Mag. iur. Alexander Viehhauser

Mag. iur. Alexander Viehhauser is Corporate Counsel at medudoc, where he advises on legal and data protection issues relating to digital patient intake. His areas of focus are medical and health law, data protection and regulatory compliance for digital health solutions in the DACH region.

Articles

• Law & regulation

  SES, AES or QES for surgical informed consent — which eIDAS level is legally sound? A factual assessment for hospitals in the DACH region.

  For standard surgical informed consent, medical law in Germany and Austria does not prescribe a specific signature level. An advanced electronic signature (AES) is generally sufficient if it is embedded in a complete consent trail. The qualified electronic signature (QES) is the appropriate instrument for clinical trials under the AMG or MPDG, or where required by compliance or the liability insurer. A simple electronic signature (SES) — such as a finger signature on a tablet without proof of identity — is in principle not sufficient under medical law.

  October 9, 2026 · 11 min read
• Law & regulation

  ISO 27001 and BSI C5: what hospital IT managers need to check when selecting digital patient intake software

  ISO/IEC 27001 confirms an audited information security management system — the certificate is only meaningful with a suitable scope and a valid term. BSI C5 specifically audits cloud services; a Type 2 attestation additionally demonstrates the operating effectiveness of the controls over a period of time. Before signing a contract, hospitals should clarify five questions in writing: where data is processed, client separation, documented technical and organisational measures (TOMs), a data processing agreement under Art. 28 GDPR, and incident management.

  October 9, 2026 · 8 min read
• Law & regulation

  Cloud or on-premise in hospitals: what IT security and liability law actually require

  Since 2024, the German legislator has expressly permitted cloud use for health data in § 393 SGB V — under clearly defined, verifiable conditions: processing in Germany or in the EU, an establishment of the processing entity in Germany, technical and organisational measures in line with the state of the art, and a current BSI C5 attestation. A blanket “cloud is not an option for us” is therefore no longer a legal position but an operational decision, subject to the same obligations to provide evidence as any other. What matters is not where the data is processed, but who operates an internet-facing service — and who can prove that the protective measures were adequate in the event of a dispute.

  August 31, 2026 · 20 min read
• Law & regulation

  Burden of proof for informed consent: why a signature is not enough in a liability case

  Under Section 630h(2) of the German Civil Code (BGB), the treating party bears the burden of proving patient information and consent — not the patient. A signed consent form only proves that a document was signed, not that the patient was informed individually, comprehensibly and in good time. The hospital's position becomes robust when the entire consent process can be reconstructed: which content was viewed when, which questions were asked and when the document was signed. In Austria, established OGH case law applies a comparable allocation of the burden of proof.

  July 7, 2026 · 7 min read
• Law & regulation

  Telemedical consent discussion: the legal position for ASA I/II patients in Germany and Austria

  In Germany and Austria, the prevailing view holds that a fully telemedical consent discussion for patients in risk classes ASA I and ASA II before straightforward elective procedures is permissible, provided the relevant requirements are met. What is required is a genuine real-time conversation with a physician — by video or by telephone — with the opportunity to ask questions, the patient's agreement, timely delivery and documentation that stands up as evidence. A patient education video or a consent sheet alone does not replace this conversation. What changes is not the duty to hold the conversation, but its modality. A ruling by the highest courts specifically on video-assisted consent discussions is still pending in both countries — to that extent, the legal position is not conclusively settled.

  July 6, 2026 · 23 min read