TL;DR (60 seconds)
- → A digital health project has 3 non-negotiable legal constraints: HDS hosting (Health Data Hosting certification), reinforced GDPR (sensitive data under Article 9), and possibly MDR if the product is a medical device.
- → Median budget: €40-80k for a patient/practitioner MVP, €100-250k for a multi-stakeholder platform integrated with the DMP or Mon Espace Santé.
- → Interoperability: the FHIR (HL7) standard is becoming mandatory for integrations with the FR/EU healthcare system.
- → The 3 fatal mistakes: choosing a non-HDS host (full rebuild at certification), ignoring MDR for a SaMD (fine plus market withdrawal), underestimating the certification cycle (6-18 months).
The specification document for a healthcare application must treat compliance as a full workstream, not as a final check. Regulators (CNIL, ANSM, Agence du Numérique en Santé) sanction severely and quickly. A healthcare platform that is non-compliant at launch is a platform shut down 3 months after its first commercial success.
Telemonitoring/patient app MVP €40-80k, DMP-integrated platform €100-250k, CE-certified medical device €250k+.
MVP 20-30 weeks, full platform 40-60 weeks (including certifications).
Is it a Software as a Medical Device (SaMD)? MDR Rule 2017/745 class I/IIa/IIb/III. Impact: mandatory CE marking, technical file, clinical evaluation, notified body. Advice: have it qualified by a regulatory affairs consultant from the concept phase.
HDS certification (Health Data Hosting) is mandatory as soon as nominative health data is processed. French HDS providers: OVH Healthcare, Scaleway HDS, AWS Paris HDS, Outscale. Structuring choice: includes backup, encryption, SLA, authorized personnel, specific HR agreements.
Article 9 GDPR: health data equals special category. Reinforced legal basis (explicit consent, care necessity, public interest). Detailed processing register, mandatory DPO, mandatory impact assessment (DPIA) before production, adapted patient legal notices.
FHIR R4 (HL7) equals EU interoperability standard, ANS reference systems (RPPS identifiers for practitioners, INS for patients), DMP (Shared Medical Record) via ANS API, Mon Espace Santé (MSSanté secure messaging), ROR (Operational Resource Directory) for stakeholder geolocation.
Patients: ProSantéConnect (state SSO), FranceConnect+ possible. Practitioners: CPS (health professional card), mobile e-CPS, RPPS certificate. No simple email plus password account is acceptable for patient record access.
End-to-end encryption of patient-practitioner messages, encryption at rest of records (KMS HSM), mandatory ANSM pentest for class IIa+ SaMD, annual security audit, ISO 27001 recommended.
Typically 3-4 roles: patient, practitioner (general practitioner, specialist), care coordinator, adjacent health professional (physiotherapists, nurses). Granular permissions by role and by patient record, access traceability (tamper-proof audit log).
MSSante integration (Mailiz, Apicrypt, Lifen) is mandatory for exchanges between health professionals. Workflow: signature, receipt, acknowledgement, 10-year archiving. Technical impact: not a simple SMTP, specific MSSante API.
If teleconsultation: encrypted video (Tixeo, on-premise Jitsi, Whereby Enterprise), NGAP/CCAM coding, FSE (Electronic Care Form) via SESAM-Vitale, payment and reimbursement by Social Security/CPAM.
Written manually, this specification often takes dozens of hours. Flowayz generates it in a few minutes from your brief.
Generate my specification →Yes, as soon as you store, process or exchange named health data in France, even indirectly. HDS certification is a certification of the host, not of your app: you must choose an HDS provider (OVH Healthcare, Scaleway HDS, AWS Paris HDS) and document the contractual arrangement in your GDPR register.
As soon as it provides information used for diagnosis, treatment, prevention or medical monitoring. Simple appointment booking is not SaMD. An app that says 'you have a 30% risk of diabetes' is SaMD. MDR rule 2017/745. When in doubt, a regulatory consultation with an ANSM specialist will cost 2-5 kEUR but avoids errors at 100 kEUR+.
Patient app MVP without health system integration: 40-60 kEUR over 20-30 weeks. With DMP/MSSante integration: 80-120 kEUR. With CE class IIa certification: add 50-100 kEUR plus 12-18 months of delay. Full multi-actor platform: 150-250 kEUR over 40-60 weeks.
FHIR (Fast Healthcare Interoperability Resources, HL7) is the international standard for health data exchange. In France in 2026, it is becoming the norm for any integration with the ANS (Digital Health Agency) ecosystem, DMP, Mon Espace Sante. For an isolated health app (no external exchange), FHIR is not mandatory but remains strongly recommended for the future.
No, for named health data of French patients. French HDS certification is required, which implies hosting in France (or failing that in the EU with documented equivalent guarantees). AWS offers a certified HDS Paris region: it is the only acceptable AWS option for this use case.
Flowayz turns your brief into a complete professional specification using 22 AI assistants. Free for life, no credit card.
Open my free account →We use cookies to analyse our traffic and improve your experience. Analytics cookies are only set with your consent. Read our cookie policy