Legal obligation · IT security in medical practices
Sightadel translates the IT security guideline for medical and dental practices into 49 controls, activates only those that apply to your practice size, and records for each control what counts as evidence. With templates, drafting help and real consultants for the difficult parts.
Only at Sightadel
Among the nine GRC vendors in our comparison, only Sightadel lists the IT security guideline under section 390 SGB V as a framework; the other eight do not mention it on their websites. Medical practices and MVZ work through the requirements step by step and back them with evidence, together with GDPR and NIS2 if needed.
Basis: public information on the vendors’ websites as of 10 October 2026. View the vendor comparison →
What it is about
The German Social Code obliges the National Association of Statutory Health Insurance Physicians (KBV) and the National Association of Statutory Health Insurance Dentists (KZBV) to set requirements for IT security in practices. The provision is now found in § 390 SGB V (German Social Code, Book V); many still know it as § 75b SGB V. The substance of the obligation has not changed. The KBV issues the guideline for medical practices, the KZBV its own for dental practices. Both were drawn up in agreement with the Federal Office for Information Security (BSI) and are binding for practices providing care under statutory health insurance.
The requirements are graded by practice size. What applies to every practice also applies to the medium-sized practice and the large practice, with additional requirements at each level. What matters is how many people are permanently involved in data processing and to what extent data is processed. Separate annexes cover large medical equipment and the decentralised components of the telematics infrastructure (TI), such as the connector and card terminals.
The content is about tangible things: anti-virus protection and updates, encrypted devices, a firewall with a documented rule set, separated networks, tested backups, an emergency plan and trained staff. The revised 2025 version also places emphasis on raising the awareness of the practice team. The current version issued by the KBV or KZBV is always authoritative.
A service provider looks after the IT, a lot has been set up, but nothing is documented. You need a list of what applies and a place where the evidence is kept.
More staff, more systems, often large equipment with remote maintenance. This is where the additional requirements apply, such as network zones, logging and an annual review.
You implement the guideline for several practices. With a uniform structure per practice, you see where which evidence is missing, and the practice sees what you have done.
Technology and evidence from a single source
The guideline requires not only documentation but also technology – above all a firewall. Together with Valar and veyrisk, we therefore offer two packages: one for practices and small medical facilities, one for hospitals. You get evidence management in Sightadel, the right hardware firewall and, if you wish, an outside view of your systems – coordinated with each other and with one point of contact.
Medical, dental and psychotherapy practices, medical care centres and small medical facilities
Hospitals, large medical care centres, laboratories and facilities with NIS2 obligations
We put both packages together to suit your facility. You receive a quote after a short conversation.
Request a packageRequirements
Summarised in our own words. The original text in its current version is always authoritative.
Up-to-date anti-virus protection, regular updates, automatic screen lock, encrypted storage media and no permanent working with administrator rights. From medium-sized practices upwards, a device inventory and centrally managed accounts.
In SightadelEach control states what counts as evidence, for example a patch log for the last three months. Devices without manufacturer support get a replacement date as a task.
Apps only from official sources, approved apps with access to patient data named, mobile devices locked, encrypted and remotely wipeable.
In SightadelList of approved apps with purpose and approval date. For private devices, the template provides a draft usage agreement; you set the rules.
Securely configured browser, encrypted transmission of confidential data, encrypted emails containing patient information, encrypted removable media and secure deletion before disposal.
In SightadelGuided questions with answer options instead of jargon. Deletion records and maintenance records for the practice website are filed with a date and expire when the next check is due.
A firewall between the practice network and the internet with a documented rule set, blocked incoming connections, secure Wi-Fi with a separate guest network. From medium-sized practices upwards, network zones and remote access only via VPN with a second factor.
In SightadelA rule set sheet for source, destination, service, direction and purpose of each rule. Your service provider fills it in, you see the status. A package with a hardware firewall is available on request.
Daily automatic backup, at least one copy separate from the practice network, a tested restore and a written emergency plan. From medium-sized practices upwards, fallback procedures if central systems fail.
