Tailored solutions for healthtech companies
If you develop software for patients, doctors or hospitals, you process data that needs special protection. Customers in healthcare ask for certificates and cloud attestations, and manufacturers of medical devices can fall under NIS2. Sightadel guides you through data protection, ISO 27001, NIS2 and BSI C5 and keeps the evidence on a shared foundation.
Starting point
Healthtech companies work with data that the GDPR treats as a special category. Under Art. 9 GDPR, health data may only be processed if one of the exceptions listed there applies, such as explicit consent. In addition, a data protection impact assessment is almost always needed, because the processing is likely to result in a high risk to the data subjects.
The customers are demanding. Hospitals, practices and health insurers review providers thoroughly. Under § 393 SGB V (German Social Code, Book V), healthcare providers and health insurers may only have health data processed in the cloud if a current C5 attestation is in place. For software as a service, this often means the question about the attestation comes up in sales.
If your software is a medical device, the Medical Device Regulation and its IT security requirements apply as well. Manufacturers of medical devices are also listed in Annex 2 of the BSIG and are important entities from medium size. Sightadel does not cover the Medical Device Regulation. You run the information security behind it with ISO 27001 on the same foundation as everything else.
Why now
Since 1 July 2025, § 393 SGB V generally requires a C5 Type 2 attestation. For new systems placed on the market after 30 June 2025, Type 1 is sufficient for the first 18 months.
Hospitals and health insurers often make ISO 27001 or comparable proof a condition. Without a certificate, you are left out.
Its intended purpose can turn an app into a medical device. The company then belongs to Annex 2 of the BSIG as a manufacturer, from 50 employees or more than €10 million in turnover and balance sheet total.
Manufacturers of digital health applications (DiGA) have had to prove data security with a BSI certificate since 1 January 2025 and data protection with a certificate under Art. 42 GDPR since 1 August 2024.
Every new processing activity needs a legal basis under Art. 9 GDPR and usually an impact assessment before it goes live.
In due diligence, investors and pharma partners ask about data protection, certificates and incidents. A maintained ISMS answers this without extra shifts.
Relevant frameworks
Summarised in our own words, not legal advice. The original text in its current version is authoritative.
Health data are special categories under Art. 9 GDPR. You need an exception from the processing ban, a data protection impact assessment under Art. 35 GDPR for large-scale processing and usually a data protection officer. As a processor for practices or hospitals, contracts under Art. 28 GDPR come on top.
View framework →The usual proof of information security towards hospitals, health insurers and partners. An ISMS under ISO 27001 is also a good foundation for C5, NIS2 and the security requirements for medical device software.
View framework →Required under § 393 SGB V for cloud processing of health and social data by healthcare providers and health insurers. If you run your software as a cloud service for these customers, your own attestation is often requested. The attestation is issued by an auditor under ISAE 3000.
View framework →Manufacturers of medical devices and in vitro diagnostic devices are listed in Annex 2 of the BSIG and are important entities from medium size. Software can itself be a medical device. Providers of cloud services belong to digital infrastructure in Annex 1. The classification is a legal question for your advisers.
View framework →For providers whose product uses AI, for example to analyse findings. A management system under ISO 42001 describes how models are selected, data is used and risks are assessed, and it has the same structure as ISO 27001.
View framework →Recommended order
Which health data do you process, for what purpose and on which basis under Art. 9 GDPR? Are you the controller or a processor? This determines the impact assessment, contracts and information obligations.
Is your software a medical device? Do you fall under NIS2? Do your customers require a C5 attestation? The answers decide the order. The legal assessment stays with your advisers.
Risk analysis, policies, access, secure development, logging, backups and incident handling. The ISMS later supports C5, NIS2 and customer requirements.
For a C5 Type 2 attestation, what counts is that controls were effective over months. Access reviews, changes and training need continuous evidence.
