Health Data Hosting in Switzerland: The 2026 Legal Framework

The essentials in 30 seconds

Introduction

Health data hosting in Switzerland cannot be reduced to a single localisation rule. The nFADP (new Federal Act on Data Protection) governs disclosure abroad, while cantonal law, professional secrecy and the position of the authorities narrow the choices of a public hospital. The electronic patient record (EPR) requires data carriers to be in Switzerland.

A CIO or data protection officer (DPO) mostly finds hosting providers' sales pitches, which present a Swiss data centre as the equivalent of a certification, and general summaries of the law written for companies. Few pages separate what the law requires from what the authorities recommend.

This article sets out the layers in the order a management committee meets them: federal law, cantonal law, professional secrecy, positions of the authorities, the EPR, public procurement. It then places the French framework, which does not apply to a Swiss hospital.

Every statement points to a text or a dated decision. A reading that a lawyer should confirm is flagged in the limits section.

How does Galeon approach health data hosting?

Galeon, a French electronic health record (EHR) vendor founded in 2016, hosts its client hospitals' health data in France, with Scaleway, an HDS-certified host. This French base equips 19 hospitals and around 10,000 clinician users.

French, HDS-certified and sovereign hosting

According to the page Galeon devotes to its hosting, Scaleway is a French company with fully European governance, not subject to the extraterritorial reach of US law. Galeon draws a sovereignty argument from this: the host's jurisdiction matters as much as the location of the servers. The same page adds a caveat, since no arrangement makes data untouchable.

Galeon's information security is also ISO 27001 certified, according to its website. The infrastructure runs on Kubernetes (Kapsule), with S3-compatible object storage for backups, which makes reversibility easier.

And for a Swiss institution?

Galeon is extending its offer to Swiss hospitals. According to its articles on Switzerland, its EHR applies TARDOC rules and outpatient flat rates at the point of data entry, codes procedures with the help of AI and relies on HL7 FHIR, the standard for connecting to the EPR.

The relevant hosting location for a Swiss hospital depends on its cantonal law and its professional secrecy obligations, layers detailed below. It is settled with each institution, based on the five pieces of evidence listed in the section on what a foreign vendor must demonstrate.

Does the nFADP require health data to be hosted in Switzerland?

The law contains no general "host in Switzerland" clause. It governs security, subcontracting and disclosure abroad, and hosting is assessed through these three doors.

What the law requires of the host

The Federal Act on Data Protection (nFADP) has been in force since 1 September 2023 (Federal Council, press release of 31 August 2022). It classes health data among sensitive data (art. 5, let. c). The controller and the processor ensure security appropriate to the risk (art. 8).

Entrusting processing to a third party requires a contract or a legal basis, that the third party only does what the controller could do itself, and that no duty of secrecy prohibits it (art. 9, para. 1). The controller makes sure the processor guarantees security, and the processor may subcontract in turn only with the controller's prior authorisation (art. 9, para. 2 and 3).

Processing sensitive data on a large scale calls for a prior data protection impact assessment (art. 22): the hospital documents it before entrusting its patient record to a host.

When the law does not apply to the hospital

The FADP governs processing by private persons and federal bodies (art. 2). A public cantonal hospital generally falls under cantonal law. In their guidance note of 16 September 2026, the Federal Data Protection and Information Commissioner (FDPIC) and privatim distinguish public institutions, subject to the principle of legality and to cantonal law, from private clinics without a public mandate, subject to the FADP.

Can a Swiss hospital host its data abroad, in France or in the United States?

Yes, under conditions, from the nFADP's point of view: disclosure abroad is possible to an adequate state or with safeguards. This answer does not close the question for a hospital, which must also look at its cantonal law and at professional secrecy.

To a state recognised as adequate

Data may be disclosed abroad if the Federal Council has determined that the state offers adequate protection (art. 16, para. 1). The list is in annex 1 of the Data Protection Ordinance. In its version of 15 September 2024, it includes the 27 European Union states and the three EEA states, France among them.