In SightadelTest records with date, scope and result. The emergency plan is created from a template with contact details and restart sequence, ready to print.
A named responsible person, instructed staff, accounts blocked when staff leave, and data processing agreements. In larger practices, an incident register and an annual review.
In SightadelStaff instructions as recurring cycles with attendance lists. Service providers are kept in the Vendors module with contract and validity date.
Large equipment is recorded and sits in its own network segment, and the manufacturer's remote maintenance access is regulated and open only when needed.
In SightadelThese controls only appear if you state large equipment in the practice profile. Remote maintenance sessions are logged with a date.
The connector and card terminals are protected, run on the approved software version, and practice cards (SMC-B) and health professional cards are stored securely.
In SightadelSoftware version and location are filed as evidence. Reminders point out checks that are due.
Process
Four to twelve weeks to a documented status, depending on practice size and how well the IT service provider cooperates. Small practices with well-maintained IT are at the lower end.
Record the number of people involved in data processing, large equipment and TI connection. This determines which controls apply.
Go through the applicable controls together, upload and assign existing evidence. At the end you know what is evidenced and what is missing.
Record the rule set, justify exceptions, check Wi-Fi and guest network. If there is no firewall, that is the first item on the list.
Actually test a restore once and record it. Fill in the emergency plan and keep a printed copy where it will be needed in an emergency.
Instruction with an attendance list, open items as tasks with a deadline. Typical big items are encryption, legacy devices and contracts with service providers.
Record the status and sign it. After that, expiry dates remind you of updates, backup tests and the next instruction.
Ready to start
Clarify these questions early and you save weeks later on. In Sightadel they are set up as your first tasks.
Division of work
If software filled everything in, the standard would not serve its purpose – and the auditor would notice. That is why it is clearly defined what stays with you.
From practice
From many years of consulting and certification practice: these are the points that cost the most time or lead to nonconformities in the audit.
If you count full-time positions instead of people with access to patient data, you often end up one type too low. Count every person who works with patient data on a permanent basis, and record the count.
The service provider sets up a lot, but responsibility remains with the practice. Clarify in writing which items it takes on, and have it deliver evidence.
The internet provider's router usually does not replace a firewall with a documented rule set. Check whether a suitable firewall is in place and whether every rule has a purpose.
A backup whose restore has never been tested often fails in an emergency. Test restores regularly and record date, scope and result.
If the emergency plan is stored on the encrypted server, it cannot be reached in an emergency. Keep a printed copy in a known place.
New staff and new attack patterns make regular instruction necessary. Plan it annually and whenever someone joins, with an attendance list.
One piece of evidence, several frameworks
We deliberately do not give a percentage – it depends on your scope. Where requirements overlap, one piece of evidence is attached to all of them.
Patient data is a special category of personal data. Encryption, access rights, deletion procedures and data processing agreements also evidence the technical and organisational measures under Art. 32.
NIS2Medical practices are usually below the thresholds of the German BSI Act (BSIG). Large medical care centres and laboratories may fall within its scope. Firewall, backup, emergency plan and staff instruction then contribute to several measures under § 30 BSIG.
ISO/IEC 27001The next step for larger facilities. The evidence from the guideline covers many technical controls from Annex A; risk analysis and management system come on top.
ISO 9001Practices with quality management share document control, staff instructions and internal audits. In Sightadel, one piece of evidence can be assigned to several frameworks.
Audit and evidence
The guideline does not provide for certification of the practice. You must meet the requirements and be able to prove it if necessary, for example to your regional Association of Statutory Health Insurance Physicians or Dentists, after an incident or to the data protection supervisory authority. Sightadel does not certify and does not provide legal advice.
For implementation, practices can engage service providers certified by the KBV for this task. Such a service provider or an independent auditor from our partner network gets their own access in Sightadel, without deletion rights. No commission is paid for audits – neither to us nor to the partners.
