Cloud-based Data Solutions

There is often uncertainty as to which regulations must be observed at all regarding the data processed. Different rules apply to personal data than to nonpersonal data. Hospitals, health insurance companies and DiGA manufacturers must observe and fulfill different requirements.

One of the central professional duties of physicians is the duty of confidentiality. § Section 203 of the German Criminal Code (StGB) protects patient confidentiality under criminal law. The disclosure of secrets is therefore only permitted to members of the medical profession under special conditions.

With whom must a processing contract be concluded in accordance with the GDPR? Data transfers to third countries without an adequacy decision are also only permitted if appropriate safeguards are in place.

Due to their legal assessment, health and social data are data with a high level of protection. The technical and organizational measures taken when processing this data must reflect this level of protection.

Many state hospital laws restrict the disclosure of patient data collected at the hospital. In many places, these restrictions also apply to the use of processors.

Special regulations apply to social data. One of these is § 80 SGB X. This states, among other things, that no processing may take place in a third country for which no adequacy decision exists pursuant to Art. 45 DGSVO.

Digital health applications (DiGA) are also subject to special requirements regarding the processing of personal data, which are regulated in the DiGAV. The strict interpretation of the legal requirements by the BfArM leads to uncertainty among manufacturers.

Critical infrastructure as defined by BSIG must meet special requirements for security in information technology.

Regulatory authorities often express skepticism and restrictiveness in connection with service providers that have group connections in a third country. This uncertainty needs to be dealt with.