HDS Certification in France: What It Covers for Medical Phone Calls

HDS certification (hébergeur de données de santé) is the French certification required of any provider that hosts personal health data on behalf of a healthcare professional, a facility or a patient. For a medical practice, the question is rarely whether the practice itself needs it. The question is whether the providers handling its calls, recordings, voicemail and appointment data are certified where hosting is involved, and whether the practice collects no more than it needs in the first place.

Key takeaways

• HDS certification applies to the hosting of personal health data for third parties, not to every business that answers a telephone. What matters is whether a provider stores or hosts health data on behalf of a practice.
• The v2 framework published in 2024 tightens sovereignty requirements: hosted health data must be located in the European Economic Area, with transparency on the risk of access from outside the EU/EEA.
• Data minimization applies before any hosting question: a call should capture only the information needed for scheduling, triage or the medical file.
• Recordings, transcripts and call logs need a defined purpose, restricted access and a documented retention period.
• A practice should ask any call-handling provider for its certificate scope, its processing role and the list of its subcontractors.

Table of Contents

• What HDS certification is and who it concerns
• The six hosting activities covered
• What changed with the v2 framework
• When phone data counts as health data
• Data minimization on the phone
• Recording calls: the limits
• What a practice should check in a call-handling provider
• Our perspective
• How ClicFone supports practices
• FAQ
• Sources

What HDS certification is and who it concerns

French law makes hosting of health data a regulated activity. The framework applies to any person providing all or part of a hosting service for personal health data collected during prevention, diagnosis, care, or social and medico-social follow-up, when that person acts as a processor under the GDPR (HDS v2 certification framework). The legal basis is Article L1111-8 of the Public Health Code, which also binds hosts, and the persons under their authority who access the hosted data, to professional secrecy under Article 226-13 of the Penal Code (Légifrance).

Two consequences follow for a practice:

1. A practice that keeps its own records on its own equipment is not a host in this sense. A company that stores or backs up those records on the practice’s behalf can be.
2. Responsibility remains shared. The practice, as data controller, chooses its processors, and the processors answer for what they host.

The six hosting activities covered

A certificate is not a general label. It covers one or several defined hosting activities, which the framework lists as six categories:

The list comes from the official framework. A telephone provider that relies on a cloud platform to store recordings or messages will usually depend on a certified host for one or more of these activities. The useful check is therefore the certificate scope of each link in the chain, not the mere mention of “HDS” on a website.

What changed with the v2 framework

The second version of the framework, issued in 2024, replaced the 2018 version and added stricter sovereignty requirements. Health data must be located within the European Economic Area, and hosts must be more transparent about the risks of access from countries outside the EU/EEA (HDS v2 framework).

The transition schedule matters for providers. According to a law firm’s analysis, hosts certified under the earlier version had until May 2026 to align with v2, and the sovereignty obligations stemming from the 2026 decree take effect in September 2026 (Squire Patton Boggs). In late 2026, a certificate that still refers to the earlier version therefore deserves a direct question to the provider.

Two practical points on validity: certification is delivered by an accredited certification body, and the Agence du Numérique en Santé publishes the list of those bodies. Its list dated 9 March 2026 includes AFNOR Certification, accredited since 29 August 2019, and the page should be consulted directly because authorization status can change (ANS list of certification bodies).

When phone data counts as health data

A medical call is not only a voice. It produces several kinds of data, and their sensitivity differs:

• The content of the conversation: symptoms, a request for a prescription renewal, the reason for a consultation. This is health data in the ordinary sense.
• The appointment record: the identity of the patient, the practitioner and the specialty reveal something about a person’s health, even without the reason being stated.
• Voicemail and recordings: audio files that contain the above, often kept longer than intended.
• Transcripts and automated summaries: text derived from the audio, which can be searched and copied more easily.
• Call metadata: numbers, times and durations. Alone they are less revealing, but linked to a practitioner’s specialty they can become so.