To the independent auditor networkThe law itself contains no technical details. Section 390 SGB V instructs the National Association of Statutory Health Insurance Physicians and the National Association of Statutory Health Insurance Dentists to set out the requirements in a guideline, in agreement with the BSI and in consultation with other bodies. The guideline must be adapted to the state of the art and is therefore updated regularly. For medical and psychotherapy practices, the KBV guideline applies; for dental practices, that of the KZBV. Both follow the same basic idea but differ in structure and detail. The version issued by your national association is always authoritative.
The KBV guideline is divided into a main text and annexes. The annexes contain the actual requirements, graded by practice type: what applies to every practice, what is added in medium-sized practices and what large practices must additionally meet. Further annexes concern large medical equipment and the decentralised components of the telematics infrastructure. The requirements build on each other, so a large practice also meets all the requirements of the smaller types.
The most recently revised KBV version came into force on 1 April 2025, and the new requirements had to be implemented within six months. The revision focuses on raising awareness and training of the practice team, backup and the secure configuration of email. Sightadel maps the requirements to 49 controls and shows only those that apply to your practice profile. When a new version is published, the controls are adapted and your existing evidence is kept.
Classification is the first and most important step, because it determines how many requirements apply. What matters is not the total number of employees, nor working hours, but the number of people permanently involved in processing patient data. This includes doctors as well as medical assistants at reception. Cleaning staff without access to systems do not count.
With up to five such people, the practice counts as a practice within the meaning of the guideline. With six to twenty people, it is a medium-sized practice. Above that, or if data is processed on a large scale, for example in large medical care centres or laboratories, it is a large practice. Independently of this, the annexes for large equipment and TI components are added if you operate them.
In Sightadel, you enter these details in the practice profile. This automatically determines which controls appear. If the size changes, for example due to new colleagues or a merger, you adjust the profile and the additional requirements become visible as open items. Record the reasoning behind your classification so that it can be traced later.
There is no list price for § 390 SGB V in Sightadel. The price depends on practice type and scope and is quoted on request. IT service providers looking after several practices receive their own quote. You can try Sightadel free for 14 days without payment details; everything you set up carries over to the paid plan.
The bigger costs usually arise for technology and the service provider. Typical items are a suitable firewall, replacing legacy devices without manufacturer support, a backup with a copy outside the practice network, encryption of devices and storage media, and the IT service provider's working time for setup and documentation. These costs are invoiced to you directly by the respective providers. If you are looking for a hardware firewall, ask us about the right package.
The internal effort in the practice is manageable if it is planned: one responsible person who keeps an eye on the status, a stocktake together with the service provider, an instruction session for the team and regular reviews. What is usually underestimated is the time it takes to get evidence from the service provider. Separate access for the service provider in Sightadel shortens this path.
The guideline itself does not contain its own catalogue of fines, and the regional associations of statutory health insurance physicians do not carry out regular checks of practices. Concluding from this that the obligation is not binding would be a mistake. The guideline is binding for practices providing medical and dental care under statutory health insurance, and it specifies what counts as appropriate security.
This becomes relevant above all after an incident. If a practice's data is encrypted by ransomware or patient data falls into the wrong hands, the data protection supervisory authority examines whether appropriate technical and organisational measures under Art. 32 GDPR were in place. The guideline is an obvious benchmark for this. On top of that come possible reporting obligations under the GDPR, claims by patients, questions of medical confidentiality and, where applicable, consequences with insurers.
If, on the other hand, you can prove that the requirements were implemented, the backup was tested and the team was instructed, you are in a better position in each of these conversations. That is why clean, dated evidence pays off. Clarify the legal assessment of an individual case with your legal adviser or your professional chamber; Sightadel does not provide legal advice.
Most practices do not implement the guideline alone, but with an IT service provider or the vendor of their practice management system. That makes sense, but it does not shift the responsibility. The practice owner remains responsible. A clear division of tasks is therefore important: what does the service provider set up, what does it document, and what must the practice do itself, such as staff instruction, the emergency plan and access rules.
