HDSFrench certified health data hosting

Article L1111-8 covers health data collected during prevention, diagnosis, care or medico-social follow-up. Where such data is hosted on a digital medium, the host must hold a certificate of conformity issued by an accredited certification body (article L1111-8, paragraph II).

Decree No 2018-137 of 26 February 2018 sets the certified activities. They are: making physical sites, physical infrastructure, virtual infrastructure and application hosting platforms available and keeping them operational; administering and operating the information system that holds health data; and backing up health data.

The texts do not mention animals or veterinary records. The regime concerns health data of natural persons. Under the GDPR, health data are personal data relating to the physical or mental health of a natural person (article 4, points 1 and 15). Data about an animal alone are not personal data under the GDPR, which covers natural persons only. On these texts, a record holding only animal data is outside the HDS scope. The owner’s identity data are personal data, but not health data. The scope may change, so check the current position on esante.gouv.fr.