The CNIL has not issued a single rule for each of these. It has, however, announced for 2026 work to clarify the conditions for using voice transcription and automated analysis tools, including in call centers (CNIL 2026 work programme). Until that guidance appears, the prudent approach is to treat stored recordings, voicemail and transcripts linked to identifiable patients as health data, and to ask whether their hosting falls under L1111-8. For a deeper look at provider obligations, the call analytics GDPR checklist for French clinics covers HDS and the Article 28 processor contract together.

Data minimization on the phone

Hosting rules apply only to what has been collected. Data minimization reduces that volume at the source, which is often the most effective compliance measure.

The CNIL’s reference framework for private practices states that liberal healthcare professionals should collect and use only data that is relevant and necessary for their own medical and administrative patient management, and should check necessity, relevance and quality throughout the processing (CNIL practice framework). The CNIL’s guidance on minimization adds that it must be designed before collection, documented, and applied especially strictly to health data, and that information should not be collected when the purpose can be reached without it (CNIL, Minimiser les données collectées).

Applied to a telephone reception, this translates into concrete rules:

1. Define what a secretary asks. For booking, name, a contact number and the type of appointment are generally sufficient. Clinical detail is gathered only where triage requires it.
2. Separate scheduling from clinical content. A message for the practitioner can say that a patient asks for a call back about a result without detailing the result.
3. Limit access by role. The CNIL’s telemedicine guidance requires differentiated permissions so that each user sees only the patient data strictly necessary for that role (CNIL telemedicine guidance).
4. Set retention by category. The CNIL recommends documenting retention periods by category and purpose, purging data automatically when they expire, and considering pseudonymization or anonymization when data remain useful (CNIL). The page on call log retention under CNIL rules details this for medical DPOs.
5. Keep conversations private. The joint CNIL and national medical council guide specifies that calls must not be overheard by nearby people, and that unsecured internet-connected communication applications should not be used to exchange patient information (CNIL and CNOM guide).

For written messages taken by a secretary, the guide to phone message documentation offers templates consistent with these principles. Tools that convert spoken exchanges into written records raise the same retention questions, as this overview of digital care records illustrates.

Recording calls: the limits

Recording is where minimization and hosting meet. The CNIL’s guidance on call recording sets several principles: recording must have a defined purpose, must not be permanent or systematic unless a legal text authorizes it, access must be restricted to the services concerned and secured through permissions and traceability, and recordings are normally kept no more than six months unless a specific legal requirement or justification applies (CNIL, call listening and recording). That guidance dates from 2009 and concerns the workplace in general, so it is a baseline rather than a specific rule for medical practices.

For a practice, the working consequences are:

• Record only if a precise purpose exists, such as quality training or proof of an urgent instruction, and inform callers at the start of the call.
• Do not keep audio indefinitely “just in case”.
• If audio is stored by a third party, identify who hosts it, where, and whether the hosting activity requires a certificate.

Two further resources deal with the technical side: encrypted call recording in healthcare and a five-step approach to secure call recording.

What a practice should check in a call-handling provider

A short verification routine avoids most problems. It can be done before signing, and repeated at each renewal.

1. Does the provider host health data at all? Ask what is stored (audio, transcripts, messages, appointment notes), for how long, and where.
2. If yes, who is the host and what does its certificate cover? The certificate should name the activities relevant to the service, and be issued by an accredited body. The ANS list is the reference for the bodies.
3. Which version of the framework applies? After the 2026 transition, v2 is the one to expect.
4. Where is the data located? The v2 sovereignty requirements place hosted health data in the EEA.
5. What is the provider’s role? As a processor, it needs a written contract under Article 28 of the GDPR, which lists subcontractors and their obligations.
6. Who has access, and are they bound by secrecy? Staff handling data must be under confidentiality obligations, in line with Article 226-13 of the Penal Code for hosts. See the page on confidentiality agreements for medical secretaries.
7. Has an impact assessment been considered? Large-scale processing of sensitive data, notably with automated tools, may call for a data protection impact assessment. The guide to privacy impact assessments for calls explains how to avoid delays with the CNIL.

The broader obligations of confidentiality at the point of contact are summarized in patient call confidentiality rules for French practices.

