[{"data":1,"prerenderedAt":485},["ShallowReactive",2],{"navigation-docs_en":3,"/en/blog/kbv-it-security-guideline-390-sgb-v-medical-practices-microsoft-365-october-2026-posts_en":51,"/en/blog/kbv-it-security-guideline-390-sgb-v-medical-practices-microsoft-365-october-2026-surround-posts_en":474},[4],{"title":5,"path":6,"stem":7,"children":8,"page":25},"En","/en","en",[9],{"title":10,"path":11,"stem":12,"children":13,"page":25},"Docs","/en/docs","en/1.docs",[14,26],{"title":15,"path":16,"stem":17,"children":18,"icon":25},"Getting Started","/en/docs/getting-started","en/1.docs/1.getting-started/1.index",[19,21],{"title":20,"path":16,"stem":17,"children":-1},"Introduction",{"title":22,"path":23,"stem":24,"children":-1},"Migration Roadmap","/en/docs/getting-started/migration-fahrplan","en/1.docs/1.getting-started/2.migration-fahrplan",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Technologies","/en/docs/technologies","en/1.docs/2.technologies",[31,35,39,43,47],{"title":32,"path":33,"stem":34,"children":-1},"Nextcloud","/en/docs/technologies/nextcloud","en/1.docs/2.technologies/1.nextcloud",{"title":36,"path":37,"stem":38,"children":-1},"Matrix / Element","/en/docs/technologies/matrix","en/1.docs/2.technologies/2.matrix",{"title":40,"path":41,"stem":42,"children":-1},"ONLYOFFICE","/en/docs/technologies/onlyoffice","en/1.docs/2.technologies/3.onlyoffice",{"title":44,"path":45,"stem":46,"children":-1},"Ubuntu Linux","/en/docs/technologies/ubuntu","en/1.docs/2.technologies/4.ubuntu",{"title":48,"path":49,"stem":50,"children":-1},"Keycloak","/en/docs/technologies/keycloak","en/1.docs/2.technologies/5.keycloak",{"id":52,"title":53,"authors":54,"badge":60,"body":62,"date":433,"description":434,"extension":435,"faq":436,"howto":446,"image":466,"meta":468,"navigation":469,"path":470,"seo":471,"stem":472,"__hash__":473},"posts_en/en/3.blog/32.kbv-it-security-guideline-390-sgb-v-medical-practices-microsoft-365-october-2026.md","The KBV IT Security Guideline – Simply Explained for Your Practice",[55],{"name":56,"to":57,"avatar":58},"Michael Wolf","/en/about",{"src":59},"/michael.webp",{"label":61},"Practical Tip",{"type":63,"value":64,"toc":420},"minimark",[65,69,82,87,90,150,153,157,160,206,210,213,272,275,279,312,315,319,345,349,352,369,372,376,382,388,392,406,410,413],[66,67,53],"h1",{"id":68},"the-kbv-it-security-guideline-simply-explained-for-your-practice",[70,71,72,73,77,78,81],"p",{},"In medical, dental and psychotherapy practices, very personal data is handled every day. To keep it well protected, Germany has the ",[74,75,76],"strong",{},"IT security guideline"," of the National Association of Statutory Health Insurance Physicians (KBV) under ",[74,79,80],{},"§ 390 SGB V",". For dental practices, there's a corresponding guideline from the KZBV. It sounds like a lot of paperwork at first – but it's very doable. Here's a friendly overview.",[83,84,86],"h2",{"id":85},"what-is-the-guideline-about","What is the guideline about?",[70,88,89],{},"The guideline describes minimum requirements for IT security in practices. It's divided into annexes based on practice size and special situations. Roughly, it distinguishes:",[91,92,93,106],"table",{},[94,95,96],"thead",{},[97,98,99,103],"tr",{},[100,101,102],"th",{},"Category",[100,104,105],{},"In short",[107,108,109,120,130,140],"tbody",{},[97,110,111,117],{},[112,113,114],"td",{},[74,115,116],{},"Practice",[112,118,119],{},"Smaller practices with few staff",[97,121,122,127],{},[112,123,124],{},[74,125,126],{},"Medium practice",[112,128,129],{},"Somewhat larger teams",[97,131,132,137],{},[112,133,134],{},[74,135,136],{},"Large practice",[112,138,139],{},"Practices with many staff or extensive data processing",[97,141,142,147],{},[112,143,144],{},[74,145,146],{},"Additional annexes",[112,148,149],{},"e.g. for large medical devices or decentralised components of the telematics infrastructure",[70,151,152],{},"You'll find the exact thresholds and requirements directly in the guideline on the KBV website.",[83,154,156],{"id":155},"typical-requirements","Typical requirements",[70,158,159],{},"Many requirements are common sense and quick to implement:",[161,162,163,170,176,182,188,194,200],"ul",{},[164,165,166,169],"li",{},[74,167,168],{},"Updates"," for operating systems and programs installed promptly",[164,171,172,175],{},[74,173,174],{},"Antivirus"," on all computers",[164,177,178,181],{},[74,179,180],{},"Secure