Tag
Articles on IT security
- Law & regulation
ISO 27001 and BSI C5: what hospital IT managers need to check when selecting digital patient intake software
ISO/IEC 27001 confirms an audited information security management system — the certificate is only meaningful with a suitable scope and a valid term. BSI C5 specifically audits cloud services; a Type 2 attestation additionally demonstrates the operating effectiveness of the controls over a period of time. Before signing a contract, hospitals should clarify five questions in writing: where data is processed, client separation, documented technical and organisational measures (TOMs), a data processing agreement under Art. 28 GDPR, and incident management.
· 8 min read - Law & regulation
Cloud or on-premise in hospitals: what IT security and liability law actually require
Since 2024, the German legislator has expressly permitted cloud use for health data in § 393 SGB V — under clearly defined, verifiable conditions: processing in Germany or in the EU, an establishment of the processing entity in Germany, technical and organisational measures in line with the state of the art, and a current BSI C5 attestation. A blanket “cloud is not an option for us” is therefore no longer a legal position but an operational decision, subject to the same obligations to provide evidence as any other. What matters is not where the data is processed, but who operates an internet-facing service — and who can prove that the protective measures were adequate in the event of a dispute.
· 20 min read