How should I proceed in order to get a HDS certification for my Azure Database for MySQL flexible server?

Cécile Robert 20 Reputation points
2023-10-18T18:19:49.4766667+00:00

Hello

I am using a Azure Database for MySQL flexible server for my application that is deployed on Azure App Service. I recently heard about the HDS (hébergement des données de santé) in France and I want to obtain it for my database. Reading the Microsoft Documentation, it is not clear the way of achieving this goal. Please provide a step by step guide to add this certification on my Azure Database for MySQL flexible server ressource.

Thank you!

Azure Database for MySQL
Azure App Service
Azure App Service

Azure App Service is a service used to create and deploy scalable, mission-critical web apps.

Answer accepted by question author
GeethaThatipatri-MSFT 29,522 Reputation points Moderator
2023-11-02T14:51:38.5266667+00:00

@Cécile Robert Please review this public documentation - Health Data Hosting (HDS) France - Microsoft Compliance | Microsoft Learn

 In this document, there are two key sections that I believe you should share with the customer.  They relate to which Data Centers must be used and how the customer should implement to be HDS compliant.

 The Microsoft – in-scope cloud platforms & services section Health Data Hosting (HDS) France - Microsoft Compliance | Microsoft Learn states

The HDS certificate applies to Azure services listed as compliant with the ISO/IEC 27001 standard in Azure Compliance offerings and provisioned in the following regions:

o   France Central (Paris)

o   France South (Marseille)

o   North Europe (Ireland)

o   West Europe (Netherlands)

 How to implement section Health Data Hosting (HDS) France - Microsoft Compliance | Microsoft Learn states

Contractual terms: The French Public Health Code requires the execution of specific contractual terms between the health data hosting service or cloud service provider and its customers. Eligible customers must reach out to their Microsoft licensing point of contact to enter into these specific contractual terms before hosting health personal data on Microsoft online services.

Health and life sciences: Case overviews, solution guides, tutorials, and other resources to help build Azure solutions.

Regards

Geetha

Was this answer helpful?

0 comments

3 additional answers

Sort by: Newest
Most helpful Newest Oldest
  1. Cécile Robert 20 Reputation points
    2023-11-02T15:07:38.3133333+00:00

    Hi Geetha

    I'll be more than happy to reach out to my "Microsoft licensing point of contact" but I have none.

    We are a startup and we have benefited Azure credits from Microsoft but we do not have any sales person to speak. If you could tell me to whom I can talk about this, it would be great!

    Thank you!

    Cécile

    Was this answer helpful?

    0 comments
  2. Cécile Robert 20 Reputation points
    2023-10-25T15:45:14.96+00:00

    Hi Geetha

    I know very well that Microsoft Azure is compliant to the HDS requirements.

    We have recently migrated our database on Azure. All of your Azure clients do not have the HDS type of hosting, because it is needed only for health data. We do collect health data, which is why we need to have this kind of hosting services. How to proceed to have the HDS hosting with Azure please? Is it a kind of option to activate or is there something more technical to perform to benefit from this service? I will need also the technical documentation to be able to give more info to my customers regarding the capabilities of hosting.

    Many thanks for your help.

    Was this answer helpful?

    0 comments
  3. GeethaThatipatri-MSFT 29,522 Reputation points Moderator
    2023-10-24T21:21:40.2466667+00:00

    @Cécile Robert Our documentation has this to say about the compliance of our services with HDS:

    Microsoft Azure, Microsoft Dynamics 365, and Microsoft Office 365 have been granted the Health Data Hosting (Hébergeurs de Données de Santé, HDS) certification, which is required for all entities hosting personal health data governed by French law. This made Microsoft the first major cloud service provider to meet the strict French standards for storing and processing health data. This certification, required by the revision to the 2018 French Public Health Code, imposes advanced security and privacy requirements on hosting services and cloud providers to ensure that the confidentiality and integrity of sensitive data are adequately protected.

    Microsoft's compliance with the HDS requirements has been audited and certified by the BSI Group, an independent certifying body accredited by French authorities to conduct HDS audits.

    This means you can rest assured that MySQL and how we manage it comply with all of the requirements of HDS.

    So this takes care of the backend problem. Since obtaining compliance is a shared responsibility, the customer will need to figure out what he should do on the application side, the stuff they manage and which is out of our control in order to comply. 

    I am unable to offer guidance on its implications; this is typically the domain of third-party auditors and consultants.

    Azure provides general guidelines for how you should secure your assets which are here: Security design principles - Microsoft Azure Well-Architected Framework | Microsoft Learn

    However, each compliance standard is different and covers way more then turning on a firewall or provisioning RBAC such as training for employees, physical security of rooms and computers at the customer site, etc.

    I hope this information helps.

    Regards

    Geetha

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.