IT Security in Healthcare – What Practices Can Learn from Hospitals

Hospitals have invested a lot in IT security in recent years. They work with very sensitive data and have to function around the clock. The nice thing: many of their ideas transfer well to small medical, dental and therapy practices – often with simple means and with open source.

What hospitals do particularly well

Good hospital IT follows a few clear principles:

• Overview: There's a list of all systems and data.
• Layers: Important areas are separated so that one problem doesn't affect everything.
• Backups: Data is backed up regularly, with a copy kept separately.
• Emergency plans: Everyone knows what to do if a system fails.
• Training: The team recognises suspicious emails and knows how to react.

Larger hospitals have their own requirements for this, for example from NIS2 implementation and sector-specific security standards.

And in a practice?

For practices in Germany, there's the IT security guideline of the National Association of Statutory Health Insurance Physicians (KBV). It describes which measures make sense depending on the size of the practice. The ideas are the same as in a hospital – just on a smaller scale. You'll find more in my article on the KBV guideline.

Where open source helps in a practice

The practice management system is usually specialised software. But open source is excellent for a lot of what goes on around it:

Especially with health data, it's reassuring to know where everything is – for example on a server in the practice or in a German data centre.

A relaxed start

1. Make a list: Which devices, programs and services are there?
2. Secure the basics: Updates, antivirus, two-factor login, password manager.
3. Backups: Regular, encrypted and tested once.
4. Check everyday tools: Where are files and messages today?
5. Small training session: Half an hour on suspicious emails works wonders.

A few terms, briefly explained

• Special categories of personal data: Under the GDPR, these include health data. Particularly high requirements apply to them.
• Telematics infrastructure (TI): The secure network of German healthcare, used for things like e-prescriptions and electronic patient records.
• Network segmentation: Dividing a network into separate areas, for example for practice PCs, guest Wi-Fi and medical devices.
• 3-2-1 rule: Three copies of your data, on two different media, one of them in another location.

An example from a small practice

A GP practice with seven staff takes a look at its everyday IT. The practice management system runs smoothly, but rotas, forms and internal notes are scattered across individual computers and private messengers. The practice decides on a few simple steps:

1. A Nextcloud on a small server in the practice for forms and rotas.
2. An encrypted Matrix chat for internal coordination instead of private messengers.
3. Vaultwarden, so all logins are stored securely in one place.
4. A guest Wi-Fi that's separate from the practice network.
5. Encrypted backups following the 3-2-1 rule.

That makes everyday life clearer – and the sensitive data stays where it belongs.

Note

I'm an IT service provider and external information security officer, but not a legal adviser. What exactly applies in your case is best clarified with your regional physicians' association, your data protection adviser or a lawyer. I'm happy to help with implementation – more under Consulting.

Conclusion

What hospitals do on a large scale works in a small practice too: overview, backups, clear processes and tools where you know where your data is. Open source is a friendly and affordable building block for this.

If you'd like to give it a try, I'm happy to help – just drop me a line.