Cloud and § 393 SGB V: whom the provision applies to — and which part lies with you

Anyone who wants to know whether they may entrust patient data to a service provider often ends up at § 203 of the German Criminal Code (StGB) and at data protection law. Both are right and both are not enough — at least not if one takes part in care under statutory health insurance (vertragsärztliche Versorgung).

Because then a third provision is added, one that is easily lost in guides on confidentiality, although it contains the most specific requirements of all: § 393 SGB V (German Social Code, Book V).

Whom it applies to — and what it covers

The provision is addressed to service providers within the meaning of Chapter Four of SGB V, to health insurance funds and long-term care insurance funds, and to the processors acting on their behalf.

For drawing the line, the wording speaks in favour of looking at the status of the practitioner — not at how the individual patient is insured. This actor-based reading is an interpretation; we are not aware of any decision specifically on § 393. This is the point at which summaries frequently become inaccurate. § 393 paragraph 1 speaks of “social data and health data”, not of health data of persons with statutory insurance.

The best-known route into this group is the licence (Zulassung), and it is not the only one. Under § 95 paragraph 1 sentence 1 SGB V, “licensed physicians and licensed medical care centres as well as authorised physicians and authorised institutions” take part in care under statutory health insurance; § 72 paragraph 1 sentence 2 extends the provisions of this chapter accordingly to psychotherapists. There is one further case: § 140a paragraph 3b sentence 2 expressly also permits contracts for special care “with service providers not licensed for care under statutory health insurance” — and § 140a is in Chapter Four.

A missing licence alone is therefore not sufficient to draw the line. Four questions lead further:

1. Is there a licence?
2. Is there an authorisation (Ermächtigung)?
3. Is the work done for a practice with a statutory health insurance licence, a medical care centre (MVZ) or an authorised institution? Then what matters is not the personal status of the individual, but for whom the data are processed — anyone who treats there as an employee is not outside for the sole reason that they have no licence of their own.
4. Is there a care contract with a statutory health insurance fund on the basis of which you act as a service provider within the framework of Chapter Four — for example a contract for special care under § 140a?

The consequence that surprises most: if the practitioner belongs to this group, the wording speaks in favour of § 393 covering the cloud processing of their treatment data as a whole — including that of their private patients and self-paying patients. The provision is linked to the actor, not to the individual treatment relationship. We are not aware of any decision that expressly settles this. We consider this reading the more plausible one and name it for what it is: an interpretation, not settled law.

And the case asked about most often: if a psychotherapist without a licence treats a person with statutory insurance in the cost reimbursement procedure (Kostenerstattung), there is, in our interpretation, a good deal to suggest that they do not thereby themselves become a service provider under Chapter Four — the claim to treatment and the claim to payment then exist between them and the patient. § 13 paragraph 2 shows that the law also knows service providers not named in Chapter Four; that is the cost reimbursement chosen by the insured person. The constellation meant here — a service obtained by the patient themselves in the event of a gap in care — is to be assigned to paragraph 3, provided its conditions are met; there, for psychotherapy, the law requires the practitioner to meet the requirements of § 95c — a requirement on qualification, not on the licence. The Berlin-Brandenburg Regional Social Court indirectly supports this classification, but did not decide on § 393. This too is more plausible, not decided.

What is covered is processing by means of a cloud computing service. This term is defined by law — as a digital service that enables on-demand administration and broad remote access to a scalable and elastic pool of shareable computing resources.

This is not a formality: not every external IT service is a cloud computing service. Anyone who runs software on their own hardware and only buys in maintenance is somewhere else. Anyone who uses an application as a service over the network is often here — what is decisive, however, is whether the service meets the statutory characteristics, not the fact that it runs over the network.

Four stages, none of which replaces another

The provision is usually reduced to one sentence — “the provider needs a C5 attestation”. That is one of four requirements, and it is not even the last one.

Stage 1: where processing takes place, and who needs an establishment

Processing may take place in Germany, in a member state of the European Union, in a state treated as equivalent under § 35 paragraph 7 SGB I, or in a third country for which an adequacy decision exists.

In addition — and this is overlooked more often than the processing location — the data-processing body must have an establishment in Germany.

This makes the question of the processing locations within the scope of § 393 not merely interesting under data protection law — the law looks at the place of processing, not only at where servers are located. It is prescribed by social security law, and it has a second half that is rarely asked about.