A host established in France is therefore in a state recognised as adequate. This says nothing about HDS certification, a separate French regime, nor about the cantonal law that applies to the hospital.

To the United States

On 14 August 2024, the Federal Council decided that US companies certified under the Data Privacy Framework offer an adequate level of protection, with effect from 15 September 2024. Annex 1 lists the United States for certified organisations only.

Outside these cases, the nFADP accepts contractual safeguards, such as standard clauses, or derogations, including the express consent of the person concerned (art. 16, para. 2, and art. 17).

What does cantonal law change for a public hospital?

It changes the source of the rule and the authority that supervises it. Each canton's law sets what a public hospital may outsource, and tenders reflect it.

The documented example of Zurich

The Executive Council of the canton of Zurich replied on 17 September 2025 to a parliamentary question on the choice of the clinical system at the university hospital (USZ). It recalls that the hospital is answerable for cantonal IT security and data protection rules, and that these rules were written into the tender.

The USZ states that all patient data would be stored in its own data centres or in other data centres located in Switzerland, and that it would involve the cantonal data protection commissioner after the contract is awarded.

Reading your canton's law

No French-speaking cantonal law was opened for this article. A CIO or DPO identifies their canton's data protection law and the authority that supervises it: the rules on subcontracting and the cloud vary from one canton to another.

Does professional secrecy limit the use of a host or a vendor?

It weighs on the choice, and it is a point often overlooked in comparisons of hosting providers. A third party who can read data covered by secrecy must be able to qualify as an auxiliary of the professional, or must have no access to readable data.

What article 321 of the Criminal Code says

Article 321 punishes physicians and other healthcare professionals, as well as their auxiliaries, who disclose a secret entrusted to them because of their profession. The penalty goes up to three years in prison or a monetary penalty, on complaint. Disclosure is not punishable with the consent of the person concerned, or with the written authorisation of the superior or supervisory authority.

Is a vendor or a host an auxiliary?

The Zurich data protection commissioner answers, about a US vendor, that a large foreign group does not meet the conditions of an auxiliary. She concludes that at implementation, the provider must have no means of accessing patient data (reply of the Zurich Executive Council, 17 September 2025).

She distinguishes the on-premises solution, where data stays local, from the cloud solution. In the second case, secrecy can be preserved if the data is encrypted so that the provider cannot read it. Privatim likewise writes that not every third party can be called an auxiliary.

What do Swiss authorities say about hyperscalers and the cloud?

Data protection commissioners are the most restrictive, and the political debate remains open. The line that emerges depends less on the country of the data centre than on who can read the data.

The privatim resolution of 18 November 2025

Privatim, the conference of Swiss data protection commissioners, adopted a resolution on outsourcing to the cloud. It targets public bodies that use SaaS services from large international providers. For particularly sensitive data or data subject to legal secrecy, it considers such use inadmissible in most cases.

It becomes possible only if the body encrypts the data itself and the provider has no access to the key. Privatim notes that most SaaS solutions do not yet offer end-to-end encryption. The US CLOUD Act can also compel a US provider to hand over data, including data stored in Swiss data centres.

A resolution is not legally binding, and part of legal scholarship considers it too absolute. It shows how the supervisory authorities read the issue.

The Vaud debate and the federal SwissHDS project

In the canton of Vaud, the minority report of the Grand Council committee (June 2026) sums up two positions. The majority held that on-site hosting and contractual clauses are enough to neutralise the CLOUD Act risk. The minority held that hosting in Switzerland is not enough to guarantee sovereignty. The Grand Council approved the choice of the US system.

At federal level, Netzwoche reported on 12 May 2026 that preliminary FOPH documents for the SwissHDS data space would call for an infrastructure subject exclusively to Swiss law, with no dependence on foreign jurisdictions. The head of procurement specified that this was a preliminary market consultation, not a finalised tender.

