANS or COFRAC standardising it, so a definition learned in one department will not reliably apply in another. Students and junior staff searching "what is hds medical" are usually looking for a meaning specific to the chart or textbook in front of them, not a universal clinical standard. Separately, "is hds legit in philippines" typically has nothing to do with healthcare at all: it usually refers to a trading platform, investment scheme or retail brand operating under the HDS name in Southeast Asia, unconnected to the French certification or to any framework CertReports tracks. Checking that kind of claim is a job for the Philippine Securities and Exchange Commission or a relevant consumer protection body, not a compliance evidence index. For a genuine country-specific hosting scheme comparable in spirit to HDS, France also runs SecNumCloud, a stricter sovereignty-focused certification for cloud providers. The two schemes are related in origin but not interchangeable in scope.

Three unrelated meanings share the same three letters; only one has a public, checkable record.

How to verify an HDS claim on a vendor page

1
Find the certifying body
Look for the name of the COFRAC-accredited auditor on the certificate itself, not just the vendor's own branding or a generic HDS logo.
2
Match the scope to your use case
Check whether the certificate covers infrastructure, platform or application hosting, since a vendor may hold one without the others and that gap matters for your data.
3
Check the certificate holder
Confirm the legal entity named on the certificate is the one actually hosting your data, which can differ from the brand name you are buying from.
4
Check the validity dates
HDS certificates run on multi-year cycles with surveillance audits; an expired cycle with no renewal listed is worth a direct question to the vendor.
5
Ask for the document, not the badge
A logo on a marketing page is not evidence. Request the certificate or ask the vendor to point to where it is published in full.

HDS in the index, by the numbers

HDS is a narrow, country-specific scheme compared with the frameworks most vendors lead with on their trust pages, which is part of why it gets overshadowed and confused with broader terms.

34
frameworks tracked: in the CertReports index on 2026-10-25, including HDS and HIPAA; 1
country HDS legally applies to: France, under Code de la santé publique Article L1111-8; 0
official "HIPAA certified" badges that exist: HIPAA requires a signed BAA, not a certificate, from any vendor handling PHI

Treat any HDS claim the way you would treat any other audit outcome: check the certifying body, the scope and the dates before it goes into a questionnaire answer or a vendor risk file.

People also ask

What is hds?

HDS stands for Hébergeur de Données de Santé, a French certification required for organisations that host, store or process personal health data for French healthcare providers, insurers or health tech companies. It's issued by a COFRAC-accredited certification body against a framework maintained by the Agence du Numérique en Santé. The same three letters also show up as an informal medical abbreviation and as an unrelated commercial brand name, which is why search results for "what is hds" mix several unrelated topics together.

What is hds in medical terms?

In clinical settings, "HDS" is sometimes used as informal shorthand on charts or in training materials, but its meaning varies between hospitals and specialities because no governing body standardises it the way the Agence du Numérique en Santé standardises the French health data hosting certification. If you've encountered "HDS" in a medical document, check the local glossary or ask the author rather than assume a single universal definition applies everywhere.

What is hds medical?

This phrasing usually reflects the same search as "HDS in medical terms": people looking for a clinical meaning of the abbreviation rather than the French health data hosting certification. Because no single medical body owns the term, its meaning depends on the institution, chart or course material where it appeared. It is unrelated to the Hébergeur de Données de Santé certification that governs health data hosting in France.

Is hds legit?

The French HDS certification is a legitimate, government-recognised scheme. It's backed by a legal requirement in the Code de la santé publique, assessed by certification bodies accredited by COFRAC, and based on a published reference framework held by the Agence du Numérique en Santé. You can verify a specific claim by checking the certifying body's name, the certificate scope and its validity dates, rather than relying on a vendor's badge alone.

Is hds legit in philippines?

If you're asking this, you've likely encountered a company, trading platform or investment product using "HDS" as a brand name in the Philippines, which has no connection to the French health data hosting certification or to any framework tracked here. That kind of legitimacy question falls under the Philippine Securities and Exchange Commission or local consumer protection bodies, not a compliance evidence index covering vendor certifications and audit reports.

HDShealth data hostingFranceHIPAAcompliance explainer

Solomon Amos · Founder, CertReports

Solomon builds CertReports, the public evidence index for vendor security reviews. PhD in machine learning and cybersecurity, two years embedded at HMRC digital programmes, founder of TapTax. He writes about what registries, trust centres and auditors actually publish, and how buyers can use it before the questionnaire goes out.