Special requirements in healthcare
Health data is among the most sensitive data categories that exist. GDPR classifies it as a "special category of personal data" under Art. 9 — with enhanced protection requirements and restricted legal bases for processing.
Healthcare organizations are also subject to additional industry-specific rules: the Social Code Books (SGB V, SGB XI), physician-patient confidentiality (§ 203 of the German Criminal Code), state health laws, and a growing set of digital requirements arising from the telematics infrastructure.
Who we work with
- Medical practices (independent practices, group practices)
- Medical care centers (MVZ)
- Hospitals and clinics
- Care facilities (outpatient and inpatient)
- Physiotherapists, dental practices, pharmacies
- Health IT providers (software, apps, platforms)
Typical topics in practice
Practice software and hospital information systems (KIS)
Practice management software (PVS) and hospital information systems (KIS) process highly sensitive patient data. We review:
- Data processing agreements with the software provider
- Access permissions and logging
- Data backup and emergency response planning
Telematics infrastructure (TI)
ePA (electronic patient record), eRezept (e-prescription), KIM — digitalization in healthcare raises new data protection questions. We support you through GDPR-compliant implementation.
Staff training
Medical and nursing staff need practical, hands-on training — not theoretical GDPR lectures. Our training is tailored to everyday life in practices and care facilities.
Data breaches
Patient data accidentally faxed to the wrong number — what now? We help you respond correctly and report the incident to the supervisory authority where required.