What does the electronic patient record require on localisation?

The EPR is the case where the rule is written down: data carriers must be located in Switzerland and governed by Swiss law. The future electronic health record carries this principle forward.

The current ordinance

The Ordinance on the Electronic Patient Record provides that data carriers must be located in Switzerland and governed by Swiss law (EPRO, art. 12, para. 5, status as of 1 October 2024). The rule applies to the communities that operate the EPR, not to the hospital's internal record.

The future electronic health record

For the law being drafted, the FOPH indicates that data will be subject to Swiss law and kept in Switzerland, with a go-live in 2030 at the earliest. The rule does not automatically extend storage in Switzerland to the hospital's internal record. It shows the Confederation's position on data that circulates between providers.

How does the French HDS framework differ from the Swiss one?

HDS certification is a French regime: it does not apply to a Swiss hospital, and hosting in Switzerland is not equivalent to HDS certification. The two frameworks answer neighbouring questions with different mechanisms.

What HDS covers

The framework was revised by the order of 26 April 2024, published on 16 May 2024. According to the law firm CMS's analysis, certification is mandatory for a host that stores health data on behalf of a third party, as a processor. Hosts already certified had 24 months, until 16 May 2026, to move to the new framework.

What HDS does not say

HDS says nothing about Swiss cantonal law or about article 321 of the Criminal Code. According to the same analysis, its requirements on non-European laws remain less strict than those of the SecNumCloud framework. A Swiss hospital therefore reads an HDS certificate as a sign of the host's seriousness, not as proof of compliance with its own law.

What must a foreign vendor demonstrate to a Swiss hospital?

The law sets no list of evidence. The cases of Zurich and Vaud and the position of privatim make it possible to draw up five items. This list is our reading of these sources, not a standard.

Five pieces of evidence to ask for

• Where the data is stored and administered, including the country and the data centre.
• Who can access it, including remotely, and under which law: this is the criterion the Zurich commissioner and privatim place at the centre.
• Who holds the encryption keys.
• The subcontracting chain, with subsidiaries and hosts in third countries (art. 9, para. 3 of the nFADP).
• Cooperation with the hospital's DPO: impact assessment, subcontracting contract, confidentiality clause.

What tenders already set out

Hosting conditions are found in tender specifications more than in any single text. The threshold of the WTO Agreement for services of cantons and municipalities is 350,000 francs (IAGP communication for 2024 and 2025). The projects in Fribourg, Zurich and Vaud followed a tender procedure, and Zurich wrote the cantonal data protection rules into it.

What a foreign certification does not replace

A foreign vendor answers these five points with a contract, architecture diagrams and an audit the hospital can review, not with its home country's certification.

What it changes for management, IT and clinicians

For management

Management weighs a legal risk and a reputational risk. It benefits from distinguishing, from the tender stage, what the law requires from what the authorities recommend. Privatim is not binding, but a cantonal authority may refer to it.

The cost of local hosting or of encryption managed by the hospital should be estimated early: it can shift the balance between an on-premises and a cloud solution.

For the IT department and the DPO

The CIO and the DPO carry the impact assessment, the subcontracting contract and key management. The question "where is the data" is paired with "who can read it", which only a verifiable architecture can settle.

For clinicians

Clinicians are the holders of the secret: article 321 covers them and their auxiliaries. They expect the hosting choice to preserve the confidentiality of what patients confide in them.

Limits and points of caution

• Reading to be confirmed. The absence of a general localisation rule in the nFADP is our reading of articles 8, 9, 16 and 17. A lawyer must confirm it.
• Cantonal law not covered. No French-speaking cantonal law was opened: each canton may have stricter rules on subcontracting, the cloud and secrecy.
• A resolution is not a law. Privatim's position guides the supervisory authorities without being binding, and part of legal scholarship considers it too absolute.
• SwissHDS not finalised. The requirements reported by the press come from preliminary documents, and the head of procurement speaks of a market consultation.
• Texts liable to change. Annex 1, the EPRO and the HDS framework were read in dated versions.

