The Health Data Hub: at last a step toward digital sovereignty

This morning I was invited by France Culture to discuss the procedure launched by the government to find a new host for the Health Data Hub, the national health data platform. The radio format forces you to move fast, too fast. I don't even know whether the interview will air.

Yet I was unable to come back to several essential points: the exceptional value of this data, its strategic role for artificial intelligence, the very real legal issues tied to the American cloud, or what the announced migration concretely means, along with the notion of digital sovereignty.

This text is therefore a plain-spoken account of what is at stake.

What is the Health Data Hub?

The Health Data Hub (HDH) is a public platform created in 2019 to centralise, structure and make available, within a controlled framework, French health data for research, innovation and the steering of public policy.

It draws mainly on the Système National des Données de Santé (SNDS), which brings together in particular:

• reimbursement data from the Assurance maladie,
• hospitalisation data (PMSI),
• medical causes of death,
• and other medico-administrative sources.

In concrete terms, this covers nearly 99 % of the French population, or more than 67 million people.

What makes this database unique in the world is not only its volume (billions of records) but its quality: longitudinal, exhaustive, cleaned data, harmonised according to international standards and regularly updated. Few countries have such a level of historical depth at national scale.

The HDH is not a mere warehouse: it provides secure working environments, allowing researchers, hospitals, startups or public institutions to exploit the data without extracting it, within a controlled framework.

Why is health data a strategic asset?

In 2026, health data has become a major strategic asset for artificial intelligence. A reliable medical AI requires datasets that are:

• massive,
• representative,
• low in bias,
• and of high quality.

The SNDS ticks all these boxes.

This data makes it possible in particular to:

• detect cancers or chronic diseases early,
• optimise care pathways,
• analyse treatment side effects at large scale,
• model epidemics,
• develop personalised medicine.

The national AI and health strategy (2025-2028) rests largely on this asset. The PariSanté campus already brings together more than 1,300 players around this ecosystem. At European scale, the future European Health Data Space (EHDS) will rely directly on national databases like ours: Regulation (EU) 2025/327 entered into force on 26 March 2025, and its main provisions on the secondary use of data will apply in stages from March 2029.

This data is therefore not only a scientific tool. It is an economic, industrial and geopolitical lever.

Why is the choice of Microsoft Azure a problem?

When the HDH was created in 2019, the choice fell on Microsoft Azure. At the time, the argument put forward was the absence of a sufficiently mature European alternative. This choice immediately sparked controversy, and rightly so.

The problem is not "Microsoft is American", but the legal framework to which Microsoft is subject. As an American company, Microsoft is subject to the CLOUD Act, which allows American authorities to demand access to data held by a US company, including when that data is hosted in Europe, and without going through a European court decision.

This risk is not theoretical. On 10 June 2025, before the Sénat committee of inquiry into public procurement, Anton Carniaux, director of public and legal affairs at Microsoft France, was asked point blank: could he guarantee that the data of French citizens would never be handed over to American authorities without France's agreement? His answer came in a single sentence: "No, I cannot guarantee it."

From that point on, the debate is no longer ideological. It is factual.

To this legal risk is added a well-documented cyber risk: the health sector is one of the most targeted in the world. A compromise would have serious consequences: medical identity theft, blackmail, malicious exploitation for AI purposes.

Finally, there is an issue of strategic competition: hosting health data of such quality with an American hyperscaler means accepting that the non-European ecosystem indirectly benefits from a decisive advantage in training health AI models.

In terms of digital sovereignty, this was a major anomaly.

What does the migration to a SecNumCloud host change?

On 6 February 2026, the government announced the launch of a procedure to select a new host for the HDH. The tender was issued on 9 February 2026, with an award targeted for the end of March 2026 and a complete migration by the end of 2026. The transitional solution considered for a while has been dropped in favour of hosting a full copy of the main SNDS database by the end of the year.

The central criterion is clear: the SecNumCloud qualification issued by ANSSI.