Our perspective

After more than 15 years in medical telephone answering, we see the same misunderstanding repeated: practices ask whether a provider is “HDS” as if it were a single yes-or-no label. In our experience, the more useful discussion has three parts: what data the call actually produces, how little of it needs to be kept, and which links in the chain host it.

We therefore work from the principle that the best protected data is data that was never collected. A secretary trained for healthcare knows which questions serve the booking and which belong to the practitioner. Human operators who are specifically trained for the medical sector, supported by AI for out-of-hours coverage, can follow a defined script, record what is necessary in the practitioner’s calendar and leave clinical detail to the clinician. The telephone then acts as an intelligent filter: it qualifies the request, directs urgency correctly and passes on only what the practice needs.

We also encourage practices to document their choices. A short record of what is collected by phone, who can see it, where it is stored and when it is deleted is more convincing, to a patient or to the CNIL, than any badge.

— Rudolph Thierry

How ClicFone supports practices

ClicFone provides outsourced telephone answering for doctors, specialists, paramedical professionals and group practices, with trained operators and AI support available around the clock. The service synchronizes with Doctolib, LibreRDV, Maiia and CalenDoc, so appointments are written directly into the practice’s own calendar rather than into a separate tool.

Practices that want to see how this works in daily use can start with remote telephone secretarial service, or read how medical phone triage separates urgent from routine requests. Questions about the data handled and its hosting can be raised directly with the team before any commitment, through the ClicFone website.

FAQ

Is HDS certification mandatory for a doctor’s practice?

Not for the practice itself when it keeps its data on its own equipment. The obligation falls on providers who host health data on behalf of others, under Article L1111-8 of the Public Health Code. A practice should, however, verify that any such provider it uses holds a valid certificate for the relevant activities.

How can a certificate be verified?

The certificate names its scope, meaning the hosting activities covered, and the certification body that issued it. The body itself can be checked against the list published by the Agence du Numérique en Santé. Requesting the certificate and confirming that it refers to the v2 framework is a reasonable step in late 2026.

Does HDS certification apply to call recordings?

It can, when recordings or transcripts containing identifiable patient information are stored by a third party on the practice’s behalf. The CNIL has announced further work on voice transcription tools for 2026, so the position may become more precise. Independently of hosting, recording needs a defined purpose and a limited retention period.

What does data minimization mean for a medical secretary?

It means collecting only what is needed to schedule, direct or transmit a request: identity, contact details, appointment type and, for triage, the elements necessary to assess urgency. Detailed clinical information stays in the medical file, under the practitioner’s responsibility.

Does a telephone answering provider need to be HDS-certified?

Not automatically. It depends on whether the provider, or its subcontractors, host health data for the practice. If they do, the hosting activity must be covered by a certificate, and the contract must set out roles and subcontractors.

Sources

• HDS certification framework v2 (Agence du Numérique en Santé)
• Article L1111-8, Public Health Code (Légifrance)
• List of HDS certification bodies (ANS)
• Squire Patton Boggs: HDS compliance deadline under the new framework
• CNIL 2026 work programme
• CNIL framework for private practices
• CNIL: Minimiser les données collectées
• CNIL: telemedicine and patient data
• CNIL and CNOM practical guide
• CNIL: call listening and recording at work

Recommended

• Encrypted Call Recording in Healthcare: The French Rules
• HDS, Art. 28 and CNIL Checklist for Midwife Phone Coverage in France
• Secure Call Transfer for Medical Practices in France
• 3 GDPR Steps French Clinics Must Take for Medical Calls

LibreRDV-ClicFone Télésecrétariat

ClicFone Télésecrétariat depuis 2010 au service des professionnels de la santé. Permanence téléphonique 7h/20h. Secrétariat téléphonique à distance pour médecins, paramédicaux ou autres praticiens de la santé. Secrétariat humain, empathique et formé aux agendas Doctolib, Maiia, CalenDoc ou LibreRDV mais aussi synchronisé avec Google Agenda, Calendly et Cal.com

See Full Bio

CalenDoc Doctolib Maiia LibreRDV ClicFone Télésecretariat Secretariat téléphonique Permanence téléphonique Médical