The digital law: time-critical requirements for cloud service providers

Digitization in Germany is a constant topic in the media. The need for digitalization in the healthcare sector is no exception. The government has been working on the so-called Digital Act (DigiG) for some time now. Now that the Federal Council has approved the draft law on February 2, 2024, its entry into force seems within reach.

The aim of the Digital Act is to simplify the interaction between patients and doctors using digital solutions and make it more secure. At the heart of the Digital Act is the electronic patient file (ePA). However, the digital medication overview and the further development and binding nature of the e-prescription, to name just three examples, are also covered by the Act.

In addition to the content specifications for the digitalization of the healthcare system, the law also places concrete requirements on cloud service providers who provide their solutions for hospitals, other healthcare providers or for data transmission between the parties involved, for example. This is intended to counter the IT security and cyber risks associated with digitalization.

For providers who provide services for the healthcare sector via cloud models, a regular audit in accordance with the requirements of the audit standard Cloud Computing Compliance Criteria Catalogue (C5) of the German Federal Office for Information Security (BSI) is to become mandatory in future.

With the Cloud Requirements Catalogue (BSI C5), the Federal Office establishes uniform criteria that cloud service providers can use to align their internal control system. In addition to "classic" IT security topics such as the organization of information security, cryptography and physical security, the 13 sub-areas of the catalog of requirements also cover topics such as portability, dealing with investigation requests and product security. Cloud service providers can have the conformity of their cloud models with the BSI C5 criteria confirmed following a successful audit by an auditing company. The corresponding audit has a fixed observation period and must therefore be repeated regularly (so-called type 2 audit).