The KBV certifies IT service providers that support practices with implementation. A certified service provider knows the requirements. However, the certification relates to the service provider, not to your practice, and does not replace your own evidence. Ask which controls the service provider takes on and which evidence it will deliver to you.
In Sightadel, the service provider gets its own access. It enters the firewall rule set, patch levels, backup records and device inventory directly against the relevant controls. You can see at any time what has been done and what is missing. If a service provider looks after several practices, it works with the same structure everywhere. A data processing agreement with the service provider also belongs in the evidence.
Many requirements are not one-off tasks. Updates must be installed continuously, backups tested regularly, new staff instructed and the accounts of departing staff blocked. If the technology changes, for example due to a new piece of large equipment, a new connector or a move, the network and documentation must be updated.
A fixed rhythm has proven its worth. Monthly, the service provider checks updates and backups; quarterly, a restore is spot-checked; annually, the team is instructed, the emergency plan updated and the overall status reviewed. For larger practices, an annual review is explicitly required.
In Sightadel, every piece of evidence has an expiry date. If it expires, Sightadel reminds the responsible person and the service provider before a gap arises. The evidence sheet with the current status can be generated, signed and filed at any time. When the guideline is updated, you see which controls have been added.
If you want to go beyond the mandatory level, for example a large medical care centre that could fall under NIS2, you build on the same evidence. In Sightadel, firewall, backup, emergency plan and staff instruction also count towards GDPR, NIS2 and ISO 27001, without being filed twice.
What it costs
You only pay for the frameworks you actually need. The editions differ in capacity and response time, not in subject-matter scope. If you run several frameworks, you save permanently. All prices, discounts and a calculator are on the pricing page.
The certification or audit body invoices its fees directly to you. If needed, you can add consulting as a package in the app.
Working materials
↓§ 390 SGB V – evidence pack for medical practicesChecklist · XLSX, PDFPractical aids, not legal advice.
Terms
Yes, if you provide medical or dental care under statutory health insurance. This applies to single-handed practices as well as group practices, medical care centres and laboratories. Which requirements apply in detail depends on practice size, large equipment and the connection to the telematics infrastructure.
The obligation still exists; it is now found in § 390 SGB V. The term § 75b has remained common in practices and among service providers. The guideline itself is issued by the KBV, and by the KZBV for dental practices.
The requirements already apply. The revised KBV version came into force in April 2025, and the new requirements had to be implemented by October 2025. The guideline is updated regularly; the current version is always authoritative.
The guideline itself does not contain its own catalogue of fines. But inadequate security can be expensive: in the event of a data breach, the data protection supervisory authority examines whether appropriate measures were in place and can impose fines under the GDPR. On top of that come liability issues and possible consequences under the law governing statutory health insurance physicians. Have this clarified legally in each individual case.
No, not for practices. IT service providers that support practices with implementation can be certified. The practice itself demonstrates its status with evidence, not with a certificate.
By the number of people permanently involved in data processing: up to five is a practice, six to twenty a medium-sized practice, and above that, or where data is processed on a large scale, a large practice. Large equipment and TI components are considered in addition.
Yes. A firewall between the practice network and the internet is one of the basic requirements, as is a documented rule set. The internet provider's router alone is usually not designed for this. Talk to us if you are looking for a package with a hardware firewall.
No, deliberately not. It provides drafts and helps with wording. Whether a measure has been implemented in your practice is confirmed by you or your service provider – with evidence.
The KBV guideline applies to practices providing care under statutory health insurance, which includes psychotherapy practices with statutory health insurance accreditation. Purely private practices are not directly covered. However, the security obligations of the GDPR apply to them, and the guideline is a good benchmark for what counts as appropriate.
Regular checks of all practices are not planned. The status becomes relevant above all after an incident, towards the data protection supervisory authority or insurers. So keep dated evidence ready instead of searching for it only when something goes wrong.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.