SecNumCloud requires in particular:

• a high level of encryption,
• European localisation and control of the data,
• reinforced protection against extraterritorial laws,
• regular and demanding audits.

In practice, this excludes American hyperscalers. The selection runs through the Nuage Public framework agreement managed by the interministerial digital directorate (DINUM) and UGAP, and several French or European players are positioning themselves: OVHcloud with Docaposte, Cloud Temple with Atos, Orange Business, Scaleway, or S3NS, the joint venture between Thales and Google. That last case already illustrates the limits of the exercise: sovereignty plays out as much in the shareholding structure as in the label.

This is not a simple change of infrastructure. It is a political and strategic choice: to protect citizens' privacy, strengthen cyber resilience, and keep the scientific and economic value of this data in Europe.

Why is this shift coming far too late?

Migrating the Health Data Hub to a SecNumCloud-qualified host is an excellent decision. But it is also a late decision, and that delay has a cost.

For years, we lost time, credibility and above all trust. The trust of citizens, who saw their most sensitive data hosted within a legally questionable framework. The trust of researchers and institutions, locked into a permanent debate over the very legitimacy of the platform. And, finally, trust in the State's ability to treat the digital domain as a strategic subject, rather than as a mere budget line or a technical problem.

This initial choice durably weakened the Health Data Hub. It turned a project of general interest into a symbol of technological dependence, and fed a distrust that could have been avoided.

A structural dependence that goes beyond France

It would be an illusion to believe that this decision, on its own, marks a clean break with our dependence on the American cloud giants.

Even today, the majority of public tenders are written in a way that favours, sometimes implicitly, American hyperscalers. Not out of ideology, but out of habit, out of convenience, and often out of a lack of technical and legal culture when the requirements are drafted. Criteria of performance, scalability or managed services are too often thought through the prism of the American behemoths, relegating European players to the rank of "alternatives", when they should be considered strategic choices in their own right.

There lies the paradox: we talk about sovereignty after the fact, once the dependencies are already in place.

We must also be honest: this change of direction does not stem solely from a national awakening. It is part of a much broader movement, at European scale, driven by the rise of geopolitical tensions, the growing legalisation of data flows, and the late but real understanding that the digital domain is now a lever of power on a par with energy or defence. Germany, the Nordic countries, the Netherlands and Italy are following the same trajectory: reassessing dependencies, strengthening control requirements, taking back the reins of critical infrastructure.

And this movement does not come only from States. It also comes from the field. At Cresco Cybersecurity, we already support public and private organisations facing very concrete digital sovereignty needs: control of sensitive data, genuine reversibility of infrastructure, lasting legal compliance, reduction of technological dependence. These are no longer theoretical debates. They are operational challenges, raised by CIOs, CISOs and executive boards that have understood that "all-American cloud" is no longer tenable in the long run.

Digital sovereignty is not an ideological posture. It is a question of resilience, of continuity, and of responsibility.

A step in the right direction, but not an end in itself

The Health Data Hub's exit from Azure is a strong signal. It shows that the State is finally capable of acknowledging a strategic mistake and correcting it. But this shift comes late, and it must not remain isolated.

Sovereignty cannot be decreed: it is built over time, through governance, transparency, technical mastery and the ability to say no when necessary. It is not limited to a tender or a label. It demands a deeper transformation:

• in the way architectures are conceived,
• in the drafting of public procurement,
• in the training of decision-makers,
• and in the political courage to break free from entrenched dependencies.

This choice is welcome. It must now become structuring. Otherwise, in a few years, we might discover that we have simply moved the problem without ever really solving it.

---

Sources

• Migration of the Health Data Hub to a SecNumCloud host, procedure of 9 February 2026, Nuage Public framework agreement and candidates: Next, 9 February 2026.
• Hearing of Anton Carniaux (Microsoft France) and remarks on the CLOUD Act, 10 June 2025: Sénat committee of inquiry into public procurement.
• European Health Data Space (EHDS), Regulation (EU) 2025/327 in force since 26 March 2025: European Commission.