The verdict in three sentences
As soon as a form on your website collects a reason for consultation, a medical history or a prescription, you are hosting health data and, for French patients, HDS-certified hosting is no longer optional. For a healthcare website with online booking, 150 to 350 EUR per month covers most needs, with the 600 EUR upper bound reserved for a redundant two-zone architecture. A SecNumCloud option is only justified if your organisation is a sensitive operator or a public tender requires it.
What HDS certification really covers in 2026
The HDS v2 framework, published in 2024, is now aligned with ISO 27001 and requires health data to be stored inside the European Economic Area. Hosts certified under the previous framework must have moved to v2 by the end of 2026: check the certificate date before you sign. Across Europe, other portals rely on ISO 27001 plus national rules (C5 in Germany, NEN 7510 in the Netherlands), but HDS remains the strictest benchmark.
Certification covers six distinct activities. A host can be certified for physical infrastructure without being certified for managed services or backup. Ask for the exact scope of the certificate, not just the logo.
| HDS activity | What it covers | Required for a booking website? |
|---|---|---|
| 1. Physical premises | Data centre, access control | Yes |
| 2. Hardware infrastructure | Servers, network, storage | Yes |
| 3. Virtual infrastructure | Hypervisor, virtual machines | Yes |
| 4. Hosting platform | OS, managed database | Yes if managed database |
| 5. Administration and operations | Managed services, patching | Yes if managed |
| 6. Off-site backup | Encrypted off-site copies | Yes |
GDPR obligations come on top: an Article 28 data processing agreement, a record of processing activities, a DPIA when health data is processed at scale, and encrypted backups with keys under your control.
Comparison of HDS offers for a healthcare website
The prices below are 2026 orders of magnitude taken from public price lists and typical quotes, excluding application management.
| Configuration | OVHcloud | Scaleway | Outscale |
|---|---|---|---|
| Single HDS instance + managed database | 80 to 150 EUR/month | 90 to 160 EUR/month | 150 to 250 EUR/month |
| Two instances + load balancer | 200 to 350 EUR/month | 220 to 380 EUR/month | 300 to 450 EUR/month |
| Multi-zone redundancy + 30-day backup | 400 to 600 EUR/month | 400 to 580 EUR/month | 500 to 700 EUR/month |
| SecNumCloud qualification | Yes, dedicated ranges | In progress on some ranges | Yes |
| Observed SecNumCloud premium | +25 to 40% | Not applicable yet | +20 to 30% |
| 24/7 support in French | Paid depending on tier | Paid depending on tier | Included on enterprise offers |
Three criteria usually decide between these offers. First, reversibility: require a full export of data and backups in a standard format, with a contractual deadline. Second, where the administration teams are located, which determines exposure to extraterritorial laws. Third, the guaranteed RPO and RTO: losing 24 hours of appointments is expensive to reschedule. AWS, Azure and Google Cloud offer ISO 27001 and HDS-certified French regions at comparable prices, but none is SecNumCloud-qualified.
Recommended architecture by organisation size
| Profile | Monthly traffic | Architecture | Monthly hosting budget |
|---|---|---|---|
| Group practice, 5 practitioners | 3,000 visits | Static site + form sent to HDS instance | 80 to 150 EUR |
| Health centre, 20 practitioners | 15,000 visits | HDS instance + managed database + backup | 150 to 250 EUR |
| Private clinic, 120 beds | 40,000 visits | Two instances + load balancer + WAF | 250 to 400 EUR |
| Multi-site hospital group | 150,000 visits | Multi-zone, tested DRP, SIEM | 400 to 600 EUR and up |
| Organisation subject to SecNumCloud | Variable | Dedicated qualified range | +20 to 40% on the matching line |
One trick cuts the bill: separate the public showcase, hosted on fast standard infrastructure, from the booking module and forms, which alone require the HDS scope. Only health data needs to live on the certified environment.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Isabelle, CIO of a 90-bed private clinic in Nantes, receives two proposals. The first hosts the whole site on a redundant HDS architecture at 480 EUR per month, or 5,760 EUR per year. The second puts the showcase on standard hosting at 40 EUR per month and isolates the booking module and forms on two HDS instances at 260 EUR per month, or 3,600 EUR per year in total.
The gap is 2,160 EUR per year, about 10,800 EUR over five years, with no loss of compliance since health data stays inside the certified scope. Isabelle adds a 1,500 EUR line for the DPIA and the processing record update, and picks the second option.
FAQ
Does a simple contact form require HDS hosting?
If the form invites patients to describe symptoms or a medical reason, yes, because you are collecting health data. A form limited to name, phone and department is not covered, but the line is thin. Restricting the fields costs less than paying 150 EUR more per month for HDS hosting.
Can we use AWS, Azure or Google Cloud?
All three have HDS-certified regions in France. Their cost is comparable, between 120 and 500 EUR per month for these architectures, but they are not SecNumCloud-qualified and remain subject to US law.
How long does it take to migrate an existing website to an HDS host?
Plan 3 to 6 weeks for a healthcare website: flow audit, configuration, backup tests and cutover. Migration budgets usually fall between 3,000 and 9,000 EUR excluding VAT depending on the existing stack.
What is the risk without HDS hosting?
Article L.1111-8 of the French Public Health Code provides for up to 3 years in prison and a 45,000 EUR fine, on top of GDPR penalties of up to 4% of annual turnover.
Does booking through Doctolib remove the HDS requirement?
Yes for the data processed by that platform, which is already HDS-hosted. Your website remains in scope if other forms collect medical information.
Let's scope your project. Send us your website scope, forms and appointment volume, and we will price the right HDS architecture and the build with a realistic timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
