Section 393 SGB V: using cloud services in healthcare with a C5 attestation

What does Section 393 SGB V regulate and who does it apply to?

Section 393 SGB V sets out the conditions under which social and data may be processed by means of cloud computing. The provision originates from the Act to Accelerate the Digitalisation of the Healthcare System (DigiG) and has applied since 1 July 2024. The legislator has since added a rule for systems placed on the market for the first time.

Section 393 SGB V does not create any new data protection obligations. The GDPR, SGB X and BDSG remain fully applicable; for SGB X and BDSG, Section 393(8) SGB V expressly clarifies this. The provision supplements these rules with additional IT security requirements for the use of cloud services. The aim is to create legal clarity and to promote the use of modern IT infrastructures in healthcare.

Section 393(1) SGB V covers the following bodies:

• Service providers under Chapter Four of SGB V, such as SHI-accredited physicians, psychotherapists, pharmacies, hospitals and midwives
• Statutory health insurance funds and long-term care insurance funds
• Processors acting for these bodies

In substantive terms, the provision concerns health data within the meaning of Art. 4(15) GDPR and social data under Section 67(2) SGB X. Anyone within this group must meet the admissibility requirements of Section 393 SGB V when using cloud services.

Under what conditions may health data be processed in the cloud?

Under Section 393(2) and (3) SGB V, health and social data may only be processed in the cloud if the place of processing, establishment and information security meet the statutory requirements. The centrepiece is a current C5 attestation for the cloud systems used.

All five requirements must be met cumulatively:

• Place of processing: in Germany, in an EU Member State, in a state treated as equivalent under Section 35(7) SGB I (EEA, Switzerland) or in a third country with an adequacy decision under Art. 45 GDPR.
• Establishment in Germany: The body processing the data must have an establishment in Germany, even if the processing takes place outside Germany.
• Technical and organisational measures (TOMs): appropriate and in line with the state of the art to ensure information security.
• Current C5 attestation: with regard to the C5 basic criteria for the cloud systems and technology used, or equivalent evidence under the C5 Equivalence Ordinance.
• Customer-side criteria: The criteria for customers set out in the attestation's audit report have been implemented.

With regard to TOMs, Section 393(5) SGB V helps many users: the measures are deemed appropriate if the IT security requirements applicable to them are met. These are Section 390 SGB V for SHI-accredited medical and dental care, Section 391 SGB V for hospitals and the B3S-GKV/PV for health and long-term care insurance funds. For all other bodies, subsection 6 sets a standard equivalent to the requirements of Section 391 SGB V.

If any of the five requirements of Section 393 SGB V is missing, processing in the cloud is not permitted, provided the service qualifies as a cloud computing service within the meaning of SGB V in the first place.

What counts as a cloud computing service under SGB V?

Under Section 384 no. 5 SGB V, a cloud computing service is a digital service that provides on-demand remote access to scalable and elastic computing resources, even where these are distributed across several locations. Only such services are subject to the requirements of Section 393 SGB V.

The legal definition in Section 384 no. 5 SGB V describes services with these characteristics:

• Availability on demand
• Remote access to scalable and elastic computing resources
• Provision of these resources across multiple locations

The definition is based on the definition in the NIS2 Directive (EU) 2022/2555 and comprises eight characteristics, including scalability, shared use and elasticity.

There are also differing technical definitions, for example in the BSI's C5:2026 catalogue, which derives its terms from the IT-Grundschutz Compendium and the ISO/IEC 22123 standard. There is therefore some uncertainty as to the specific requirements for cloud computing services under Section 384 no. 5 SGB V, and a case-by-case assessment is always necessary.

Which C5 attestation does Section 393 SGB V require today?

Since 1 July 2025, Section 393(3) no. 2 in conjunction with (4) sentence 2 SGB V has generally required a current C5 Type 2 attestation. A C5 Type 1 attestation is now only sufficient for information technology systems placed on the market for the first time after 30 June 2025, and only for the first 18 months.