FAQ

Must a Swiss hospital's health data be hosted in Switzerland?
No general nFADP rule requires it, in our reading: it governs disclosure abroad. The EPR requires it for its data carriers. Cantonal law, professional secrecy and the privatim resolution may require it in practice for a public hospital.

Can a Swiss hospital use a US cloud?
Since 15 September 2024, federal law recognises US organisations certified under the Data Privacy Framework. For data covered by secrecy, privatim considers such use inadmissible in most cases, unless encryption is managed by the public body.

Is a French HDS host accepted in Switzerland?
HDS is a French regime with no value of its own in Switzerland; it is the one that covers Galeon's hosting in France. France is among the adequate states in annex 1 of the ordinance, but the hospital remains bound by its cantonal law and by professional secrecy.

Does hosting in Switzerland protect against the CLOUD Act?
Not by itself, according to privatim: the CLOUD Act can target a US provider even for data stored in Swiss data centres. The Vaud debate shows that the authorities do not all decide the same way.

Who is liable for a data breach at the host?
The controller remains the first party concerned. The processor reports any breach to the controller promptly (art. 24, para. 3 nFADP), and the controller notifies the FDPIC when the breach presents a high risk (art. 24, para. 1).

Can a French vendor serve a Swiss hospital?
Nothing in the texts read rules it out. It must provide evidence specific to Switzerland: place of hosting and administration, access, encryption keys, subcontracting, cooperation with the DPO. Galeon, which hosts in France with Scaleway, HDS-certified, addresses these with each institution.

In summary

Galeon, a French electronic health record (EHR) vendor, equips 19 hospitals in France with around 10,000 clinician users, with data hosted by Scaleway, an HDS-certified host with European governance, and it is extending its offer to Swiss hospitals. For a Swiss hospital, hosting is judged in layers. The nFADP governs subcontracting and transfers, cantonal law governs the public hospital, professional secrecy covers the professional and their auxiliaries, and privatim asks, for the international cloud, for encryption managed by the public body. The EPR requires data carriers in Switzerland. HDS, a French regime, replaces none of these layers: a Swiss hospital asks every vendor for the five pieces of evidence described above, Galeon included.

Read also: health data sovereignty, the Cloud Act and sovereign hosting

Sources

• Federal Act on Data Protection: Fedlex, FADP (RS 235.1) (art. 2, 5, 8, 9, 16, 17, 22, 24 and 61), Data Protection Ordinance (annex 1, version of 15 September 2024) and Federal Council, Swiss-US Data Privacy Framework (14 August 2024).
• Data protection authorities: privatim, resolution of 18 November 2025 (encryption managed by the body, key not accessible to the provider, CLOUD Act) and FDPIC and privatim, guidance note of 16 September 2026 (public institutions under cantonal law, private clinics under the FADP).
• Cantonal law and secrecy: Zurich Executive Council, reply of 17 September 2025 (commissioner's opinion, auxiliaries, storage in Switzerland) Criminal Code, art. 321 (relayed text, in force as of 1 October 2026) and IAGP, threshold values 2024 and 2025 (350,000 francs).
• Public debate: canton of Vaud, minority report of the Grand Council committee (June 2026) and Netzwoche, SwissHDS (12 May 2026).
• EPR: Ordinance on the Electronic Patient Record (art. 12, para. 5, status as of 1 October 2024) and FOPH, law on the electronic health record (data kept in Switzerland, 2030 at the earliest).
• French framework: CMS, new HDS framework (order of 26 April 2024, published on 16 May 2024).
• Galeon: HDS certification, what it covers and health data hosting, the Galeon x Scaleway partnership.
• Galeon: which EHR to choose to feed the EPR in Switzerland and EHR tenders, the evaluation grid.

‍