Stage 2: “state of the art” becomes an audit path

What is required are technical and organisational measures that are appropriate according to the state of the art. At first, that sounds as vague as everywhere else.

For care under statutory health insurance by physicians and dentists, however, it becomes specific: the requirements are deemed appropriate if the conditions of § 390 SGB V are met. And § 390 obliges the National Association of Statutory Health Insurance Physicians (Kassenärztliche Bundesvereinigung) to lay down an IT security guideline — and then declares it binding for the participating service providers.

This guideline is not a guide. It is binding for the service providers taking part in care under statutory health insurance by physicians and dentists, it is graded according to the risk potential, it protects availability, integrity and confidentiality — and it must be reviewed and corrected in content every year and adapted at least every two years to the state of the art and to the risk potential.

For the practice, this is rather good news: a vague legal term becomes a document one can open.

And it becomes more specific still, because the guideline is graded — what is decisive is the number of persons constantly engaged in data processing. Up to five persons, Annex 1 applies, plus Annex 5 insofar as decentralised components of the telematics infrastructure are used. With six to twenty persons, Annex 2 is added; above that — or in the case of data processing on a considerable scale — Annex 3 as well. Large medical devices additionally trigger Annex 4. Only what belongs to the target objects actually present has to be implemented. For the typical single-handed or joint psychotherapy practice, this as a rule means: Annex 1, and Annex 5 insofar as telematics components are present.

Stage 3: C5 — and the alternative that hardly anyone knows

In principle, the law requires a current C5 attestation of the data-processing body, that is, an audit under the Cloud Computing Compliance Criteria Catalogue of the Federal Office for Information Security (BSI).

Two types of attestation have to be distinguished. Until 30 June 2025, an attestation of Type 1 was sufficient; since 1 July 2025, Type 2 has been decisive. For IT systems placed on the market for the first time after 30 June 2025, a Type 1 attestation is sufficient during the first 18 months.

And now the part that is easily overlooked: the law permits equivalent security evidence, determined by statutory ordinance. This ordinance was executed on 19 March 2025 and applies with effect from 1 July 2024. It recognises:

• ISO/IEC 27001 in the version applicable at the time
• ISO 27001 on the basis of IT-Grundschutz
• the Cloud Controls Matrix in version 4.0 in the version applicable at the time

Anyone who concludes from this that an ISO certification is sufficient has read half of it. The alternative is tied to a plan of measures, and its timing is precise: it must document the material gaps with respect to the C5 criteria catalogue, describe the arrangements for closing them and contain milestone planning. The deadlines run from its creation: closing the gaps within twelve months, measures to obtain a C5 attestation of Type 1 within 18 months and of Type 2 within 24 months. On request, the plan and the existing attestation or certificate must be presented without undue delay — to the commissioning service providers and funds as well as to the supervisory authorities.

A subtlety that is worth more in a conversation with a provider than most certificate logos: the ordinance speaks of the attestation or certification of a cloud computing service. An ISO 27001 certificate that has been issued to the company but does not cover the service used is not sufficient for this.

Equivalence is thus not a mere substitute certificate, but tied to a time-bound plan of measures aimed at a C5 attestation.

And one point at which the law leaves a question open that will become important in a moment: the equivalent evidence takes only the place of the C5 attestation — § 393 paragraph 4 sentence 4 speaks expressly of processing “under paragraph 3 number 2”. The fourth requirement, number 3, remains alongside it. It is, however, linked to the customer criteria “contained in the audit report of the attestation” — and an ISO or CCM report does not necessarily set out such criteria in the same form. Neither the law nor the ordinance says expressly how the two fit together. This is not an academic gap, but the question one has to ask a provider with equivalent evidence.

For the conversation with a provider, this gives a better question than “Do you have C5?”. It is: Which evidence do you provide — and if it is an equivalent one: since when, and what is in the plan of measures?

Stage 4: what falls within your responsibility

The fourth requirement is the easiest to overlook, and it makes visible that responsibility is shared.

§ 393 additionally requires the implementation of the corresponding criteria for customers contained in the audit report of the attestation.

Insofar as the audit report contains corresponding customer criteria, it describes not only what the provider does, but also measures that the customer has to implement so that the level of security is achieved at all. The C5 catalogue in the version C5:2020 sets out such criteria, for example, for the authentication mechanisms: the customer has to actually use the mechanisms provided by the provider in accordance with its own rules on identity and access management. Since April 2026, the version C5:2026 has been available; for audit periods from 1 June 2027, only it applies.