The Cloud Computing Compliance Criteria Catalogue (C5) is a catalogue of criteria published by the German Federal Office for Information Security (BSI). It is intended to establish a minimum standard for information security in cloud services. The attestation comes in two forms:

• C5 Type 1: certifies the suitability of the controls at the time of the audit. Under the BSI's C5:2026 catalogue, a Type 1 report is limited to the initial engagement. Until 30 June 2025, it counted as a current attestation within the meaning of Section 393 SGB V.
• C5 Type 2: additionally covers the effectiveness of the measures over an audit period which, under C5:2026, should be at least three and at most twelve months. Since 1 July 2025, it has been the standard case.
• Exception for new systems: If an information technology system is placed on the market for the first time after 30 June 2025, a C5 Type 1 attestation is sufficient for the first 18 months. From the 19th month onwards, a C5 Type 2 attestation is required (Section 393(4) sentence 3 SGB V).

For customers, the C5 attestation creates transparency about the security level of the cloud service. However, it also obliges them to assess and implement the customer-specific measures themselves. Since July 2025, the C5 Type 2 attestation has therefore been the standard statutory evidence under Section 393 SGB V.

How does a cloud service obtain a C5 attestation?

A C5 attestation is the result of an audit carried out by public auditors. What ultimately matters for customers is the audit report, as it sets out the customer-side criteria under Section 393(3) SGB V.

Who conducts C5 audits and how does the audit work?

C5 audits are carried out exclusively by public auditors in accordance with the international assurance standard ISAE 3000. The BSI is not involved in the audit process and does not evaluate the audit reports. The process comprises three steps:

1. Readiness assessment
2. Audit with control tests and evidence
3. Reporting

Only specific cloud services and defined regions are audited, not a provider's entire cloud platform.

What criteria does the C5 catalogue contain?

The C5 criteria catalogue is divided into 17 subject areas, including in the current version C5:2026. C5:2020 contains 121 requirements, while C5:2026 comprises 168 criteria. The audit covers organisational, technical and process-related aspects. The subject areas include, for example:

• Organisation of information security
• Cryptography and key management
• Compliance
• Business continuity and emergency management
• Product security

The C5 criteria are divided into basic and additional criteria. According to the BSI, the basic criteria represent the minimum level for information with a normal protection requirement and the minimum scope of every C5 audit. Providers can include additional criteria in the audit for customers with higher protection requirements. Section 393 SGB V requires an attestation with regard to the basic criteria and does not specify a catalogue version.

What does the C5 audit report contain?

The C5 audit report is the document from which customers can identify the requirements that apply to them. In the usual audit of a statement by the legal representatives, a C5 report under the BSI's C5:2026 catalogue contains:

• the report of the independent auditor including the audit opinion
• the statement by the legal representatives on the appropriateness and, where applicable, the effectiveness of the controls
• the cloud provider's system description
• the provider's controls, the audit procedures and their results
• optionally, other information from the provider, such as statements on identified deviations

The auditor does not assess the corresponding controls of the cloud customers. In the report, the auditor makes clear that the C5 criteria are only met if these customer controls are also appropriately designed and effective. Implementing the customer-side criteria from the C5 audit report is therefore a prerequisite for permissible cloud use under Section 393(3) no. 3 SGB V.

What changes with the new C5:2026 catalogue?

With C5:2026, the BSI has revised the substance of its criteria catalogue for the second time. The new version continues the criteria from C5:2020, adds new requirements and applies to audits with a reference date or start of the audit period on or after 1 June 2027.

In terms of content, C5:2026 builds on the requirements of the European cloud certification scheme EUCS and takes into account, among others, ISO/IEC 27001:2022, the Cloud Controls Matrix version 4 and the NIS2 Directive. The BSI cites the following as key changes compared with C5:2020:

• New criteria, in particular on container management, supply chain management, post-quantum cryptography and confidential computing
• Multi-tenancy and sovereignty: The catalogue addresses both in more detail, sovereignty with a view to its technical implementation.
• Sub-criteria: The criteria are broken down into clearly defined sub-criteria that can be mapped more precisely to individual controls.
• Additional criteria: These are now expressly classified as either tightening or extending.

C5:2026 is to be applied to Type 1 reports with a reference date on or after 1 June 2027 and to Type 2 reports whose audit period begins on or after 1 June 2027. Earlier application is permitted. If a Type 2 period begins before 1 June 2027 and ends afterwards, the audit should be carried out exclusively under C5:2020. The BSI does not provide for combining both versions in a single audit.

