Confidentiality and the cloud: what psychotherapists may do — and what they have to do for it

Before any decision on practice software, the same question arises, and it usually goes unspoken: Am I even allowed to do this? Patient data in a system that someone else operates, on servers that do not belong to me, maintained by people I will never meet — is that compatible with professional confidentiality?

The short answer from the perspective of criminal-law confidentiality is: in principle, yes. Since November 2017, § 203 StGB (German Criminal Code) has expressly allowed necessary secrets to be made accessible to involved external service providers as well. This does not yet answer the questions of data protection law, professional law and — for psychotherapists contracted with statutory health insurance — social security law. The longer answer is the more important one, because the legislator did not only permit something. In the same step, it imposed a duty on the person providing treatment, and disregarding it can become a criminal offence under the conditions of § 203 paragraph 4 — and this half comes up less often in the discussion.

What professional confidentiality prohibits

§ 203 paragraph 1 of the Criminal Code makes it a criminal offence to disclose without authorisation a secret of another person that was entrusted to one as a member of a healthcare profession. The penalty ranges up to one year’s imprisonment or a fine; anyone acting for payment or with the intention of enriching themselves or another person or of harming another person risks up to two years. The duty does not end with the treatment, nor with the patient’s life — it continues to apply after death.

The decisive term is disclosing. It does not only mean telling. Making data accessible to another person can also be disclosure — and it was precisely this that caused the uncertainty that accompanied every outsourcing to an IT service provider before 2017. Anyone who handed the maintenance of their practice system to a company was in a legally uncertain and disputed position — which the legislator expressly set out to clarify in 2017.

Why external service providers are permissible

The law knows two ways out of this situation, and they are different.

The first is old: anyone who makes secrets accessible to the assistants working for them in a professional capacity, or to persons working for them in preparation for the profession, does not disclose in the legal sense in the first place (§ 203 paragraph 3 sentence 1). One’s own practice employee typically falls under this; external providers, by contrast, are regularly other involved persons within the meaning of sentence 2.

The second way is the new one and the decisive one for the software question. § 203 paragraph 3 sentence 2 permits disclosing secrets of others to other persons who are involved in the professional activity — insofar as this is necessary for making use of their activity. These “involved persons” are the category that software providers, data centre operators and IT service providers fall under.

This was introduced by a law with an unwieldy name: the Gesetz zur Neuregelung des Schutzes von Geheimnissen bei der Mitwirkung Dritter an der Berufsausübung schweigepflichtiger Personen (Act on the new regulation of the protection of secrets when third parties are involved in the professional practice of persons bound by confidentiality) of 30 October 2017, promulgated in the Federal Law Gazette I 2017 No. 71, page 3618, in force since 9 November 2017. Anyone who comes across older guidance texts that reach a stricter conclusion is, as a rule, dealing with the legal situation before this date.

Two limits nonetheless apply. First, the permission is tied to necessity. It covers what the service provider needs for its activity — it is not a licence to give it everything as a precaution. Second, it extends to subcontracting: if the involved person in turn calls in further persons, the necessary secrets may also be disclosed to them.

What “necessary” means in practice

The necessity requirement is easily overlooked, yet it is the lever with which a practice can actually change something. The permission under § 203 paragraph 3 sentence 2 is not a blanket release for everything that is in the system. It covers what the service provider needs for its service — and on closer inspection, that is often less than one assumes.

This leads to a question that is rarely asked in conversations with providers. It is not only: Which provider do I trust? It is also: What does the provider get to see at all?

There is a considerable difference between the two questions. Where real names do not leave the practice in the first place, where identifying details are replaced before transmission, where a service provider works only with what it needs for its specific task, the scope of what is disclosed becomes smaller. That does not make the legal review unnecessary — but it reduces what has to be reviewed.

For the conversation with a provider, this means: ask also about the scope of the data, not only about the processing location. Both questions count, and they count at different levels — the processing location is relevant under data protection law and, for psychotherapists contracted with statutory health insurance, as the later section shows, additionally restricted directly by social security law. The scope, on the other hand, is the question that criminal law asks. It is asked less often.

What the person providing treatment has to do for it

This is the part that almost never comes up in sales conversations.

The new rules brought the involved persons within criminal liability: a service provider who discloses a secret obtained in this way without authorisation commits an offence themselves (§ 203 paragraph 4 sentence 1). That is one side.

The other side concerns the person providing treatment. § 203 paragraph 4 sentence 2 number 1 penalises anyone who has not ensured that an involved person was obliged to maintain secrecy — in relation to an involved person who subsequently discloses without authorisation a secret that has become known to them. Number 2 governs the corresponding case where the involved person calls in further persons.

More precisely: under this provision, the omission only becomes a criminal offence once the person who was not obliged actually discloses a secret without authorisation. Under contract law, professional law and data protection law, a missing obligation can cause problems independently of this. For the practice, this means: if the case occurs, it is not a mishap of the service provider alone, but a question that is also put to you. Anyone who completed the obligation beforehand is in a different position at exactly this moment.

This shifts the question before the contract is concluded. It is no longer only “may I use a provider”, but “have I properly obliged it”.