passwords"," and, where possible, two-factor login",[164,183,184,187],{},[74,185,186],{},"Protect the network",", for example with a well-configured firewall",[164,189,190,193],{},[74,191,192],{},"Backups"," made regularly, with restoring tested",[164,195,196,199],{},[74,197,198],{},"Apps and online services"," chosen consciously",[164,201,202,205],{},[74,203,204],{},"Devices disposed of securely",", so no data is left behind",[83,207,209],{"id":208},"how-open-source-helps-in-a-practice","How open source helps in a practice",[70,211,212],{},"Your practice management system stays as it is, of course. But open source can be a nice solution for much of what goes on around it:",[91,214,215,228],{},[94,216,217],{},[97,218,219,222,225],{},[100,220,221],{},"Task",[100,223,224],{},"Open-source solution",[100,226,227],{},"Benefit",[107,229,230,240,251,262],{},[97,231,232,235,237],{},[112,233,234],{},"Documents and file storage",[112,236,32],{},[112,238,239],{},"Data on a server you know",[97,241,242,245,248],{},[112,243,244],{},"Internal communication",[112,246,247],{},"Element (Matrix)",[112,249,250],{},"Encrypted, on your own server",[97,252,253,256,259],{},[112,254,255],{},"Passwords",[112,257,258],{},"Vaultwarden",[112,260,261],{},"Secure passwords for the whole team",[97,263,264,266,269],{},[112,265,192],{},[112,267,268],{},"e.g. Restic or BorgBackup",[112,270,271],{},"Encrypted and automated",[70,273,274],{},"Especially with health data, it feels good to know where everything is – for example on a small server in the practice or in a German data centre.",[83,276,278],{"id":277},"a-relaxed-roadmap","A relaxed roadmap",[280,281,282,288,294,300,306],"ol",{},[164,283,284,287],{},[74,285,286],{},"Determine your category:"," Which annexes apply to your practice?",[164,289,290,293],{},[74,291,292],{},"Make a list:"," Devices, programs, services.",[164,295,296,299],{},[74,297,298],{},"Implement the basics:"," Updates, antivirus, passwords, backups.",[164,301,302,305],{},[74,303,304],{},"Bring the team along:"," A short session on suspicious emails works wonders.",[164,307,308,311],{},[74,309,310],{},"Document:"," A short overview of what's been implemented.",[70,313,314],{},"You can get help with implementation. The KBV also refers to certified service providers in this context. What exactly applies to your practice is best clarified with your regional physicians' association.",[83,316,318],{"id":317},"a-few-terms-briefly-explained","A few terms, briefly explained",[161,320,321,327,333,339],{},[164,322,323,326],{},[74,324,325],{},"SGB V:"," Book Five of the German Social Code, which governs statutory health insurance.",[164,328,329,332],{},[74,330,331],{},"Telematics infrastructure (TI):"," The secure network of German healthcare, for example for e-prescriptions and electronic patient records.",[164,334,335,338],{},[74,336,337],{},"Connector:"," The device that links the practice to the telematics infrastructure.",[164,340,341,344],{},[74,342,343],{},"Firewall:"," Protection that controls which connections into and out of the network are allowed.",[83,346,348],{"id":347},"an-example-from-a-psychotherapy-practice","An example from a psychotherapy practice",[70,350,351],{},"A psychotherapist works alone with a part-time administrator. She calmly goes through the requirements for small practices and finds that a lot is already in place. She takes on a few points:",[280,353,354,357,360,363,366],{},[164,355,356],{},"Turn on automatic updates for the computer and phone.",[164,358,359],{},"Introduce a password manager and store all logins there.",[164,361,362],{},"Set up regular, encrypted backups to a second drive.",[164,364,365],{},"Separate the patient Wi-Fi from the practice network.",[164,367,368],{},"Create a short overview of what's been implemented.",[70,370,371],{},"After two afternoons, everything is done. Once a year she goes through the list again.",[83,373,375],{"id":374},"frequently-asked-questions","Frequently asked questions",[70,377,378,381],{},[74,379,380],{},"Do I need to know the guideline by heart?","\nNo. It's enough to go through the requirements that apply to your practice once and document what you've implemented.",[70,383,384,387],{},[74,385,386],{},"Do I need expensive specialist software?","\nFor many requirements, no. Built-in operating system tools and proven open-source tools cover a large