Sightadel
Free 14-day trial

Solutions · Medical and dental practices, MVZ

The practice IT is secure.
Now someone has to be able to show it.

For practices treating patients under Germany's statutory health insurance, the IT security guideline is mandatory, and data protection for health data applies anyway. Large medical care centres (MVZ) and laboratories also fall under NIS2. Sightadel sorts this by practice size, divides the tasks between the practice and its IT service provider and records what has been done.

Try free for 14 daysTalk to an expert

Only at Sightadel

Section 390 SGB V as a framework of its own – none of the compared vendors offers it.

Among the nine GRC vendors in our comparison, only Sightadel lists the IT security guideline under section 390 SGB V as a framework; the other eight do not mention it on their websites. Medical practices and MVZ work through the requirements step by step and back them with evidence, together with GDPR and NIS2 if needed.

Basis: public information on the vendors’ websites as of 10 October 2026. View the vendor comparison →

Starting point

What it looks like in practice.

In most practices an external IT service provider looks after the server, practice management system, connector and network. Practice management relies on this running properly. Usually it does. What is missing is the overview: which requirements of the guideline apply to our practice size, which are done, who checked them and when, and where is the evidence?

This is exactly the question that comes up when the regional Association of Statutory Health Insurance Physicians (KV) makes enquiries, a data breach happens, the practice is sold or brought into an MVZ, or the cyber insurer sends a questionnaire. What counts then is not what the service provider says it has set up, but what can be evidenced. Responsibility always stays with the practice.

The good news: the requirements are manageable and specific. Antivirus, updates, encryption, firewall, separate networks, tested backups, emergency documentation, a trained team. Most of this is in place in well-supported practices. It just needs to be organised once and then maintained.

Why now

Typical reasons to tackle the topic.

01

New version of the guideline

The National Association of Statutory Health Insurance Physicians (KBV) revised its IT security guideline in 2025, with more weight on raising awareness in the practice team. The implementation deadline has passed. If you have not yet made the adjustments, now is the time.

02

The practice grows or becomes part of an MVZ

With more people constantly involved in data processing, the practice moves into a higher level of the guideline. For an MVZ with many locations, the question of NIS2 also arises.

03

Incident or near miss

Encryption by malware, a stolen laptop, test results sent to the wrong recipient. Afterwards the data protection authority asks which measures were in place. If you can evidence them, you are in a much better position.

04

Change of IT service provider

A change shows how much knowledge sat only with the previous provider. Your own organised documentation makes the practice independent.

05

Cyber insurance questionnaire

Insurers ask about multi-factor authentication, backups and training. The answers are already part of implementing the guideline and can be reused.

06

Handing over or buying a practice

Buyers and investors now check IT security as well. Traceable documentation shortens this review and avoids price reductions due to uncertainties.

Relevant frameworks

What applies – and what it specifically requires here.

Summarised in our own words, not legal advice. The original text in its current version is authoritative.

§ 390 SGB VMandatory

Binding for practices providing medical and dental care under statutory health insurance. The KBV guideline applies to medical practices, the guideline of the National Association of Statutory Health Insurance Dentists (KZBV) to dental practices. The requirements are tiered by practice size. Separate annexes cover large medical devices and the components of the telematics infrastructure such as the connector and card terminals. There is no certificate. What is expected is traceable implementation.

View framework →
GDPRMandatory

Health data belongs to the special categories of personal data. The practice needs a record of processing activities, technical and organisational measures, data processing agreements with service providers and laboratories, and a procedure for data breaches. Whether a data protection officer must be appointed depends on the number of employees and the scope of processing.

View framework →
NIS2Depends on the situation

Healthcare providers are among the sectors of the German BSI Act (BSIG). Entities of medium size and above are covered, meaning 50 or more employees or more than €10 million in annual turnover and balance sheet total. Single practices are usually below this, large MVZ, laboratory groups and practice chains often above it. Then registration with the Federal Office for Information Security (BSI), risk management under section 30 BSIG, reporting obligations and the responsibility of management are added.

View framework →
ISO/IEC 27001Recommended

Not mandatory for practices. For large MVZ groups, laboratories and practice chains with their own IT department, an ISMS under ISO 27001 can be the right framework, because it brings the guideline, data protection and NIS2 under one roof.

View framework →

Recommended order

Where to start – and what comes next.

  1. 1

    Determine the practice type

    First you establish which level of the guideline your practice falls into and whether large medical devices are in use. For MVZ and laboratories, you check at the same time whether the NIS2 size thresholds are reached.

  2. 2

    Take inventory

    Which devices, programs, accounts and service providers are there? Without this list, no requirement can be answered properly. Your IT service provider supplies most of it, you add processes and responsibilities.

  3. 3

    Go through the guideline point by point

    The controls are answered and backed with evidence: a screenshot of the firewall rules, the log of the restore test, the training attendance list. Open points become measures with a deadline and an owner.