The transition will become visible in the audit report even earlier. If the audit period ends on or after 28 February 2027, the cloud provider must include information on planned adjustments to the C5:2026 criteria in the system description, such as the type of change, implementation status and implementation date. This information gives cloud customers transparency as to whether their provider is generally in a position to comply with the C5:2026 criteria in future.

Which evidence replaces the C5 attestation under the C5 Equivalence Ordinance?

The C5 Equivalence Ordinance (C5GleichwV) of 19 March 2025 recognises three other standards as equivalent evidence of security, provided that an action plan is also in place. It has applied retroactively since 1 July 2024 and is not time-limited. It was prompted by the shortage of available auditors, which put smaller providers in particular at a disadvantage.

Under Section 1(1) C5GleichwV, attestations or certifications under the following standards are deemed evidence of a security level equivalent to a C5 Type 1 or C5 Type 2 attestation:

• ISO/IEC 27001 in the applicable version
• ISO 27001 on the basis of IT-Grundschutz from the BSI
• Cloud Controls Matrix (CCM) version 4.0 in the applicable version

An ISO 27001 certificate alone is therefore not sufficient under the C5 Equivalence Ordinance. Only in combination with the action plan does it replace the C5 attestation on a transitional basis.

What must the action plan under the C5GleichwV contain?

Anyone providing evidence of an alternative standard such as ISO/IEC 27001 instead of a C5 attestation must close the gaps to the C5 basic criteria. For this purpose, Section 1(2) C5GleichwV provides for an action plan that also sets out the path to the provider's own C5 attestation.

The action plan contains four elements:

1. Gap documentation: the C5 basic criteria that the alternative standard does not cover in substance.
2. Remedial measures: the technical and organisational safeguards used to close the gaps.
3. Milestone plan: Implementation must not exceed twelve months from the date the milestone plan is drawn up.
4. Path to the C5 attestation: documentation of the measures for obtaining a C5 Type 1 attestation within 18 months and a C5 Type 2 attestation within 24 months of drawing up the milestone plan. This also includes contracts with an auditor or the commencement of contract negotiations.

The action plan and the attestation or certificate must be presented without undue delay upon request, namely to the commissioning service providers, health and long-term care insurance funds and to the competent supervisory authorities.

As the deadlines under the C5GleichwV run from the date the milestone plan is drawn up, anyone who drew up their plan in 2024 or early 2025 has now reached, or will soon reach, the end of the 24 months.

Conclusion: Section 393 SGB V requires continuously up-to-date C5 evidence

With Section 393 SGB V and the C5 attestation, there is a clear basis for cloud solutions in healthcare. This creates legal certainty, but also brings its own obligations for providers and users. You should therefore check:

• whether the chosen cloud service meets the requirements of Section 393 SGB V,
• whether a current C5 attestation or equivalent evidence is available,
• which customer-side measures you need to implement.

Since July 2025, a C5 Type 2 attestation has generally been required. The need for action now arises above all from the transition to the C5:2026 catalogue, which applies to Type 2 audit periods starting on or after 1 June 2027, and from the running deadlines in action plans under the C5 Equivalence Ordinance. Those who plan ahead in good time position themselves as trustworthy providers in a sensitive market.

Frequently asked questions

#1 Does Section 393 SGB V also apply to processors?

(1) SGB V expressly also covers the processors of service providers and of health and long-term care insurance funds. They too may only process health and social data in the cloud if the place of processing, establishment, TOMs, C5 attestation and the implementation of the customer-side criteria meet the requirements.

#2 How long is a C5 attestation valid?

A C5 attestation has no fixed period of validity; Section 393 SGB V requires a current attestation. According to the BSI, a C5 attestation always relates to a period that has already ended. Under the BSI's C5:2026 catalogue, the audit period of a Type 2 report should be at least three and at most twelve months, with exceptions possible for the upper limit.

#3 Does the cloud provider have to be based in Germany?

Section 393(2) SGB V does not require a registered office in Germany, but it does require the body processing the data to have an establishment in Germany. The processing itself may also take place in another EU Member State, in the EEA, in Switzerland or in a third country with an adequacy decision.

#4 Does the BSI issue C5 attestations?

No, C5 attestations are issued exclusively by public auditors in accordance with the ISAE 3000 assurance standard. The BSI publishes the C5 criteria catalogue but is not involved in the audit itself and does not evaluate the audit reports.