Greater Cybersecurity for Doctors and Medical Practices
IT Security Guidelines
As of October 1, 2025, all medical practices are required to comply with the KBV’s IT security policy
. The goal is to protect sensitive patient data from
hackers.
Those who fail to meet the requirements risk fee reductions,
fines, and, in serious cases, damage to their reputation.
Officially listed with the KBV
KBV Certified
We are officially certified by the KBV as an IT security service provider. To be recognized as a certified service provider, comprehensive expertise, documentation, certifications, and examinations are required.
Our expertise is certified
Guideline Pursuant to Section 390 of SGB V on the Requirements for Ensuring IT Security
IT Security Guidelines
The KBV’s IT security policy, pursuant to Section 390 of SGB V, requires medical and psychotherapy practices to ensure the protection of sensitive patient data in accordance with clearly defined security standards. It outlines mandatory requirements for IT security in medical practices, including network protection, access controls, data backup, patch management, and the secure operation of the telematics infrastructure (TI).
The goal is to prevent cyberattacks, avoid system failures, and strengthen trust in digital healthcare processes.
As a KBV-certified company, Apollon Security supports practices and medical facilities in efficiently and practically implementing the KBV IT security requirements—from analysis and technical hardening to audit-ready documentation. This results in true information security that protects rather than overwhelms.
Praxisgrößen und Anforderungskategorien
Kleine Praxis
Einzelpraxis oder kleine Berufsausübungsgemeinschaft mit wenigen Beschäftigten (i.d.R. 1–5 Personen).
- Einzelarztpraxis für Allgemeinmedizin
- Einzelpraxis für Psychotherapie
- Kleine Facharztpraxis mit minimalem IT-Betrieb
Mittlere Praxis
Berufsausübungsgemeinschaften oder größere Praxen mit mehreren Ärztinnen und Ärzten (6–20 Beschäftigte).
- Gemeinschaftspraxis mit mehreren Fachrichtungen
- MVZ mit mehreren Standorten
- Praxis mit eigenem Praxisverwaltungssystem (PVS) und mehreren Netzwerkkomponenten
Große Praxis / Medizinisches Versorgungszentrum (MVZ)
Größere medizinische Einrichtungen oder MVZ mit mehr als 20 Beschäftigten und komplexer IT-Infrastruktur.
- Großes MVZ mit Laboranbindung
- Radiologiezentrum mit eigener IT
- Fachkliniken mit ambulanter Versorgung
Examples of security measures in accordance with KBV IT security guidelines
Industry:
Medicine
Role:
Service for Ensuring IT Security - Bronze Package
Areas of Responsibility:
- Analysis of existing IT security measures in accordance with KBV guidelines
- Establishment of a cyber awareness training program
- Implementation of professional antivirus software, including monitoring by cybersecurity experts
- Definition and implementation of incident management processes
- Creation of templates for IT security, onboarding, offboarding, etc.
- Backup policies & processes
- Establishment of patch management processes
- Smartphone and tablet security
- Email Security
Industry:
Medicine
Role:
Service for Ensuring IT Security - Silver Package
Areas of Responsibility:
- Analysis of existing IT security measures in accordance with KBV guidelines
- Establishment of a cyber awareness training program
- Implementation of professional antivirus software, including monitoring by cybersecurity experts
- Definition and implementation of incident management processes
- Creation of templates for IT security, onboarding, offboarding, etc.
- Backup policies & processes
- Establishment of patch management processes
- Smartphone and tablet security
- Email Security
Industry:
Medicine
Role:
Service for Ensuring IT Security - Bronze Package
Areas of Responsibility:
- Analysis of existing IT security measures in accordance with KBV guidelines
- Establishment of a cyber awareness training program
- Implementation of professional antivirus software, including monitoring by cybersecurity experts
- Definition and implementation of incident management processes
- Creation of templates for IT security, onboarding, offboarding, etc.
- Backup policies & processes
- Establishment of patch management processes
- Smartphone and tablet security
- Email Security
Industry:
Medicine
Role:
Service for Ensuring IT Security - Silver Package
Areas of Responsibility:
- Analysis of existing IT security measures in accordance with KBV guidelines
- Establishment of a cyber awareness training program
- Implementation of professional antivirus software, including monitoring by cybersecurity experts
- Definition and implementation of incident management processes
- Creation of templates for IT security, onboarding, offboarding, etc.
- Backup policies & processes
- Establishment of patch management processes
- Smartphone and tablet security
- Email Security
Industry:
Medicine
Role:
Service for Ensuring IT Security - Bronze Package
Areas of Responsibility:
- Analysis of existing IT security measures in accordance with KBV guidelines
- Establishment of a cyber awareness training program
- Implementation of professional antivirus software, including monitoring by cybersecurity experts
- Definition and implementation of incident management processes
- Creation of templates for IT security, onboarding, offboarding, etc.
- Backup policies & processes
- Establishment of patch management processes
- Smartphone and tablet security
- Email Security
Industry:
Medicine
Role:
Service for Ensuring IT Security - Bronze Package
Areas of Responsibility:
- Analysis of existing IT security measures in accordance with KBV guidelines
- Establishment of a cyber awareness training program
- Implementation of professional antivirus software, including monitoring by cybersecurity experts
- Definition and implementation of incident management processes
- Creation of templates for IT security, onboarding, offboarding, etc.
