What is the KBV IT security guideline?

Under § 390 of the German Social Code Book V, the National Association of Statutory Health Insurance Physicians (KBV) sets out in a guideline which IT security requirements apply to practices. For dental practices, there's a corresponding guideline from the KZBV.

Does the guideline apply equally to every practice?

No. The guideline differentiates by practice size and special situations, for example when large medical devices are used. The bigger the practice, the more requirements apply.

Can I use cloud services in my practice?

The guideline doesn't generally prohibit cloud services, but it sets requirements for handling data and applications securely. With health data, it's especially worth knowing exactly where it's stored. If in doubt, your regional physicians' association or a data protection adviser can help.

Snowblueyour IT service for open source

Write to me

Practical Tip·Oct 6, 2026

The KBV IT Security Guideline – Simply Explained for Your Practice

What the IT security guideline under § 390 SGB V means for medical, dental and psychotherapy practices in Germany and how to implement it step by step.

Michael Wolf

The KBV IT Security Guideline – Simply Explained for Your Practice

In medical, dental and psychotherapy practices, very personal data is handled every day. To keep it well protected, Germany has the IT security guideline of the National Association of Statutory Health Insurance Physicians (KBV) under § 390 SGB V. For dental practices, there's a corresponding guideline from the KZBV. It sounds like a lot of paperwork at first – but it's very doable. Here's a friendly overview.

What is the guideline about?

The guideline describes minimum requirements for IT security in practices. It's divided into annexes based on practice size and special situations. Roughly, it distinguishes:

Category	In short
Practice	Smaller practices with few staff
Medium practice	Somewhat larger teams
Large practice	Practices with many staff or extensive data processing
Additional annexes	e.g. for large medical devices or decentralised components of the telematics infrastructure

You'll find the exact thresholds and requirements directly in the guideline on the KBV website.

Typical requirements

Many requirements are common sense and quick to implement:

Updates for operating systems and programs installed promptly
Antivirus on all computers
Secure passwords and, where possible, two-factor login
Protect the network, for example with a well-configured firewall
Backups made regularly, with restoring tested
Apps and online services chosen consciously
Devices disposed of securely, so no data is left behind

How open source helps in a practice

Your practice management system stays as it is, of course. But open source can be a nice solution for much of what goes on around it:

Task	Open-source solution	Benefit
Documents and file storage	Nextcloud	Data on a server you know
Internal communication	Element (Matrix)	Encrypted, on your own server
Passwords	Vaultwarden	Secure passwords for the whole team
Backups	e.g. Restic or BorgBackup	Encrypted and automated

Especially with health data, it feels good to know where everything is – for example on a small server in the practice or in a German data centre.

A relaxed roadmap

Determine your category: Which annexes apply to your practice?
Make a list: Devices, programs, services.
Implement the basics: Updates, antivirus, passwords, backups.
Bring the team along: A short session on suspicious emails works wonders.
Document: A short overview of what's been implemented.

You can get help with implementation. The KBV also refers to certified service providers in this context. What exactly applies to your practice is best clarified with your regional physicians' association.

A few terms, briefly explained

SGB V: Book Five of the German Social Code, which governs statutory health insurance.
Telematics infrastructure (TI): The secure network of German healthcare, for example for e-prescriptions and electronic patient records.
Connector: The device that links the practice to the telematics infrastructure.
Firewall: Protection that controls which connections into and out of the network are allowed.

An example from a psychotherapy practice

A psychotherapist works alone with a part-time administrator. She calmly goes through the requirements for small practices and finds that a lot is already in place. She takes on a few points:

Turn on automatic updates for the computer and phone.
Introduce a password manager and store all logins there.
Set up regular, encrypted backups to a second drive.
Separate the patient Wi-Fi from the practice network.
Create a short overview of what's been implemented.

After two afternoons, everything is done. Once a year she goes through the list again.

Frequently asked questions

Do I need to know the guideline by heart? No. It's enough to go through the requirements that apply to your practice once and document what you've implemented.

Do I need expensive specialist software? For many requirements, no. Built-in operating system tools and proven open-source tools cover a large part.

Note

I'm an IT service provider and external information security officer, but not a legal adviser. I'm happy to help with the practical side – more under Consulting and Support.

Conclusion

The IT security guideline sounds bigger than it is. With a good list, a few solid basics and tools where you know where your data is, your practice is in good shape.

If you'd like to give it a try, I'm happy to help – just drop me a line.

openDesk in Municipalities – How Towns Use Open Source Day to Day

More and more municipalities in Germany and Switzerland are trying openDesk and other open-source solutions. What that shows and what you can learn.

Taking Your Data with You – Portability, the DMA and Open Formats

With the DMA and the Data Act, the EU is strengthening the right to take your data along. What data portability means and how open formats keep you flexible.