For practices and clinics
In a medical practice, almost everything depends on the practice management system (PVS) and the telematics infrastructure (TI). If either one fails, appointments grind to a halt. We look after the IT of practices and clinics so that it runs reliably day to day and meets the IT security requirements.
Under § 390 SGB V, the National Association of Statutory Health Insurance Physicians (KBV) and the National Association of Statutory Health Insurance Dentists (KZBV) define the IT security requirements that practices must meet. The requirements are tiered by practice size, with additional points for medium-sized and large practices. The guideline is regularly updated to reflect the state of the art, so it is not a one-off task.
Connector or TI gateway, practice ID card (SMC-B), electronic health professional card (eHBA), KIM and e-prescriptions are used every day. Since 1 October 2025, practices have also been required to populate the electronic patient record (ePA). Each of these components needs maintenance, and the guideline sets its own requirements for installing them securely.
Health data enjoys special protection under Art. 9 GDPR (DSGVO), and doctors are bound by professional secrecy under § 203 of the German Criminal Code (StGB). Any IT service provider with access to your systems must therefore be bound to confidentiality.
Under § 391 SGB V, every hospital must take appropriate technical and organisational measures in line with the state of the art. A hospital with 30,000 or more inpatient cases a year counts as critical infrastructure (KRITIS), and depending on its size it may also fall under the German NIS2 Implementation Act. We work out which classification applies to your hospital together with you and your legal advisers.
What we do not take on: maintenance of medical devices and the specialist application from your PVS vendor. We connect both securely to your network and coordinate with the vendors.
FAQ
At a minimum: a reliably maintained practice management system, a connection to the telematics infrastructure, a tested backup and the measures from the IT security guideline. Exactly which of these apply depends on the size of your practice. We assess where you stand and show you where the gaps are.
It sets minimum requirements for the IT of medical practices, tiered by risk and practice size. These include rules for hardware, software and practice staff, and for the secure installation and maintenance of the TI components. Because the requirements are regularly updated to the state of the art, we do not check your status only once.
By the number of people who work with data processing on a regular basis. With up to 5 people a practice counts as small, with 6 to 20 as medium-sized and above that as large. A practice that processes data on a large scale also counts as a large practice.
No, there is no such obligation. Under § 390 (7) SGB V, the KBV certifies service providers on application if they help practices implement the guideline, but the choice of provider is yours.
That depends on case numbers and the size of the organisation. A hospital counts as critical infrastructure from 30,000 inpatient cases a year, and it may also fall under NIS2 because of its headcount and turnover. The binding classification is a legal question. We prepare the facts with you and then implement the technical side.
Only as far as our work requires it, and only after we have been bound to confidentiality. § 203 StGB allows doctors to involve contributing service providers if they are bound to secrecy. In addition, we sign a data processing agreement under the GDPR.
Call our support hotline so that we can start troubleshooting straight away. A PVS outage counts as a business outage. We respond within 4 hours in the Basic package and within 2 hours in the Standard and Complete packages. In the Complete package you can reach us around the clock.
We provide ongoing managed IT from 5 users. We support smaller practices with individual projects, such as implementing the guideline, and bill by time spent.
Medical Practices & Clinics
Tell us how your practice or clinic works today. In the intro call we clarify where you stand and what makes sense next.
