All the rules are set out in the HDS certification – Accreditation reference system and the COFRAC’s "Exigences spécifiques pour l’accréditation des organismes procédant à la certification de systèmes de management dans le domaine des technologies de l’information" (Specific requirements for structures that certify management systems in the information technology sector), available in our Documentation section.

To find out more about the list of certified and accredited bodies, click on the links below.

There are 6 types of activities that make you eligible as a health data host:

1. providing and monitoring the operations of a physical site that hosts the material infrastructure of the IS used to treat health data;
2. providing and maintaining the structural material used by the IS to host health data;
3. providing and maintaining a platform that hosts the IS applications;
4. providing and maintaining a digital structure for the IS which hosts health data;
5. the administration and exploitation of the IS which contains the health data;
6. health data backup services.

The full list of HDS-certified activities is available here: 

Le Centre de Gestion des Terminologies de Santé a donc pour mission de se charger de cette maîtrise d’ouvrage opérationnelle des ressources sémantiques, mais aussi du guichet national de publication, ainsi que de l’accompagnement des utilisateurs. En France, le CGTS regroupe à date au sein de son catalogue 34 Terminologies couvrant un grand nombre de domaines médicaux.

In order to request test products for certificates (CPS cards and test software certificates) issued by the IGC-Santé, go to our service page for the IGC-Santé.

The evaluation is done in two phases. It is conducted by the certifying body, which must verify the compliance with the certification requirements set out in the HDS Certification document (available below).

The audit also verifies the specific requirements for health data hosting are being met. 

A terminology is an ensemble of concepts defined by terms which belong to a specific language set. 

Terminologies are defined through a research process aimed at finding the most relevant terms used by a specific profession (or a field of expertise) in a particular context of use. 

Centralising and monitoring this vocabulary is essential to maintain a coherent use of the terms amongst eHealth experts and healthcare professionals.

It is compulsory to have an individual CPx-type card to log in to the INSi teleservice. Three types of cards are supported: CPS, CPE, CPF. 

CPx cards issued before December 2020 have a contactless chip that prevents from overwriting its code.

The new CPS R3V3 cards that are now in circulation have a Mifare Desfire chip. These cards can stock crypto-secret keys that work with the Mifare Desfire protocol.

All the information about this feature is available in the Manual to deploy contactless CPx cards (available to download below). One must be cautious about the data inserted in the chip’s writing code.

We strongly advise against using this section of the chip to stock access rights. The ANS recommends you to use the ANSSI guidelines on using a "transparent" reader in connected mode. This does not involve a cryptographic protocol during a badge authentication – only the UTL (logic treatment unit) takes part in the cryptographic protocol.

ANSSI advises against setting up a “smart” badge allowing a double authentication breaking from the UTL.

All the recommendations on securing systems for physical access and video projection are available in the document below, "Recommendations on securing systems for physical and video projection access".

The digital transition in France involves much more health data transfers. It is essential to set up a common language in this ecosystem, which currently lacks homogeneity at a local and international scale. The CGTS was created by the State to centralise the semantic resources for health professionals.

The certificates that the ANS issues are an official means to identify the players of the health sector, persons and organisations. Certificates also act as a seal of quality, making sure that the issuing cryptographic key infrastructures (CKP) are conform to the sector’s best practice standards. Certificates can be revoked in case of failure to comply.

No, a person may only have one e-CPS card at a time.

The national ID is:

• One the first line of your CPx-type card
• Add “8” before your RPPS ID, for example 81234567890
• Add “0” before your ADELI ID, for example 01234567890

The CPS card and e-CPS are two complementary means of authentication. A person may use both at the same time, or one or the other according to their preference.

The ANS offers 4 types of software certificates:

• Legal person (Organisation)
• Legal person (Server)
• Natural person (Professional)
• Natural person (Health Professional)

This midware allows the interfacing between computer applications, such as the Vivoptim doctors portal and the CPS card.