IT security in healthcare: demonstrably resilient

For the part that concerns the infrastructure, yes: ISO 27001 based on IT-Grundschutz (BSI certificate BSI-IGZ-0773), an unqualified BSI C5:2020 Type 1 attestation, TOM documentation and a data processing agreement, all with their scope in the Trust Center. However, the addressee of Section 393 SGB V (introduced by the PDSG) and of NIS2 remains your institution: risk analysis, ISMS, reporting channels and the security of your applications are for you to demonstrate. centron provides the documentation for the supply-chain share.

If you process health data via cloud services as a care provider, you must check whether your provider meets the requirements of Section 393 SGB V: processing in permissible regions, a domestic establishment, appropriate technical and organisational measures and a current C5 attestation. centron meets the location and establishment requirements and holds a BSI C5:2020 Type 1 attestation for the ccloud³ as well as ISO 27001 certification based on IT-Grundschutz. You can obtain the documents from the sales team.

An air-gapped backup sits beyond the reach of the production system. Ransomware typically encrypts everything reachable from the infected system – including attached backups. With S3 Object Storage and object lock, backups are stored immutably: within the retention period they cannot be overwritten or deleted, not even with stolen credentials. See backup for patient data for how this looks for practices and clinics.

centron is responsible for platform and operations: data centres, virtualisation, network, monitoring, logging, platform backup, and incident, change, emergency and provider management. Your operating systems, your applications, your business processes and your content – including the patient data itself – remain your responsibility. This boundary is expressly recorded in the scope of our ISO 27001 certification and can therefore be evidenced in an audit.

The centron solution team works hand in hand with your IT. The migration follows a detailed project plan to avoid downtime and preserve the integrity of your databases.

Yes. At centron you have direct access to competent contacts (level 3) who know your infrastructure environment in detail and advise you as equals.

Yes. Manufacturers of digital health applications run their solution on the certified platform. The evidence towards the BfArM is provided by the manufacturer itself; centron supplies the certificates with their scope, the TOM documentation and the data processing agreement. Which evidence your application needs in detail depends on its protection requirements.

An IT service provider supporting professional secrecy holders with data processing is an “other participating person” under Section 203 (3) StGB. The personnel involved must be bound to confidentiality – at centron this is implemented through corresponding staff obligations and the documented technical and organisational measures.

No. Customer data is processed exclusively in German data centres, with no transfer to third countries. The deployment location for cloud workloads is our own data centre in Hallstadt near Bamberg. centron is a German company with no foreign parent company.