Written by the NIS2Compass Team ·
Under Annex 1 BSIG, hospitals belong to the Health sector. With 50 or more employees, or annual turnover and balance sheet total each above €10M, they are important entities; from 30,000 inpatient cases per year they operate a critical facility (KRITIS). In addition, §391 SGB V (until March 2024 §75c SGB V) requires every hospital not already covered as a KRITIS operator to maintain state-of-the-art IT security. NIS2Compass sorts these duties and guides IT teams step by step through implementation.
Sector
Annex 1 BSIG, no. 4.1.1: healthcare providers within the meaning of Directive 2011/24/EU. This covers hospitals as well as other providers such as medical care centres (MVZ). According to the BSI, long-term care facilities are not included.
Size
Important entity from 50 employees or turnover and balance sheet total each above €10M; essential entity from 250 employees or turnover above €50M and balance sheet total above €43M (§28 BSIG). Single practices are usually below.
KRITIS and §391 SGB V
From 30,000 inpatient cases per year, a hospital is a critical facility (BSI-KritisV, Annex 5) and therefore an essential entity regardless of size. All other hospitals are additionally subject to §391 SGB V.
§30 BSIG, §391 SGB V and, for KRITIS hospitals, §§31 and 39 BSIG overlap. The industry standard B3S helps with implementation, but does not replace clarifying which rules apply to your hospital.
§30(2) no. 5 BSIG requires vulnerability management. CT, MRI and lab IT often run on legacy operating systems and cannot be patched like office IT. Compensating measures such as segmentation and monitoring are needed.
A ransomware attack with access to patient data can trigger both the report under §32 BSIG to the joint reporting office of BSI and BBK and the report under Art. 33 GDPR to the data protection authority. Two recipients, different criteria and content.
A hospital with 350 beds, around 18,000 inpatient cases per year and 8 people in IT is below the KRITIS threshold, but is NIS2-obliged under §28 BSIG and must also meet §391 SGB V. Existing evidence from the §75c SGB V era has to be mapped to the measures in §30 BSIG, and in an incident the BSI and GDPR reports run side by side. NIS2Compass structures the implementation path in 8 chapters with 124 steps. Knowledge Hub articles explain how to coordinate NIS2 and GDPR reporting. The reporting forms cover all three stages under §32 BSIG, and the incident register documents both assessments in one place.
NIS2 Guide
8 chapters, 124 steps, each with a template
Knowledge Hub
40+ expert articles, incl. coordinating NIS2 and GDPR reporting
Reporting templates
Incident register, early warning (24 h), notification (72 h), final report
The starting point of any implementation. Under §28(1) no. 1 BSIG, operators of critical facilities are always essential entities, regardless of turnover and headcount. For hospitals, Annex 5 of the BSI-KritisV sets the threshold at 30,000 inpatient cases per year. Below that, headcount, turnover and balance sheet total decide. Important and essential entities must register with the BSI (§33 BSIG).
Hospitals must take appropriate organisational and technical precautions in line with the state of the art, including mandatory security awareness measures. Until March 2024 the duty was in §75c SGB V; the Digital Act (DigiG) moved it to §391 SGB V. It applies to all hospitals that are not already obliged as operators of critical facilities under §§30, 31 and 39 BSIG (para. 5). It can be met in particular by applying a B3S whose suitability the BSI has confirmed under §30(8) BSIG (para. 4).
Important and essential entities implement and document the measures in §30(2) BSIG, from risk analysis and backup and crisis management to multi-factor authentication. Number 5, vulnerability management, is tricky for hospitals: medical devices on legacy operating systems need compensating measures such as segmentation, strict access control and monitoring. KRITIS hospitals must also use attack detection systems (§31(2) BSIG) and prove implementation every three years (§39 BSIG).
Reports go to the joint reporting office of BSI and BBK: early warning within 24 hours, notification with an initial assessment within 72 hours, final report one month later. Operators of critical facilities additionally state the type of facility, the critical service and the impact (§32(3)). If the incident is likely to result in a risk to patients, a report under Art. 33 GDPR is added: without undue delay and where feasible within 72 hours to the competent data protection authority. §391 SGB V contains no separate reporting duty.
Management must implement the risk management measures, monitor their implementation and attend training regularly. In case of culpable breach, they are liable to the entity under the company law rules that apply to its legal form.
| Kriterium | NIS2Compass | Klassische Beratung | ISMS-Tool | Selbstumsetzung |
|---|---|---|---|---|
| Monthly cost | €29 | €700-1,600/day | €200-2,000/month | €0 |
| §391 SGB V context | explicit | depends on consultant | generic | build yourself |
| GDPR and NIS2 coordination | Knowledge Hub articles | individual | often omitted | build yourself |
| German templates | yes (45+) | tailored | mostly English | no |
| Onboarding | 10 minutes | weeks | days + setup | months |
| For 5-12-person hospital IT | yes | too expensive | too complex | capacity-challenged |
§28 and §30 BSIG, §391 SGB V, reporting under §32 BSIG: 8 chapters, 124 steps, 45+ templates.
Official sources