The verdict in three sentences
As soon as an application stores health data for patients or clinicians, Europe treats it as a special category of data, and in France hosting with an HDS-certified provider is mandatory regardless of size. For a health centre, recurring hosting runs EUR 300 to 1,500 a month, plus a DPIA of EUR 3,000 to 8,000 and technical requirements (encryption, access logging, backups). In the UK, the equivalent gate is the NHS Data Security and Protection Toolkit (DSPT) for anyone handling NHS patient data, and non-compliance can cost up to 4% of global turnover under GDPR and UK GDPR.
What compliant health data hosting costs in 2026
Price depends on volume (patients, attachments, imaging), service level and the certified scope of the host. Figures below are for HDS hosting in France.
| App profile | Typical resources | Monthly budget 2026 | Example use |
|---|---|---|---|
| Small app, under 5,000 patients | 2 vCPU, 4 GB RAM, 100 GB | EUR 300 to 500 | appointments, questionnaires |
| Health centre, 5,000 to 30,000 patients | 4 vCPU, 16 GB RAM, 500 GB | EUR 600 to 1,000 | patient follow-up, reports |
| Multi-site or heavy documents | 8 vCPU, 32 GB RAM, 2 TB | EUR 1,000 to 1,500 | teleconsultation, large attachments |
| Managed HDS operations (24/7 monitoring) | extra | EUR 400 to 1,200 | on-call, security patching |
| Externalised HDS backups | extra | EUR 50 to 200 | 30 to 90 day retention |
| Disaster recovery plan | extra | EUR 200 to 600 | certified secondary site |
These amounts are a 2026 order of magnitude. Always check that the host's certificate covers the activities you need: physical infrastructure only, or managed services and backup as well.
Obligations to budget on top of hosting
| Obligation | What it involves | 2026 budget | Frequency |
|---|---|---|---|
| DPIA (impact assessment) | data mapping, risks, measures | EUR 3,000 to 8,000 | before go-live, yearly review |
| Encryption | data at rest and in transit, key management | EUR 1,500 to 4,000 | at design stage |
| Access logging | who opened which record and when | EUR 2,000 to 5,000 | at design stage, logs retained |
| Strong clinician authentication | MFA or national health ID (Pro Santé Connect in France, NHS login or Care Identity in the UK) | EUR 2,500 to 6,000 | at design stage |
| Records and patient information | GDPR records, notices, rights handling | EUR 1,000 to 2,500 | at design stage, ongoing |
| Pre-launch pentest | grey-box penetration test | EUR 5,000 to 12,000 | before go-live, then yearly |
The HDS framework version 2, in force since 2024, also requires data to be hosted within the European Economic Area and third-country access risks to be documented. In the UK, the DSPT is a yearly self-assessment covering similar controls, and NHS buyers often add Cyber Essentials Plus and the DTAC assessment to their tenders.
How to structure the project
- Classify the data: a simple booking form without medical reason does not carry the same requirements as a follow-up record with clinical reports.
- Pick the host before building: OVHcloud, Scaleway, Outscale or a health-specialised host in France; in the UK, a host able to support your DSPT evidence.
- Separate environments: staging must never contain real patient data.
- Contract properly: HDS-compliant hosting contract in France, GDPR processor agreement, reversibility.
- Appoint a DPO: mandatory for large-scale processing of health data.
Mini case study
Dr Sophie Martin, director of a 22-practitioner multidisciplinary health centre in Marseille, launches a follow-up app for 12,000 patients (diabetes and rehabilitation programmes). Compliance budget: DPIA EUR 5,000, encryption and logging EUR 6,000, Pro Santé Connect for clinicians EUR 4,000, pentest EUR 7,000. Initial total: EUR 22,000.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Recurring: HDS hosting EUR 800 a month, managed operations EUR 600, backups EUR 100, i.e. EUR 1,500 a month or EUR 18,000 a year. Across 12,000 patients, that is EUR 1.50 per patient per year. On the other side, a CNIL fine for a centre with EUR 3 million turnover could reach EUR 120,000, before counting service suspension.
FAQ
Can a small practice skip a certified host?
In France, no: the obligation applies as soon as a third party hosts health data collected during prevention, diagnosis or care, whatever the size. Entry-level offers start around EUR 300 a month.
What is the difference between HDS and GDPR?
GDPR governs any processing of personal data, while HDS certification applies specifically to the host of health data in France. You need both: DPIA, records and patient rights on one side, certified host on the other.
What applies in the UK?
UK GDPR plus the NHS DSPT if you process NHS patient data, often with Cyber Essentials Plus and DTAC in tenders. There is no HDS-style host certification, but hosting choices must be justified in your DSPT evidence.
How long does compliance take?
Allow 6 to 10 weeks between choosing the host, the DPIA, security development and the pentest. The DPIA alone takes 2 to 4 weeks.
What are the penalties?
Regulators can fine up to 4% of global turnover or EUR 20 million under GDPR. The French CNIL has sanctioned several health players in recent years for security failures.
Let's scope your project. Describe your app, patient volume and the data processed: we will price compliant hosting, the DPIA and security development with a compliance timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