part.",[83,389,391],{"id":390},"note","Note",[70,393,394,395,400,401,405],{},"I'm an IT service provider and external information security officer, but not a legal adviser. I'm happy to help with the practical side – more under ",[396,397,399],"a",{"href":398},"/en/consulting","Consulting"," and ",[396,402,404],{"href":403},"/en/support","Support",".",[83,407,409],{"id":408},"conclusion","Conclusion",[70,411,412],{},"The IT security guideline sounds bigger than it is. With a good list, a few solid basics and tools where you know where your data is, your practice is in good shape.",[70,414,415,416,405],{},"If you'd like to give it a try, I'm happy to help – ",[396,417,419],{"href":418},"/en/contact","just drop me a line",{"title":421,"searchDepth":422,"depth":422,"links":423},"",2,[424,425,426,427,428,429,430,431,432],{"id":85,"depth":422,"text":86},{"id":155,"depth":422,"text":156},{"id":208,"depth":422,"text":209},{"id":277,"depth":422,"text":278},{"id":317,"depth":422,"text":318},{"id":347,"depth":422,"text":348},{"id":374,"depth":422,"text":375},{"id":390,"depth":422,"text":391},{"id":408,"depth":422,"text":409},"2026-10-06T00:00:00.000Z","What the IT security guideline under § 390 SGB V means for medical, dental and psychotherapy practices in Germany and how to implement it step by step.","md",[437,440,443],{"q":438,"a":439},"What is the KBV IT security guideline?","Under § 390 of the German Social Code Book V, the National Association of Statutory Health Insurance Physicians (KBV) sets out in a guideline which IT security requirements apply to practices. For dental practices, there's a corresponding guideline from the KZBV.",{"q":441,"a":442},"Does the guideline apply equally to every practice?","No. The guideline differentiates by practice size and special situations, for example when large medical devices are used. The bigger the practice, the more requirements apply.",{"q":444,"a":445},"Can I use cloud services in my practice?","The guideline doesn't generally prohibit cloud services, but it sets requirements for handling data and applications securely. With health data, it's especially worth knowing exactly where it's stored. If in doubt, your regional physicians' association or a data protection adviser can help.",{"name":447,"description":448,"totalTime":449,"steps":450},"Implementing the KBV guideline in your practice","Five steps to organise IT security in your practice in a relaxed way.","P4W",[451,454,457,460,463],{"name":452,"text":453},"Determine practice size","Check in the guideline which category applies to your practice and pick out the relevant requirements.",{"name":455,"text":456},"Take stock","List all computers, phones, printers, routers, programs and online services in the practice.",{"name":458,"text":459},"Implement the basics","Set up updates, antivirus, secure passwords, protected networks and regular backups.",{"name":461,"text":462},"Involve the team","Give the team a short session on secure passwords and suspicious emails.",{"name":464,"text":465},"Document","Briefly record the measures you've implemented and review them once a year.",{"src":467},"/img/blog/photo-1538108149393-fbbd81895907.webp",{},true,"/en/blog/kbv-it-security-guideline-390-sgb-v-medical-practices-microsoft-365-october-2026",{"title":53,"description":434},"en/3.blog/32.kbv-it-security-guideline-390-sgb-v-medical-practices-microsoft-365-october-2026","5IEXzEG799IGg2aY2Rg3BjT-ria3vDS9k4Ki6_VVTGM",[475,480],{"title":476,"path":477,"stem":478,"description":479,"children":-1},"openDesk in Municipalities – How Towns Use Open Source Day to Day","/en/blog/opendesk-municipal-mainstream-neuburg-oberkirch-swiss-federal-chancellery-2026","en/3.blog/31.opendesk-municipal-mainstream-neuburg-oberkirch-swiss-federal-chancellery-2026","More and more municipalities in Germany and Switzerland are trying openDesk and other open-source solutions. What that shows and what you can learn.",{"title":481,"path":482,"stem":483,"description":484,"children":-1},"Taking Your Data with You – Portability, the DMA and Open Formats","/en/blog/dma-azure-gatekeeper-november-2026-portability-exit-microsoft-365","en/3.blog/33.dma-azure-gatekeeper-november-2026-portability-exit-microsoft-365","With the DMA and the Data Act, the EU is strengthening the right to take your data along. What data portability means and how open formats keep you flexible.",1792720367125]