See Galeon for real
Checklist · CIOs and IT leads
HDS Compliance 2026: The Decision-Makers' Checklist
The points to check before signing with a host or an EHR vendor, to keep your health data secure.
- Written by Galeon, the EHR of 19 hospitals in France
- PDF format, ready to share with your teams
- Free, a 5-minute read
Flip through the guide
What’s inside.
HDS certification is mandatory for hosting health data. This condensed checklist reviews the control points (certification scope, HDS vs GDPR, data location, reversibility, subcontractors) to secure your decisions before signing with a host or an EHR vendor.
- Why this checklist
- Check the exact scope
- Locate and secure the data
- The control points
- Recommendations for decision-makers
HDS compliance 2026
galeon.careContents
- 01Why this checklist
- 02Check the exact scope
- 03Locate and secure the data
- 04The control points
- 05Recommendations for decision-makers
Chapter 01
Why this checklist
3Chapter 02
Check the exact scope
4Chapter 03
Locate and secure the data
5Chapter 04
The control points
6Chapter 05
Recommendations for decision-makers
7Frequently asked questions
What we are asked about this.
What is HDS certification?
HDS (Health Data Hosting) is a mandatory French certification for hosting personal health data entrusted to a third party. It attests that the host meets a security and confidentiality framework covering several hosting activities.
What is the difference between HDS and GDPR?
HDS certification governs the hosting of health data ; GDPR governs its processing. The two are cumulative: using an HDS host does not exempt you from end to end GDPR compliance of your processing.
Is an HDS certified vendor certified across the whole chain?
Not necessarily. HDS certification can be partial: a host certified on infrastructure may not cover the application layer where your data lives. Read the certificate itself and check the exact scope of the activities covered.
Where should health data be located for sovereignty?
To limit exposure to extraterritorial laws, data is generally expected to be located and operated within the European Economic Area. Location is a point to clarify and to write into the contract.
Why is reversibility a key control point?
Reversibility ensures you can retrieve your data in a usable format and change provider without lock in. Without a clear reversibility clause, you risk technical and commercial dependence on your host or vendor.
All of Galeon’s guides.
HDS compliance, EHR migration, interoperability, clinical AI: practical resources for hospital decision-makers.