- Backup policies & processes
- Establishment of patch management processes
- Smartphone and tablet security
- Email Security
Industry:
Medicine
Position:
Service for Ensuring IT Security - Gold Package
Areas of Responsibility:
- Analysis of existing IT security measures in accordance with KBV guidelines
- Establishment of a cyber awareness training program
- Implementation of professional antivirus software, including monitoring by cybersecurity experts
- Definition and implementation of incident management processes
- Creation of templates for IT security, onboarding, offboarding, etc.
- Backup policies & processes
- Establishment of patch management processes
- Smartphone and tablet security
- Email Security
Industry:
Medicine
Role:
Service for Ensuring IT Security - Silver Package
Areas of Responsibility:
- Analysis of existing IT security measures in accordance with KBV guidelines
- Establishment of a cyber awareness training program
- Implementation of professional antivirus software, including monitoring by cybersecurity experts
- Definition and implementation of incident management processes
- Creation of templates for IT security, onboarding, offboarding, etc.
- Backup policies & processes
- Establishment of patch management processes
- Smartphone and tablet security
- Email Security
Industry:
Medicine
Role:
Service for Ensuring IT Security - Bronze Package
Areas of Responsibility:
- Analysis of existing IT security measures in accordance with KBV guidelines
- Establishment of a cyber awareness training program
- Implementation of professional antivirus software, including monitoring by cybersecurity experts
- Definition and implementation of incident management processes
- Creation of templates for IT security, onboarding, offboarding, etc.
- Backup policies & processes
- Establishment of patch management processes
- Smartphone and tablet security
- Email Security
Industry:
Medicine
Role:
Service for Ensuring IT Security - Silver Package
Areas of Responsibility:
- Analysis of existing IT security measures in accordance with KBV guidelines
- Establishment of a cyber awareness training program
- Implementation of professional antivirus software, including monitoring by cybersecurity experts
- Definition and implementation of incident management processes
- Creation of templates for IT security, onboarding, offboarding, etc.
- Backup policies & processes
- Establishment of patch management processes
- Smartphone and tablet security
- Email Security
Industry:
Medicine
Role:
Service for Ensuring IT Security - Silver Package
Areas of Responsibility:
- Analysis of existing IT security measures in accordance with KBV guidelines
- Establishment of a cyber awareness training program
- Implementation of professional antivirus software, including monitoring by cybersecurity experts
- Definition and implementation of incident management processes
- Creation of templates for IT security, onboarding, offboarding, etc.
- Backup policies & processes
- Establishment of patch management processes
- Smartphone and tablet security
- Email Security
Industry:
Medicine
Role:
Service for Ensuring IT Security - Silver Package
Areas of Responsibility:
- Analysis of existing IT security measures in accordance with KBV guidelines
- Establishment of a cyber awareness training program
- Implementation of professional antivirus software, including monitoring by cybersecurity experts
- Definition and implementation of incident management processes
- Creation of templates for IT security, onboarding, offboarding, etc.
- Backup policies & processes
- Establishment of patch management processes
- Smartphone and tablet security
- Email Security
Where are the requirements listed?
Links & Information on the Requirements
- List of KBV-Certified Providers (LINK)
- IT Security Requirements for Small Medical Practices (LINK)
- Requirements for medium-sized medical practices (LINK)
- Requirements for large medical practices (LINK)
- Requirements for large medical devices (LINK)
- Requirements for Decentralized Components of the Telematics Infrastructure (LINK)
- Continuing Education (LINK)
- Sample Documents (LINK)
FAQs
The directive applies to all medical and psychotherapy practices connected to the telematics infrastructure—regardless of specialty or practice size. The requirements are tiered according to practice size (small, medium, large) to enable practical implementation.
The most important measures include firewall protection, up-to-date antivirus software, regular data backups, strong passwords, patch management, encryption of sensitive data, and access controls. Organizational processes such as emergency management and training are also mandatory.
The practice owner is responsible for implementing the KBV guidelines. However, day-to-day management can be outsourced to external IT service providers or information security officers—but overall responsibility remains with the practice.
A lack of or inadequate protective measures can lead to data breaches, system failures, and, in the worst case, fines under the GDPR. In addition, the KBV may require corrective measures in the event of serious violations.
Medical practices must regularly review and document their IT security measures—at least once a year. In the event of major changes to the infrastructure (e.g., server migration, new software), an immediate reassessment is required.
The classification is based on the number of employees and the complexity of the IT infrastructure:
- Small practices: up to 5 employees
- Medium-sized practices: 6–20 employees
- Large practices / medical care centers: more than 20 employees
The larger the practice, the more extensive the IT security requirements.
IT is the digital backbone of healthcare. Medical practices must ensure the secure operation and protection of this connection—including access management, physical security, and up-to-date connectors. Violations can compromise IT access.
Apollon Security assists medical practices in fully implementing the KBV IT Security Policy—from the initial analysis through technical security measures to audit-ready documentation. The focus is on practical, efficient solutions that provide protection without disrupting day-to-day operations.