Patient data deserves special protection
Medical practices in Germany run almost everything digitally: scheduling, practice management system, telematics infrastructure (TI), electronic patient record (ePA), e-prescriptions. Health data is specially protected under the GDPR. This overview doesn't replace advice from your practice software vendor or legal counsel.
The basis: KBV IT security guideline
Practices under statutory health insurance must follow the binding IT security guideline of the National Association of Statutory Health Insurance Physicians (KBV), with requirements scaled by practice size. Dental practices have equivalent KZBV rules.
1. Devices and updates
- All computers receive security updates; no unsupported systems (see Windows 10)
- Current antivirus
- Quick screen lock, especially at reception
- Reception screens angled away from waiting patients
2. Network
- Connector and TI access integrated per vendor guidance
- Separate networks for practice IT, guest Wi-Fi and medical devices, see office Wi-Fi
- Firewall; remote maintenance only via secured, logged access
3. Access
- Personal accounts instead of one shared login
- Strong passwords or passkeys, MFA for email and remote access (see password managers)
- Rights by role
- Disable leavers' access immediately
4. Backup
- Daily backup of the practice system
- At least one copy separated from the network
- Regular restore tests
- Encrypted backups when they leave the practice
5. Email and communication
- No findings via unencrypted email
- Use KIM (secure healthcare messaging) with other practices and hospitals
- Phishing training, see spotting phishing
6. Providers and contracts
- Data processing agreements with all providers who may access patient data
- EU data centres for cloud services
- Clear emergency responsibilities in an IT emergency plan
Weak spots I often see
- One shared Windows account at reception
- Permanently open remote-maintenance access
- Backups on an always-connected external drive
- A staff member's private phone on the practice Wi-Fi
FAQ
Must a small single practice do everything? Requirements are scaled by size, but the basics apply to everyone.
Who is responsible for the TI? Usually your TI provider or practice software vendor. Put the split with your other IT support in writing.
Conclusion
Good practice IT is a few basics applied consistently. Learn more on IT for healthcare.
