Stricter IT security requirements in the healthcare sector

At the end of 2022, the EU has adopted important regulations to protect network and information security in "critical sectors" with the "NIS2" directive, which also includes the healthcare sector.  The Directive aims to strengthen the protection of certain healthcare facilities and services against cyber threats. 

In Germany, the directive is implemented by the NIS 2 Implementation and Cybersecurity Strengthening Act (German). In doing so, the draft law goes beyond the EU requirements and thus brings about numerous innovations in national cyber security law. 

The NIS 2 Implementation and Cybersecurity Strengthening Act is to be adopted by mid-2024. The obligations it entails are to apply from 1 October 2024.

Scope

Significantly more companies than before will be included in the IT security regime through the core piece of the draft NIS 2 Implementation and Cybersecurity Strengthening Act - the amendment of the BSI Act. A distinction is made between "important" and "particularly important facilities" as well as "critical installations" (cf. section 28 (3), (6), (7) Draft BSI Act). All covered entities must fulfil a number of obligations. 

In any case, Annex I of the NIS 2 Directive already provides a list of "critical facilities", which must accordingly also be reflected in the legal ordinance. Annex I No. 5 of the Directive identifies the healthcare sector as a sector with high criticality. The scope extends to healthcare providers, certain medical device and pharmaceutical manufacturers and EU reference laboratories.

Risk management, reporting, registration, verification and information obligations 

Under the Draft BSI Act, the companies covered and their management bodies are subject to a number of obligations. These depend in detail on whether the company operates a "critical installation" or an "important" or "especially important facility". 

Risk management: safety measures and risk assessment (§ 30 Draft BSI Act) 

All institutions are required to implement technical and organisational measures to protect their IT systems and processes. These measures shall be state of the art and shall adequately address the risk of potential damage, considering factors such as the size of the institution and potential security incidents. The primary responsibility for implementing and monitoring cybersecurity measures lies with the managing directors. They are also liable for breaches and should regularly participate in training (section 38 Draft BSI Act).

Reporting obligations (§ 31 Draft BSI Act) 

In the event of a security incident, the institutions must submit various reports to the Federal Office for Information Security (BSI), including an initial report within 24 hours and a detailed report within 72 hours, as well as a final report. Security incidents are defined as events that affect the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of services offered or accessible via information technology systems, components and processes (Section 2 (1) no. 37 Draft BSI Act).

Other duties

Compliance with the security requirements must be regularly demonstrated to the BSI. In the event of security deficiencies, the BSI can demand corrective measures (section 34 Draft BSI Act). In addition, all institutions are obliged to register with the BSI and provide relevant information (sections 32, 33 Draft BSI Act). In the event of significant security incidents, they may be obliged to inform their customers about them (sections 35, 36 Draft BSI Act).

Enforcement and sanctions: 

The Federal Office for Information Security is responsible for verifying compliance with and enforcement of the aforementioned obligations (sections 62-65 Draft BSI Act). In doing so, it can directly influence the companies and take measures. These remain in force until the institution has complied with the authority's orders.
Non-compliance can result in severe fines (section 64 Draft BSI Act). According to the wording of the draft law, these can amount to up to twenty million euros or two percent of the total worldwide turnover of the company concerned in the previous business year.

What to do now - Preparing for the NIS 2 Implementation Act

The covered healthcare sector operators must, inter alia, take appropriate, proportionate and effective technical and organisational measures to prevent disruptions to the availability, integrity, authenticity and confidentiality of the information technology systems, components and processes they use to provide their services and to prevent or minimise the impact of security incidents on their services or on other services. The draft law is not yet final. However, the requirements are not expected to change fundamentally. Companies should therefore address the following topics:

1. Create concepts related to risk analysis and security for information systems,
2. Managing security incidents,
3. Business continuity, such as backup management and disaster recovery, and crisis management,
4. Supply chain security,
5. Security measures in the acquisition, development and maintenance of information technology systems, components and processes, including vulnerability management and disclosure,
6. Create concepts and procedures to evaluate the effectiveness of cyber security risk management measures,
7. cyber hygiene procedures and cyber security training,
8. Creating concepts and procedures for the use of cryptography and encryption,
9. Staff security, access control concepts and asset management
10. Use of multi-factor authentication or continuous authentication solutions, secure voice, video and text communications and, where appropriate, secure emergency communication systems within the facility.