This names a misconception that persists stubbornly: “The provider has an attestation, so we are done.” Insofar as the corresponding customer criteria concern the practice, it must implement them itself.

Which ones these are depends on the service model. With an infrastructure service, typically more tasks lie with the customer; with a ready-made application, the same responsibility can typically lie with the provider. The customer criteria are exactly the place where this division becomes visible.

If a control list has been published for the attested system, the practice does not have to work out the customer criteria itself from the complete audit report. The law provides for such a control list on the corresponding criteria for customers: anyone who applies for the publication of an attested cloud system must enclose it with the application (§ 393 paragraph 7). Asking for it is therefore the shorter route — but one should not rely on it existing for every service, because publication requires an application.

What to ask the provider

Five questions that follow from the four stages and can be asked without prior knowledge:

1. In which places is processing carried out — including maintenance, support and backup —, and does the data-processing body have an establishment in Germany?

2. Which security evidence exists: a C5 attestation, and of which type? Or equivalent evidence?

3. If equivalent: does the scope of the evidence specifically cover the service we use? Does the associated plan of measures exist, since when has the milestone planning been running, and which deadlines does it name?

4. With a C5 attestation: which corresponding customer criteria concern us specifically, and do you provide us with the associated control list? With equivalent evidence: how do you then meet the requirement of § 393 paragraph 3 number 3?

5. How do you support us in complying with the IT security guideline under § 390?

The fourth question is the most revealing, because its answer creates work in the practice. A specific control list makes the division of responsibility directly verifiable for the practice.

And who checks this?

A question that suggests itself while reading — and whose answer is surprising: § 393 names neither a supervisory authority of its own nor a fine or penalty provision of its own. The penal provisions of § 399 SGB V cover other data processing infringements, not this one.

That is not an all-clear. For psychotherapists contracted with statutory health insurance, the general supervisory and disciplinary structures continue to exist; § 81 paragraph 5 SGB V provides, for breaches of duties under statutory health insurance, for a warning, a reprimand, a fine and, in the most extreme case, suspension of the licence. Whether an isolated breach of § 393 would be sanctioned through this is not expressly regulated. Regardless of this, data protection law, professional law, liability law and § 203 StGB remain applicable to the same facts.

Anyone who concludes from this that nothing will happen anyway confuses a missing special provision with missing responsibility.

What § 393 does not replace

A classification that belongs at the end, because otherwise it gets lost: § 393 SGB V stands alongside the other sets of rules, not in their place.

The duty of confidentiality under criminal law remains unaffected. § 203 StGB permits disclosure to persons who contribute, but only insofar as this is necessary for making use of their activity — and requires that these persons be obliged to maintain secrecy — a duty that falls on the practitioner personally and that no security attestation fulfils.

Data protection law likewise remains unaffected. If the provider is a processor, a data processing agreement with the minimum content under Article 28 GDPR is needed; a C5 attestation does not replace it, and conversely a data processing agreement does not replace security evidence. The General Data Protection Regulation applies independently alongside. § 393 paragraph 8 additionally clarifies expressly that the provisions of Book Ten of the Social Code and of the Federal Data Protection Act remain unaffected.

And professional law is shaped by the law of the federal states — what is binding is the professional code of your competent state chamber of psychotherapists, not the model professional code.

Four levels of regulation with different conditions. They cannot be set off against each other, and none replaces another. Complying with § 393 therefore replaces neither the requirements of § 203 StGB nor those of the General Data Protection Regulation or of professional law.

About the status of this text

This article reflects the status as of 11 October 2026. It offers orientation, not legal advice, and it does not assess any provider — nor any particular evidence in an individual case. This is a translation; the German version is authoritative.

Incidentally, § 393 places obligations on both: the practice and — insofar as it is a processor acting on its behalf — the provider. Paragraph 1 expressly names service providers, health insurance funds and long-term care insurance funds “and their respective processors” side by side. An attestation of the provider does not, however, discharge the practice’s duties: in particular, it must implement the corresponding customer criteria intended for it. That is the reason why the fourth stage exists.

Because the equivalence ordinance is still new and the IT security guideline is reviewed every year and adapted at least every two years, we review this text quarterly — pay attention to the status date.

For context: this text deliberately does not classify any provider. Which evidence a provider provides belongs in every conversation with a provider — and a provider who evades the question has answered it.