Why healthcare needs special security
An IT outage here affects not only business processes but the duty of care. Cyberattacks on hospitals in recent years have shown what is at stake: emergency care taken offline, postponed treatments, weeks of contingency operation. Cybersecurity is therefore not a pure IT task but a matter for management and the operator, with a direct link to clinical risk management and patient safety.
The regulatory framework
- Section 75c SGB V: Since 2022, all hospitals must align their IT security with the state of the art, regardless of size.
- KRITIS: Hospitals with 30,000 or more full inpatient cases per year are considered critical infrastructure and must regularly demonstrate their measures (Section 8a BSIG).
- NIS-2: Extends the obligations to further institutions in the sector and holds management personally accountable.
- KHZG: Anyone who has received funding must be able to demonstrate its effective use.
- Patient data protection: Health data is among the specially protected data under the GDPR.
What we do for you
- Penetration tests for hospital infrastructure, applications and medical devices, with reports that hold up before operators, auditors and insurers.
- Free CyberRisikoCheck as an assessment for institutions without their own information security function.
- Building and developing an ISMS per BSI IT-Grundschutz or ISO 27001.
- Training and awareness for administration, nursing and IT.
Do you manufacture medical devices with software? For approval evidence per MDR and FDA we have a dedicated page: Medical technology & software as a medical device.
Why zentrust in healthcare
- Experience from the sector: We work for health insurers, hospitals and providers of digital health applications, in Germany and Switzerland.
- Our own security research in health IT: our coordinated disclosures on swisstransplant.ch and meineimpfungen.ch, a publication in the Bundesgesundheitsblatt on data protection and information security for digital health applications (DiGA), and appearances as expert witnesses in committees of the German Bundestag, including on the electronic patient record.
- We know both sides: the testers’ perspective and that of care providers. Our recommendations take into account that security measures must not slow down clinical operations.
- You can find our company certifications about us.