CaRE program: where the cyber plan for healthcare facilities stands

The essentials

CaRE (Cybersécurité accélération et Résilience des Établissements, or Cybersecurity Acceleration and Resilience of Facilities) is the national cybersecurity plan for healthcare facilities. It was unveiled on December 18, 2023. It is led by the Digital Health Delegation (Délégation au numérique en santé, DNS) and the Digital Health Agency (Agence du numérique en santé, ANS), and relayed in the regions by the regional health agencies (agences régionales de santé, ARS).
The stated goal is €750 M in investment by 2027, including a first tranche of €250 M through 2025. In January 2025, the Court of Audit (Cour des comptes) estimated that only €223 M was actually covered.
Funding is awarded through calls for each “domain.” It is paid when verified objectives are met, not simply on spending. The domains opened so far are: technical directories and Internet exposure (D1, then D1 bis), business continuity and recovery (D2), and electronic identification (HospiConnect).
As of October 12, 2026, no CaRE application window is open for a new domain. However, several deadlines for evidence and payments fall before the end of the year, including the close of D2 declarations on November 18, 2026.
The D3 (remote access) and D4 (workstation monitoring) domains are announced for 2027-2028, according to the ARS Grand Est (page dated September 14, 2026). The dates have already slipped several times.
The medico-social sector is entering the program through an experimental phase: 21 organizations were selected in July 2026.

What is this about?

CaRE was born after a series of serious cyberattacks on French hospitals. Examples include Corbeil-Essonnes in August 2022 (LockBit ransomware, patient transfers, published data) and Versailles in late 2022. According to the French national cybersecurity agency (ANSSI), 30 healthcare facilities suffered a ransomware compromise in 2022 and 2023.

The plan was presented on December 18, 2023 by the Minister of Health and the Minister Delegate for Digital Affairs. It has a dual goal: stopping attacks from succeeding, and enabling facilities to recover quickly.

It is organized around four pillars:

Governance and resilience: cyber governance at every level, self-assessment and crisis exercises.
Resources and pooling: shared services, notably through the regional cyber resource centers (CRRC) run by the regional e-health support groups (GRADeS), and skills development.
Awareness: building a security culture among professionals. The ANS online training platform offers 113 modules and 11 cyber learning paths.
Operational security: the funded “domains,” each addressing a specific technical problem.

The program was initially limited to 2027. Several ARS now describe it as running through 2028, since HospiConnect, D3 and D4 extend to that date.

Who is affected?

Public and private healthcare facilities (hospitals, clinics) are the main target. Eligibility depends on a valid authorization, on the activity declared in the hospital information systems medicalization program (PMSI) and on the FINESS category. In a territorial hospital group (GHT), the lead facility submits one application for the group.
Social and medico-social facilities and services (ESSMS) are not covered by domains D1 and D2. They are the subject of a separate, still experimental call for projects (see below).
Vendors, meaning software publishers, integrators, auditors and backup providers, are affected indirectly. The objectives to be met (repeated audits, restorable backups, evidence) shape facilities’ purchasing. The ANS has also held dedicated webinars for industry players on D2.

The funded domains

D1 and D1 bis: technical directories and Internet exposure

This first domain targets two classic entry points for attackers. The first is the technical directory, in practice Active Directory, which manages accounts and permissions. The second is the set of services exposed to the Internet.

D1, funded with €65 M, accepted applications from March 18 to April 19, 2024. At the 2026 national health IT security congress (CNSSIS), the ANS announced that 939 applications out of 1,428 eligible candidates would be funded:

479 met all objectives;
347 became eligible after checks were relaxed;
the rest fall under a partial-achievement scheme.

D1 bis was created by the order of January 27, 2026. It reopens this domain to facilities excluded from the 2024 scheme or that need to catch up on activity not covered. The objectives set by the order give a good idea of what the ministry expects:

a directory audit with ANSSI’s ADS tool every two months, with the last two reaching at least level 2;
an Internet exposure audit every two months, with the last two showing no critical vulnerability (CVSS score above 9.0);
at least one crisis exercise per facility since January 1, 2025;
a self-assessment on the oSIS platform, which covers the digital share of the budget and 43 priority measures, as well as a count of full-time equivalents devoted to cybersecurity;
for GHTs, a project lead, a single operational team for directories and a directory convergence roadmap of 18 months at most.

The minimum funding is €15,000. The ceiling depends on the number of legal and geographic entities and on activity, and payment is made on declared costs.

D2: continuity and recovery

D2 aims to build and then test a business continuity and recovery plan (PCA/PRA), with uncontaminable, restorable backups for all critical applications. It is based on the order of July 3, 2025, published in the Journal officiel on July 16, 2025. The budget is €45 M.

To apply, a facility needed an information systems security policy (PSSI) validated or reviewed within the 36 months before the order. The window, open from September 2 to October 31, 2025, received 1,167 applications. According to the ANS, this represents about 80% of eligible organizations.

HospiConnect: electronic identification of professionals

HospiConnect funds electronic identification tools to strengthen professionals’ authentication. It is governed by the order of January 27, 2026 and runs from 2026 to 2028. The scheme has two components:

a CaRE component, for hardware;
a HOP’EN 2 component, for transformation, meaning the identity lifecycle and access rights.

