IT security guideline under § 390 SGB V
IT security in your practice,the way the guideline requires it.
Every practice with statutory health insurance accreditation must implement the IT security guideline of the National Association of Statutory Health Insurance Physicians (KBV). Exactly what this involves depends on the size of your practice. We find out which requirements apply to you, implement them and record how each one is met.
What the guideline is and who it applies to
Under § 390 SGB V, the National Association of Statutory Health Insurance Physicians (KBV) and the National Association of Statutory Health Insurance Dentists (KZBV), in agreement with the Federal Office for Information Security (BSI), set out how practices must secure their IT. The guideline applies to medical, dental and psychotherapy practices with statutory health insurance accreditation and to medical care centres (MVZ).
It sets minimum requirements for devices, software, the network and how the practice team handles IT. The KBV regularly updates it to the state of the art and last revised it in 2025. It does not apply to hospitals, where § 391 SGB V governs IT security.
Which requirements apply to your practice
The guideline is divided into annexes. Which of them you must meet depends on the number of people permanently involved in data processing and on your equipment.
| Practice · up to 5 people | Basic requirements from Annex 1. They apply to every practice, including single-doctor practices. |
| Medium-sized practice · 6 to 20 people | In addition, the requirements from Annex 2. |
| Large practice · more than 20 people | In addition, the requirements from Annex 3. This also covers facilities that process data on a significant scale, such as large MVZ or laboratories. |
| Large medical equipment | Additional requirements from Annex 4 apply to equipment such as CT or MRI scanners. |
| Telematics infrastructure | For the telematics infrastructure (TI) components in the practice, the guideline sets its own requirements for secure installation and maintenance. |
Everyone who regularly works with patient data on a computer counts, including medical assistants at reception, trainees and billing staff.
What we implement in your practice
Most requirements concern things that are part of well-managed practice IT anyway. We implement them so that you can prove each one.
- Antivirus protection and prompt security updates on all computers and servers
- Secure sign-in on all devices and well-organised user accounts
- Regular backups with tested restores
- Firewall and separate networks, for example for patient Wi-Fi, medical devices and practice administration
- Protection and encryption of laptops, tablets and smartphones
- Secure installation and maintenance of the connector or TI gateway, card terminals and KIM
- Secure deletion and disposal of old devices and storage media
- Short training for the practice team on phishing and the safe handling of patient data
- An overview showing how each requirement of the guideline is met
How we proceed
- 01
Classification
We establish how many people in your practice work with data processing and which annexes of the guideline therefore apply to you.
- 02
Current state review
We check your IT against every requirement and show you what is met and where there are gaps.
- 03
Implementation
We close the gaps, and we schedule any work that would disrupt the practice outside consultation hours.
- 04
Ongoing maintenance
When the KBV changes the guideline, we check what this means for your practice and adapt the implementation.
Do you have to hire a certified service provider?
No. Under § 390(7) SGB V, the KBV certifies, on application, service providers that support practices with implementation. However, there is no obligation to hire a certified service provider. The practice remains responsible for implementation, and we supply the evidence for it.
What implementation costs
| Practice check against the guideline with a written report, practice with up to 5 people | €690 |
| Practice check, medium-sized practice with up to 20 people | €1,190 |
| Practice check, large practice or MVZ | from €1,990 |
| Implementation of individual measures | €140 / h |
| Ongoing Managed IT with updates, backup and device management | from €69 per user / month |
For every requirement of the guideline, the practice check shows you whether it is met and what it costs to implement the open points. All prices are net, excl. VAT at the statutory rate.
Updated:
FAQ
Frequently asked questions
Does the IT security guideline also apply to small practices?
Yes. The basic requirements from Annex 1 apply to every practice with statutory health insurance accreditation, including single-doctor practices. Further requirements are added as the practice grows.
Does the guideline also apply to dental and psychotherapy practices?
Yes. For dental practices, it is issued by the National Association of Statutory Health Insurance Dentists (KZBV), and its content is structured in largely the same way. Psychotherapy practices with statutory health insurance accreditation are also covered.
How do we count the people for the classification?
What counts is everyone permanently involved in data processing. Besides doctors, this includes medical assistants, trainees and billing staff who regularly work at a practice computer.
Does the guideline also apply to hospitals?
No. § 391 SGB V applies to hospitals. They must take appropriate precautions in line with the state of the art, and large hospitals may also fall under KRITIS or NIS2.
Does our IT service provider have to be certified by the KBV?
No, there is no such obligation. The KBV certifies, on application, service providers that support practices with implementation, but the choice of service provider is yours.
How often does the guideline change?
The KBV regularly updates it to the state of the art, most recently in 2025. That is why implementation is not a one-off task. As part of ongoing support, we check changes for you.
What does implementation cost in our practice?
The starting point is the practice check at a fixed price: €690 for practices with up to 5 people, €1,190 for up to 20 people and from €1,990 for large practices and MVZ. Afterwards you know what is missing and what implementation will cost.
IT Security Guideline for Medical Practices (KBV)
Where does your practice stand?
In 20 minutes, we clarify which requirements apply to your practice and where you stand today.