All the rules are set out in the HDS certification – Accreditation reference system and the COFRAC’s "Exigences spécifiques pour l’accréditation des organismes procédant à la certification de systèmes de management dans le domaine des technologies de l’information" (Specific requirements for structures that certify management systems in the information technology sector), available in our Documentation section.

To find out more about the list of certified and accredited bodies, click on the links below.

There are 6 types of activities that make you eligible as a health data host:

1. providing and monitoring the operations of a physical site that hosts the material infrastructure of the IS used to treat health data;
2. providing and maintaining the structural material used by the IS to host health data;
3. providing and maintaining a platform that hosts the IS applications;
4. providing and maintaining a digital structure for the IS which hosts health data;
5. the administration and exploitation of the IS which contains the health data;
6. health data backup services.

The full list of HDS-certified activities is available here: 

The cost is determined by the certifying body which grants the certificate.

The daily cost to conduct the audits is at their discretion. The industrial is free to choose which certifying body they want to work with to become certified.

For further information on this topic, we suggest you contact the certifying bodies that have signed a convention agreement with the ANS, listed below:

The evaluation is done in two phases. It is conducted by the certifying body, which must verify the compliance with the certification requirements set out in the HDS Certification document (available below).

The audit also verifies the specific requirements for health data hosting are being met. 

Your application needs to be complete and signed, with all the following documents:

• the MDPH label rules, which describes the labelling process  
• the convention regarding the use of the label, which defines the procedures that take place after the label is granted. For example: obligations tied to the label, audit visits, cases of modifying the label, etc. 
• the annexes to the convention; 
• the license of use for the labelled solution; 
• the insurance security plan for the conformity checks relating to the MDPH label; 
• if applicable, the decisions issued by partner organisations dealing with exchange fluxes (CNAF/SNGI, Imprimerie Nationale, etc.) to attest you are using the correct one. 

The application must be sent in paper AND via electronic mail to: 

Agence du Numérique en Santé 
Labellisation logiciels Maisons Départementales des Personnes Handicapées 
9 rue Georges Pitard 75015 Paris 

labellisation.mdph@esante.gouv.fr 

These documents are made available by the CNDA as a .zip file below.

Generally speaking, the PGSSI-S needs to be applied as soon as personal health data are being handled. It is relevant to the public sector as well as the private sector, health professionals, workers of the social-health and social sectors, healthcare establishments and service providers. 

As a patient, the PGSSI-S is a seal of guarantee on the accountability of digital health ecosystems.

Complying with the PGSSI-S frames of reference is either required by law (if the documents have been approved by a ministerial decree) or meant to be followed on a short-term basis until the documents are approved by the ministry.

The application for the SI-MDPH label is open to any legal entity with a software solution aimed at the departmental disability centres (MDPHs). This includes the MDPHs themselves, which develop their own solutions in conjunction with the relevant Departmental Council.  

The label application is a voluntary process: Anyone can be a candidate if they feel that their solution complies with the current requirements and the scope of the sector’s functional standards.

Yes, you need to have the ISO 9001 or the ISO 13485 certification to be eligible. You may begin the QHN certification process while you are in the course of making an application for/or renewing these ISO 9001 or the ISO 13485 certifications.

Yes, as long as the industrial remains responsible for the compliance of these processes with the requirements set out to obtain the QHN certification – regardless of hired external contractors or if some of the components are published or made by third-party companies.

Indeed, in the whole production system’s organisation, the industrial is the direct contact with a health professional or structure, and must make sure each requirement set out in the “Référentiel Qualité Hôpital Numérique” (QHN Referential, available in our Documentation section) is met.