  4. 4

    Connect data protection

    The record of processing activities, data processing agreements and technical measures build on the same inventory. What is evidenced for the guideline also serves as evidence of the technical measures.

  5. 5

    Maintain instead of starting over

    Evidence has an expiry date. Backups are tested regularly, training is repeated, the record is updated when new programs are added. Sightadel reminds you in good time so the status does not go out of date again.

How Sightadel helps

The features that make the difference here.

Guided assessments

The guideline is structured by practice type. You only see the controls that apply to your level, with a clear explanation of what is meant and which evidence fits.

Learn more →

Action plans

Open points become tasks with a deadline. Many of them go to the IT service provider. The provider is invited as a Contributor, does its part directly in Sightadel and stores the evidence.

Learn more →

Evidence archive

Logs, configuration extracts and training records are kept in one place, with date and version. One piece of evidence can serve both the guideline and the technical measures under the GDPR.

Learn more →

Vendor risk

IT service providers, the vendor of the practice management system, laboratories, billing centres and cloud services are tracked with their data processing agreement and assessment.

Learn more →

AI templates

Templates for the emergency plan, backup concept and device usage rules are tailored to practices. You adapt the text to your processes instead of starting from scratch.

Learn more →

Technology and evidence from one source

The practice package: guideline, firewall and evidence together.

The IT security guideline also requires technology, above all a firewall. Together with Valar we offer a package for practices: evidence management in Sightadel and a matching hardware firewall, aligned with each other and with one point of contact. Your IT service provider stays involved.

Practice package

Medical, dental and psychotherapy practices, MVZ and small medical facilities

For hospitals and large MVZ there is a separate hospital package; both are described on the § 390 SGB V page. You receive the offer after a short conversation.

Request the practice package

Effort and duration

An honest estimate.

Single practice or small group practice4–8 weeks
If the IT service provider cooperates. Practice management needs a few hours a week for this, the service provider supplies evidence and closes gaps.
Larger practice or small MVZ2–3 months
More devices, more accounts, often several locations. A fixed contact person in the practice who coordinates implementation pays off here.
MVZ group or laboratory with NIS24–9 months
On top of the guideline come risk management, the reporting chain, the supply chain and management's responsibility for implementation and oversight. The duration depends heavily on the starting point.

The ranges are based on experience, not a promise. The biggest factor is how quickly the IT service provider supplies evidence and closes gaps.

What you license · typically Basic

A typical practice starts with the IT security guideline and data protection in the Basic edition. It includes five users, enough for practice management, the practice manager and the IT service provider. A large MVZ subject to NIS2 adds NIS2, usually in the Professional edition.

Licence per framework, minimum term one year, payable monthly or annually. You will find all prices, discounts and a calculator on the pricing page. Fees of a certification or audit body are charged separately.

Pricing and cost calculatorTry free for 14 days

Questions and answers

Questions about medical and dental practices, MVZ

More in our FAQ or directly via our contact form.

Does the IT security guideline also apply to private practices?

The guideline under § 390 SGB V (German Social Code, Book V) is aimed at practices providing medical and dental care under statutory health insurance. Purely private practices are formally not covered. However, the GDPR obligations on security of processing apply to every practice, and the guideline is a useful benchmark for them.

What is the difference between § 75b and § 390 SGB V?

In substance, none. The provision was renumbered in the Social Code. Many documents and service providers still refer to § 75b. It is the same obligation and the same guideline of the KBV or KZBV.

Our IT service provider says it has implemented everything. Is that enough?

Responsibility stays with the practice. A statement from the service provider is not yet evidence. Invite the provider to Sightadel, then it answers the technical controls itself and stores the evidence. You see the status and decide what is still missing.

Do we need a service provider certified by the KBV?

No. The KBV keeps a directory of certified IT service providers, but using one is voluntary. You can work with any service provider. What matters is that the implementation is evidenced.

Does our MVZ fall under NIS2?

That depends on the size of the operating entity. From 50 employees or more than €10 million in annual turnover and balance sheet total, healthcare providers are generally covered. For groups, the group as a whole may be decisive. Sightadel helps with a structured assessment; the final classification is a legal question for your advisers.

Is there a certificate for implementing the guideline?

No. The guideline does not provide for a certificate for practices. What you can show is an evidenced implementation status. In Sightadel it can be exported as a report, for example for the regional KV, the insurer or a buyer.

Where is the data stored in Sightadel?

Sightadel is developed in Germany and operated in Germany. We conclude a data processing agreement under Art. 28 GDPR with every customer. Patient data does not belong in Sightadel anyway, only the documentation of your measures.

Content reviewed by experts on 8 October 2026 · Not legal advice. The standard or law in its current version is authoritative.

Start with one standard.

14 days, full access, no payment details. Everything you set up carries over into the paid plan.

Try free for 14 daysTalk to us