According to the ARS Normandie, the base rate is €20 per staff member, calculated on declared headcount. It is reduced by €12 for each card ordered from the ANS. Enrollment in the scheme is a condition for funding in 2026, 2027 and 2028.

D3 and D4: remote access and workstation monitoring

D3 is meant to secure all remote access, whether vendor remote maintenance or staff remote work. A May 2025 document mentioned a provisional budget of €60 M. D4 will address workstation monitoring.

Their opening dates have slipped several times: 2025, then late 2025 or early 2026, then “during 2026.” The most recent page consulted, from the ARS Grand Est dated September 14, 2026, announces a rollout in 2027-2028. No order has been published to date.

Medico-social

The social and medico-social sector benefits from an exploratory call for projects from the ANS and the DNS. Applications were open from May 11 to June 4, 2026, and 104 applications were submitted. The commitment committee selected 21 winners on July 2, 2026.

Three support tracks are being tested, depending on each organization’s maturity level. The goal is to decide how to approach a broader rollout, whose timeline is not yet known.

Timeline

Date	Milestone
December 18, 2023	CaRE plan unveiled
March 18 – April 19, 2024	D1 applications
January 3, 2025	Court of Audit report: funding covered up to €223 M
September 2 – October 31, 2025	D2 applications (1,167 applicants)
December 31, 2025	D1 payments close (date given by the ARS Normandie)
January 16, 2026	D2 objective-achievement declarations open
January 27, 2026	D1 bis and HospiConnect orders
February 13 – March 13, 2026	D1 bis applications
July 2, 2026	21 medico-social winners selected
Fall 2026	HospiConnect CaRE window (date to be confirmed on Convergence)
October 29, 2026	D1 bis evidence submission and audit requests open
November 18, 2026	D2 objective-achievement declarations close
November 29, 2026	D1 bis payments open
March 31, 2027	D1 bis evidence submission closes
June 30, 2027	D2 payments close
November 15, 2027	D1 bis payments close
2027-2028	Announced rollout of domains D3 and D4

At the European level, the NIS2 directive classifies healthcare as a highly critical sector. As of October 12, 2026, the French transposition law (the “Resilience” bill) has not yet been enacted: its examination in the National Assembly, scheduled for October 7 and 9, 2026, was removed from the agenda on October 6, with no new date set. NIS2 obligations specific to healthcare facilities are therefore not yet established in French law.

CERT Santé and incident reporting

Since October 1, 2017, healthcare facilities have been required to report serious information system security incidents. This obligation stems from Article L. 1111-8-2 of the Public Health Code and Decree No. 2016-1214. It was extended to medico-social facilities in November 2020.

Reports must be made without delay. They are handled by the ARS and by CERT Santé, the ANS incident response team, which assesses the incident, provides support and issues alerts. Depending on the case, the facility must also notify the CNIL (the French data protection authority) in the event of a personal data breach, notify ANSSI, and file a criminal complaint.

According to the observatory report published by the ANS in May 2026, 764 incidents were reported in 2025 by 606 organizations. This is almost unchanged from 2024 (749). The same report, citing ANSSI’s threat overview, says healthcare accounts for 10% of confirmed incidents and ranks third among the most affected sectors.

Attacks continue

The Armentières hospital (February 2024) and the Simone-Veil hospital in Cannes (April 2024) were hit after the program was launched. In late November 2024, data presented as belonging to more than 750,000 patients of the Aleo Santé group was put up for sale.

On September 3, 2026, the CNIL fined the Hôpital privé de la Loire in Saint-Étienne €500,000. Following an attack in summer 2025, the data of 524,867 patients had been accessed. The CNIL found:

external access to the patient record without a VPN or multifactor authentication;
inadequate access control;
a failure to inform the 202,246 “trusted third parties” concerned.

This is precisely the scope of the upcoming D3 domain and of HospiConnect.

Where to start

Check your current deadlines. If you are a D2 applicant, submit your evidence before November 18, 2026. If you were selected for D1 bis, prepare the submission that opens on October 29, 2026. The application windows are on eCaRE and Convergence.
Appoint a lead for CaRE and HospiConnect, working with your ARS and your regional CRRC, and keep the oSIS self-assessment up to date.
Regularly audit the directory and Internet exposure. ANSSI’s ADS tool and a periodic exposure scan are the baseline, even without funding.
Test a real restoration of critical applications from isolated backups, then document recovery times.
Run a crisis exercise using the ANS kits, then update the digital section of the white plan (the hospital emergency plan): crisis unit, degraded modes, incident reporting.
Inventory remote access (remote maintenance, VPN, patient record access) and enforce multifactor authentication on it, without waiting for D3 to open.
Prepare incident reporting: know the ARS and CERT Santé channel, as well as the CNIL and ANSSI notifications, and write it down in a procedure.

For vendors, the requirements of each domain are formalized in the orders and the ANS guides. An offering must enable the facility to produce the required evidence, such as audit reports or restoration test reports.