The verdict in three sentences
Any application that stores health data on behalf of patients or professionals in France must be hosted by an HDS-certified provider, at 150 to 1,500 EUR a month in 2026 depending on architecture. Migrating from a non-certified cloud costs 5,000 to 15,000 EUR and takes 4 to 8 weeks, security work included. Under the revised HDS framework, applicable to all certified hosts from May 2026, data must stay within the European Economic Area, which rules out the US or UK setups many foreign vendors start with.
How HDS compares with what you already know
For a vendor coming from the US, UK or Canada, HDS is not a copy of familiar frameworks. The table below compares the key requirements a foreign health app meets when it enters France.
| Requirement | France (HDS + GDPR) | United States (HIPAA) | United Kingdom (DSPT) | Impact for a foreign vendor |
|---|---|---|---|---|
| Hosting certification | Mandatory HDS certificate for the host | No certification, BAA contract | DSPT self-assessment for NHS suppliers | Re-host or pick a certified EU region |
| Data location | EEA only (2024 framework) | No restriction | UK preferred for NHS | US-only infrastructure is excluded |
| Security framework | PGSSI-S, ISO 27001 for the host | HIPAA Security Rule | NHS DSPT, Cyber Essentials | Gap analysis needed |
| Strong authentication | MFA, Pro Santé Connect for French clinicians | Recommended | NHS login / smartcard | Extra integration work |
| Access logging | Mandatory traceability of who accessed what | Required audit controls | Required | Usually already partly in place |
| Maximum fine | 4% of global turnover or 20 M EUR (CNIL) | Up to about 2.1 M USD per violation category per year | Up to 4% of turnover (ICO) | Same order of magnitude as GDPR |
What HDS hosting costs by architecture
Monthly price depends on service level: raw infrastructure (you manage servers and OS), managed hosting (the provider administers) or managed platform. Figures below apply to certified French or European hosts.
| Architecture | Typical use | Monthly cost (EUR) | Included | Still your responsibility |
|---|---|---|---|---|
| Single HDS-certified VM | MVP, under 1,000 patients | 150 - 300 | Physical and virtual infrastructure | OS, backups, monitoring |
| 2 VMs + managed database | Telehealth app for SMEs | 300 - 600 | Managed database, backups | App hardening, logs |
| Managed Kubernetes HDS | Multi-site SaaS | 600 - 1,200 | Orchestration, high availability | Deployments, app monitoring |
| Fully managed HDS hosting | Vendor without an ops team | 900 - 1,500 | 24/7 administration, patching, DR | Application code |
| HDS-certified hyperscaler (EU region) | Stack already on AWS, Azure or GCP | 400 - 1,500 | Certified managed services | Compliant configuration, HDS contract |
| Option: DR in a second data centre | All critical profiles | + 100 - 400 | Replication and recovery tests | Procedures and drills |
A common mistake: an HDS-certified hyperscaler does not make your app compliant. Only the services listed in the certification scope, correctly configured, are.
Migration project budget
Entry cost combines technical migration and the measures required by the PGSSI-S (French health information security policy) and GDPR: data mapping (1,500 to 3,000 EUR), infrastructure migration (2,500 to 6,000 EUR), access logging (1,500 to 3,500 EUR), strong authentication including Pro Santé Connect if needed (1,500 to 4,000 EUR), encryption and tested backups (800 to 2,000 EUR), GDPR documentation with DPIA and HDS processing contract (1,000 to 2,500 EUR). For a mid-sized app, the total lands around 9,000 to 12,000 EUR. An annual pentest (4,000 to 10,000 EUR) is strongly recommended, especially to be listed by French hospitals.
Mini case study
Emily, founder of a London post-operative follow-up app, runs on a non-certified US cloud region for 260 EUR a month. A clinic group in Bordeaux ready to sign for 36,000 EUR a year requires HDS. Migration and compliance: 11,500 EUR. New hosting on managed Kubernetes HDS in Paris: 750 EUR a month, 490 EUR more than today, so 5,880 EUR a year. First-year cost: 17,380 EUR, about 48% of the first contract alone. From the second French client onward, hosting drops to roughly 9% of the app's French revenue.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Does a wellness app need HDS?
If it only collects fitness data (steps, sleep) with no medical purpose, generally not. As soon as a health professional is involved or a diagnosis is at stake, HDS applies.
Can we keep AWS, Azure or Google Cloud?
Yes, they are HDS-certified for certain European regions and services. However, French public hospitals increasingly ask for hosts subject to EU law only.
Does the vendor itself need HDS certification?
No, if hosting is delegated to a certified host. Getting certified yourself costs 30,000 to 80,000 EUR and 9 to 12 months.
Is HIPAA compliance accepted in France?
No. HIPAA work helps with logging and access control, but it does not replace the HDS certificate or the EEA location requirement.
How long does a migration take?
Allow 4 weeks for a simple app and 8 weeks for a multi-service architecture, testing included.
Let's scope your project. Describe your application, data and target clients in France: we will price the HDS migration and compliance work in the 5,000 to 15,000 EUR range, with a 4 to 8 week plan. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
