Healthcare cloud and section 393 SGB V: Assess scope and C5 evidence precisely
Section 393 sets specific cloud conditions and exceptions. A German server location or an arbitrary ISO certificate is not a complete assessment.
Revisione editoriale:
In questa versione del sito il testo dell’articolo è disponibile in inglese.
Contesto e fonti
Section 393(1) SGB V identifies providers within Chapter Four of SGB V, health and care insurers and their respective processors. It does not automatically cover every organisation merely because it supplies SGB XI care services. Establish the relevant role and processing first. [1]
Covered processing requires permitted locations, a German establishment, appropriate security, relevant current C5 evidence and implementation of the report's complementary customer controls. A Frankfurt data centre alone does not establish those conditions. [1]
C5 Type 2 generally applies from 1 July 2025. Paragraph 4 provides a specific 18-month Type 1 route for systems first placed on the market after 30 June 2025, and an alternative for comparable or stronger standards. An arbitrary ISO certificate is not automatically equivalent. [1]
Professional-secrecy requirements for necessary service-provider involvement remain a separate issue under section 203 of the German Criminal Code. [2]
Ambito e limiti
A C5 attestation is not blanket BSI certification of an entire care facility. Review service scope, period and customer controls. Applicability of exceptions requires case-specific assessment.
Spiegato in modo semplice
Fictional example: A vendor provides its infrastructure operator's report. The buyer checks which parts of the actual care application are covered and which customer controls remain its responsibility.
Raccomandazioni pratiche
Our recommendation: Record scope and data types first. Obtain the relevant report, coverage, period, findings and customer obligations. Clarify gaps between infrastructure and application evidence.
Review locations, support, subprocessors and confidentiality. Assign incident and evidence-update responsibilities. Test export, restoration and supplier exit as separate operational requirements.