What is Germany’s DigiG?

Having seen the introduction of the EU AI Act, ISO 42001 (which regards certifications of artificial intelligence management systems), and the Digital Operational Resilience Act (DORA), 2024 was a busy year for international compliance directives and standards.

All these landmark regulations aim to address the increasing need for guardrails and more resilient protection around sensitive data, and among them, Germany also established its Digital Act (DigiG). While not itself a regulation or requirement around data protection, resilience, or responsibility, DigiG will still require compliance reporting for various entities and organizations.

As a cybersecurity assessment firm that has helped hundreds of organizations meet their applicable requirements for over 20 years now, compliance is a specialty of ours, and we’re here to help those affected understand the nuances of DigiG.

In this blog post, we’ll detail the DigiG’s mandates and their aims, along with how this new Act relates to Germany’s C5 attestation so that you can move forward and make the next moves your organization must with all the information.

An Introduction to DigiG

After recognizing the benefits of improving their healthcare sector through the portability and interoperability of patient data, the German government formulated the DigiG, which was approved by the Bundestag in December 2023 and became law in March 2024.

To achieve its aim to modernize and simplify Germany’s healthcare system—as well as improve patient care/outcomes—the DigiG integrates advanced digital solutions into the country’s daily healthcare practices, including the establishment of:

• Telemedicine Services: To enhance accessibility—especially in rural areas​—the DigiG removes quantitative limits on billing for video consultations and remote care.

• E-prescriptions: So that acquiring medicine is easier for patients, the DigiG has made e-prescriptions mandatory for all prescription-only medications if the patients have statutory health insurance (and other prescriptions are expected to also—gradually—be included).

• Electronic Patient Records (ePA) for Every Citizen: Using these patient records, German hospital systems and healthcare providers will be able to more swiftly share patient history, screening, and prescriptions, as they’ll be able to access medical histories and other essential data more easily.

What are the DigiG Security Requirements for ePAs?

That being said, the only way this new ePA ecosystem works is if patients can trust that their personal health data is secure. So, to ensure this, the DigiG requires certain classes of providers to implement and confirm that proper safeguards are in place—these providers include:

• Contracted dentists;
• Approved hospitals;
• Psychotherapists;
• Pharmacies; and
• Any contract data processors that are commissioned to process health or social data for these aforementioned providers.

Among the required safeguards are:

• Data Encryption: The DigiG now requires any transfer of healthcare data to use end-to-end encryption and other secure communication protocols, such as Transport Layer Security (TLS) for all online interactions involving healthcare data.
• Access Controls: Under the DigiG, healthcare providers, insurers, and app developers are now required to implement multi-factor authentication (MFA) and other role-based access controls so that data handlers only access data and functions necessary to perform their job responsibilities.
• Data Anonymization: Anonymization of their data will help ensure patient privacy, as will the DigiG’s requirement for data minimization—i.e., providers must only collect and store the information essential to providing medical care.
• Monitoring and Incident Response: Not only are the aforementioned providers required to implement real-time monitoring systems for the detection of unauthorized access, but they are also mandated to establish an incident response plan that includes procedures for patient notifications and system recovery​ in the event of a cybersecurity breach.

The New C5 Attestation Requirement Under Germany’s DigiG

To demonstrate that these required implementations have been made and provide assurance around the security of Germany’s healthcare data digital hosting/processing, the DigiG is also requiring these organizations/services to undergo a C5 assessment.

Cloud providers for critical infrastructure in Germany have been required to undergo C5 attestations for many years, but now, the DigiG has widened its mandate—companies processing health or personal data using cloud-based systems in Germany (or a member state of the EU) must obtain:

• A Type 1 C5 certificate by 1 July 2024 (per Section 393 Paragraph 4 Sentence 1 SGB V); and
• A Type 2 C5 certificate by 1 July 2025 (per Section 393 Paragraph 4 Sentence 2 SGB V).

(Note: While German’s health ministry website calls it a C5 “certificate,” these are most typically performed as attestations, and the different “types” align with the System and Organization Control (SOC) reporting standard of the American Institute of Certified Public Accountants (AICPA) and reporting under the International Standard on Assurance Engagements (ISAE) 3402.)

So then, what are these healthcare cloud providers getting into?

Developed by the German Federal Office of Information Security—or Bundesmat fur Sicherheit in der Informationstechnik (BSI)—the Cloud Computing Compliance Criteria Catalogue (C5) is meant to set expectations for internal controls around cloud computing.

A compilation of many globally recognized standards for information security—including ISO 27001, SOC 2, the CSA CCM, NIST, etc.—C5 helps create transparency and trust between cloud service providers and customers by requiring the former to meet various security objectives across 17 criteria areas, which include:

• Organizational Security: E.g., risk management, data protection, and training employees in handling sensitive systems or data​
• Physical Security: E.g., access control, surveillance, and environmental protections for physical cloud infrastructure
• Infrastructure and Network Security: E.g., encryption protocols for data at rest and in transit, MFA, etc.
• Incident Management and Disaster Recovery: E.g., continuous monitoring, detection/escalation protocols, backup solutions, etc.
• Privacy: I.e., data processing must adhere to EU General Data Protection Regulation (GDPR) standards, including the right to access, rectification, and deletion.

Meeting all of the C5 framework’s requirements is now a must for the aforementioned players in the healthcare ecosystem—including any of the SaaS, PaaS, and IaaS providers servicing these entities—and any organizations that will be undergoing these attestations for the first time should begin preparing now to ensure you have time enough to align with the comprehensive breadth of this framework.

Next Steps for Compliance with Germany’s DigiG

With its DigiG Act, Germany has taken a big step toward modernizing their healthcare system, but in digitizing the related sensitive data, steps had to be taken to ensure that information stays secure. Requiring handlers to pass a C5 attestation will mean those organizations will need to make investments and adjustments, but—with the right assessor—aligning with this framework and complying with DigiG mandates will be all the simpler.

Schellman does perform C5 attestations, including readiness assessments. If you’re interested in learning more about our process and what a partnership with us would look like, please contact us today so that our team can help demystify the details for you.