What is remarkable is what is not in criminal law. The careful selection of the service provider and its ongoing monitoring were still in the ministry’s draft bill but did not become law. This does not mean, however, that the selection is legally irrelevant — on the contrary: under Article 28 paragraph 1 GDPR, a controller may only use processors that provide sufficient guarantees for appropriate technical and organisational measures. And for lawyers, careful selection is even expressly regulated in professional law in § 43e paragraph 2 of the Federal Lawyers’ Act (Bundesrechtsanwaltsordnung). Whether the same applies to psychotherapists depends on the professional code of the respective chamber.

In short: the selection is not subject to criminal penalties. That does not make it legally irrelevant.

Three sets of rules that are often confused

“We have a data processing agreement, so that’s fine” — this sentence is often heard, and it falls short. Three levels with three different purposes lie on top of each other.

Criminal law protects the secret and is addressed to the person providing treatment personally. It asks about the involved person’s obligation of secrecy.

Data protection law is addressed to the controller. If the service provider is a processor — typically the case with hosting and cloud services —, it requires a data processing agreement. Article 28 of the General Data Protection Regulation sets out its minimum content. This includes a confidentiality clause: under Article 28 paragraph 3 sentence 2 point (b), the agreement must provide that the persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Subcontracting is governed by paragraph 2: it requires the controller’s authorisation.

Professional law is the third level — and the only one that is not uniform across Germany. What is decisive is the professional code of the chamber you belong to; the model professional code of the Federal Chamber of Psychotherapists is a template, not directly applicable professional law. The professional codes typically require employees to be instructed about confidentiality and the instruction to be recorded in writing. The model professional code goes further: under § 8 para. 5, the other persons who are involved in the professional activity must also be obliged to confidentiality, and this must be recorded in writing. Wording and scope differ between the federal states.

The point where it gets uncomfortable: Whether the confidentiality clause of a data processing agreement under Article 28 paragraph 3 point (b) already satisfies the criminal-law duty under § 203 paragraph 4 sentence 2 number 1 — or whether a separate declaration of obligation is needed alongside it — has not been conclusively settled. Specialised legal literature is also cautious on this point. What matters is the content of the contractual obligation, not its outward form: a suitably designed provision in the contract can cover both; a separate document with its own heading is not required by law. Anyone who wants to be on the safe side has the obligation of secrecy confirmed expressly and with reference to the criminal-law duty — and makes sure that it is passed on to staff and sub-processors.

And the patient?

A question that follows immediately: does using a service provider require consent or a release from confidentiality?

For engaging a processor as such, in principle not. Three things are required, however: that the underlying processing is itself lawful, that the disclosure remains necessary under § 203 paragraph 3 sentence 2, and that the requirements for processing on behalf are met. Article 28 GDPR is not a legal basis for the processing — it only governs the conditions under which a processor may be engaged.

What remains is the duty to inform: patients must be informed transparently about the recipients or categories of recipients of their data and about the use of processors.

A separate matter is the individual processing operation. Whether consent is needed for a particular function — for example an appointment reminder by message — depends on that function, not on the question of who operates the service.

And for practices contracted with statutory health insurance, a fourth level

Anyone who takes part in care under statutory health insurance (vertragsärztliche Versorgung) must additionally observe § 393 SGB V (German Social Code, Book V) when using a cloud computing service. Of all the provisions mentioned, this one sets the most specific requirements: a permissible processing location, an establishment of the data-processing body in Germany, technical and organisational measures — and a security attestation of the processing body.

What is special about it: § 393 requires, in addition to the security attestation of the processing body, the implementation of requirements on the customer side. An existing attestation alone is therefore not sufficient.

Because there is now more to say about this than fits into this article — in particular about the equivalent attestations permitted since 2025 and about the duties that lie with the customer —, we cover § 393 SGB V in a separate article.

For this text, the classification is enough: for psychotherapists contracted with statutory health insurance, the question of the processing location is not only relevant under data protection law, but directly restricted by social security law through § 393 SGB V — and it means more than the location of the servers.

What this means in practice

A guide for the conversation with a provider — not an exhaustive checklist, but the questions that follow from the above:

1. Is it recorded in the contract that the provider and the persons working for it are obliged to maintain secrecy?
2. Does this obligation expressly also cover the protection of professional secrets — whether in the data processing agreement or in a separate agreement?
3. Is there a data processing agreement under Article 28 GDPR?
4. Are the sub-processors named, and is it agreed that they are also obliged?
5. Are only the data transmitted that the provider actually needs for its service?
6. Is the instruction of your own employees documented in writing?
7. Where does processing take place — and where are the sub-processors located?
8. Does the professional code of my chamber say anything that goes beyond the above?

The eighth point cannot be answered in general terms, and that is not an evasion: what is binding is the professional code of your competent state chamber of psychotherapists, not the model professional code.

Anyone who takes part in care under statutory health insurance must also observe the requirements of § 393 SGB V — see the separate article.

About the status of this text

This article reflects the status as of 11 October 2026. It offers orientation, not legal advice, and it does not assess any individual case. The version of the provisions mentioned that applies at the time, and the professional code of your chamber, are authoritative. For specific questions — in particular on the design of contracts — legal advice should be sought. This is a translation; the German version („Schweigepflicht und Cloud“) is authoritative.

A note on our own behalf: this text comes from Psymira, a provider of documentation software for psychotherapy practices. We wrote it because we are regularly asked this question. It describes duties that fall on the person providing treatment — no provider can take them off their hands. Software can support compliance with § 203 technically and contractually — it cannot guarantee it, because the provision is tied to persons and their conduct, not to a product.