TLDR : The Health Data Hub, a platform for health data, currently hosted by Microsoft Azure, needs to migrate to a European cloud host by the end of 2022 to comply with GDPR and the 2024 SREN law. However, due to technical challenges, this move is delayed until summer 2026, with candidates like OVHcloud, Outscale, and Scaleway stepping up.
On July 1st, during a special Strategic Committee meeting, Yannick Neuder, Minister in charge of Health and Access to Care, presented the "Artificial Intelligence and Health Data" strategy, one of the main focuses of which is the secondary use of health data. It was on this occasion that a call for tenders was launched for the sovereign hosting of the copy of the National Health Data System (SNDS).
Created in 2019, the Health Data Hub (HDH) is a public interest group whose mission is to facilitate secure access to health data for research, evaluation, or the development of innovative solutions. The platform allows the cross-referencing of multiple sources, including the SNDS, hospital databases, and data from general practice, within a strict framework combining anonymization, traceability, and scientific evaluation of projects.
The Ministry of Health and Prevention and the CNIL originally favored a European cloud host, but the ministry considered that there were no operational European solutions before 2025 and chose Microsoft Azure without a call for tenders, which sparked a heated controversy.
The CNIL quickly expressed concerns about the risk of data transfer to the United States: the Cloud Act, enacted on March 23, 2018, by Donald Trump, allows U.S. authorities to demand access to data held by companies under U.S. jurisdiction, even if they are stored outside the United States.
In October 2020, several associations, health professionals, and researchers seized the Council of State, arguing that the operation of the Health Data Hub violated the GDPR. While acknowledging a risk of data transfer to the United States, the high court demanded additional guarantees but maintained the platform's operation due to its role deemed essential in managing the health crisis.
Today, it is still hosted on Azure despite the government's commitment to repatriate the data to a European platform by the end of 2022. This delay is partly due to the technical complexity of the migration: the volume and sensitivity of the data require high levels of security, confidentiality, and availability while ensuring continuity of service for public sector and research users.
The SREN law (Securing and Regulating the Digital Space), adopted in 2024, requires public and private operators processing sensitive data to use cloud providers offering sovereignty guarantees and to ensure that neither the data nor their processing can be transferred or accessed from a third country outside the European legal framework. The Health Data Hub will thus need to migrate to a qualified cloud. Among the credible candidates to succeed Azure: OVHcloud, Outscale, NumSpot, Scaleway, or Cloud Temple. The new sovereign environment is scheduled to be operational by summer 2026.
Clara Chappaz, Minister of State for Artificial Intelligence and Digital Affairs, emphasizes:
"Artificial intelligence in health holds immense prospects for better care. But it can only fulfill its promises by protecting the sensitive data that feeds it. The migration of the health data platform (Health Data Hub) to sovereign hosting is a decisive step forward."