Certificate, attestation and data protection documents come from independent bodies. After that, you show your status in the Trust Center so hospitals and partners find the answers themselves.
Focus
With health data, supervisory authorities, customers and patients look more closely. Four points should be settled and recorded before launch.
Explicit consent, a treatment contract or a statutory basis: for every processing of health data, it is clear which exception under Art. 9 GDPR applies. This also applies to analytics and product improvement.
New features with health data get a data protection impact assessment before launch. It is kept as dated evidence and reviewed when things change.
Where is the data, who can access it, which attestations do the service providers hold? Hospitals ask these questions before they sign. The vendor module keeps the answers ready with evidence.
An incident can trigger reports to the data protection authority, to customers and, if NIS2 applies, to the BSI. The process with deadlines and responsibilities is set beforehand.
How Sightadel helps
The GDPR, ISO 27001, C5 and NIS2 are worked through question by question. Where requirements overlap, one piece of evidence is linked to several frameworks.
Learn more →Impact assessments, contracts, training and technical evidence are kept in the evidence archive with version and expiry date. That way no evidence is missing for the observation period of a C5 attestation.
Learn more →Cloud platform, hosting and other service providers are listed with location, contract, attestations and risk. Expired evidence stands out before a customer asks about it.
Learn more →Certificates, attestations, approved documents and subcontractors on a dedicated page. Hospitals and partners find the answers themselves.
Learn more →Gaps from assessments and impact assessments become tasks with a deadline and a responsible person, including for development and operations.
Learn more →Requirements for which there is no ready-made module, such as criteria from your DiGA application or catalogues from hospital groups, are created as a custom framework.
Learn more →Effort and duration
The ranges are based on experience, not a commitment. The biggest factors are the number of processing activities involving health data, the size of the scope and whether your software is classified as a medical device.
What you license · typically Professional
A typical healthtech company manages ISO 27001 and the GDPR in the Professional edition. It includes ten users, ten assets and 25 vendors, enough for development, operations, data protection and management. Licence for ISO 27001: from €750 per month. If ISO 27001 is included, the GDPR and C5 cost permanently less. You add BSI C5 when customers from healthcare require it.
Licence per framework, minimum term one year, payable monthly or annually. You will find all prices, discounts and a calculator on the pricing page. Fees of a certification or audit body are charged separately.
No. This page is aimed at companies that develop or operate software for healthcare. For practices and MVZ, there is a separate solution page on § 390 SGB V, data protection and NIS2.
That depends on your customers and your architecture. § 393 SGB V is aimed at healthcare providers and health insurers that have health data processed in the cloud. If you run a cloud service for this, these customers will ask for your attestation. Your hosting provider's attestation only covers their part.
That is decided by the manufacturer's intended purpose under the Medical Device Regulation. Software intended, for example, for the diagnosis, monitoring or treatment of diseases can be a medical device. Clarify the classification with your regulatory advisers. Sightadel does not cover the Medical Device Regulation as a framework.
Under § 139e SGB V, manufacturers have had to prove data security with a BSI certificate since 1 January 2025, based on Technical Guideline TR-03161. They have proved data protection with a certificate under Art. 42 GDPR since 1 August 2024. Sightadel does not issue any of these certificates. An ISMS under ISO 27001 helps prepare for the assessments.
Manufacturers of medical devices and in vitro diagnostic devices are listed in Annex 2 of the BSIG. From 50 employees or more than €10 million in turnover and balance sheet total, they are important entities. If your software is not a medical device, a classification as a cloud service may be possible. Clarify the assessment of your case with your advisers.
Not always. Art. 9 GDPR names several exceptions, such as explicit consent or processing for purposes of healthcare on the basis of law or a contract with a health professional. Which exception applies depends on the processing and belongs in your record of processing.
Many requirements overlap, for example on access, encryption, logging and vendors. In Sightadel, one piece of evidence is linked to both frameworks. Certificate and attestation remain separate audits with their own auditors.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.
