Healthcare

This European series of standards defines requirements for the availability, energy efficiency and physical security of data centers. It provides a holistic Data Center design and engineering framework and supports sustainable, scalable and future-proof infrastructure concepts.

Operators of critical services – e.g. inpatient medical care, laboratory diagnostics, supply of medicines and medical products – must meet strict security requirements in accordance with the KRITIS Regulation. These regulations apply to all KRITIS-relevant facilities that play a critical role in healthcare provision.

The CER Directive (EU 2022/2557) introduced new requirements for the resilience of critical infrastructures. In Germany, this is being implemented via the KRITIS umbrella law, which may also affect data centers in the healthcare sector in the future. Operators must provide structured evidence of security measures – via a CER (Cybersecurity External Reporting) or an RCE (Regular Cybersecurity Evaluation). The audits are carried out by bodies recognized by the BSI. In addition, NIS2 regulates cybersecurity at the digital level.

From 2025, the NIS2 Directive will also oblige many non-KRITIS companies in the healthcare sector to implement strict security measures. These include pharmaceutical manufacturers, reference laboratories, R&D facilities and providers of healthcare and medical devices. Depending on the size of the company, they are considered “important” or “particularly important facilities” and must report incidents, manage risks and demonstrate technical and organizational protective measures.

The standard recognized by the German Federal Office for Information Security (BSI) defines security requirements for operators of critical infrastructures (KRITIS) in the healthcare sector.
The B3S standards apply to various areas of the healthcare sector:

• B3S Hospital: For healthcare in hospitals 
• B3S Laboratory Diagnostics: For laboratory analytics and communication systems
• B3S Pharma: For the supply of medicines and blood/plasma

This internationally recognized standard forms the basis for a robust information security management system (ISMS) and protects health data from unauthorized access.

In addition to ISO/IEC 27001, this standard defines specific requirements for the healthcare sector in order to provide special protection for patient data and medical information. This standard is not mandatory in Germany but is a valuable addition for facilities with very high data protection requirements.

The BSI's C5 catalog defines minimum security and compliance requirements for data centers that offer cloud services in the healthcare sector.

Funding programs such as the Hospital Future Fund (KHZF) have supported investments in IT security and data center infrastructure in the healthcare sector in the past. There will also be funding opportunities for digitalization and infrastructure projects in the future – we will be happy to advise you on current programs.

Strict standards are crucial in the healthcare sector. We support medical facilities in preparing for certification. Our services include as-is analysis, action Data Center design and engineering and support throughout the entire certification process.