Hospital: The Complete NIS2 Guide

Hospitals with more than 50 employees or EUR 10 million in annual revenue must be classified as Essential Entities under NIS2 Annex I No. 5 (Health). This means stricter obligations and higher fines than for Annex II entities. The threat is real: hospitals are among the most frequently attacked critical infrastructure targets in Germany. This guide is written for hospital management, CISOs, and IT directors.

Who is affected?

Hospitals fall under NIS2 Annex I No. 5 (Healthcare providers) when they exceed the SME thresholds: at least 50 employees or at least EUR 10 million in annual revenue (EU Recommendation 2003/361/EC Art. 2). Since virtually all hospitals exceed these thresholds, they must be classified as Essential Entities across the board.

Large hospitals, university medical centers, and hospital groups with more than 250 employees and more than EUR 50 million in revenue are also subject to KRITIS obligations under BSI-KritisV (threshold: 30,000 inpatient cases per year). These have already been regulated under the IT Security Act 1.0.

A district hospital with 200 beds and 300 employees is an Essential Entity under NIS2.

Obligations under § 30 BSIG-new

§ 30 BSIG-new requires seven technical and organizational measure areas that are especially demanding for hospitals because of patient-safety-critical IT systems:

1. Risk analysis and management: HIS (Hospital Information System), RIS/PACS (radiology), laboratory IT, networked medical devices, and patient data infrastructure must all be assessed.
2. Incident handling: A ransomware attack on the HIS is a reportable incident. Escalation into clinical operations (fallback procedures) and IT security response must be coordinated.
3. Business continuity: Hospitals must maintain downtime procedures for all clinical IT systems. Paper-based emergency processes for HIS failure must be tested and documented.
4. Supply chain security: HIS vendors, laboratory software providers, and medical device service companies must be reviewed for security standards. § 30 Para. 2 No. 4 BSIG-new requires contractual clauses.
5. Access control and MFA: Access to HIS, PACS, and administrative systems must be secured by MFA. Clinical staff and IT administration need separate access concepts.
6. Encryption: Patient data in transit and at rest must be encrypted. This also applies to mobile devices (tablets on wards, on-call doctor smartphones).
7. Training and awareness: Physicians, nursing staff, and administrative personnel must receive regular phishing and IT security training.

Deadlines and reporting obligations

BSI registration under § 33 BSIG-new within three months. For security incidents under § 32 BSIG-new: initial report within 24 hours, full report within 72 hours, final report within 30 days.

A ransomware attack on the HIS must be reported to the BSI within 24 hours. This applies even if clinical operations can continue through fallback procedures. The report must include the scope of the incident, affected systems, and measures taken.

Fines and personal liability

Essential Entity (Annex I): up to EUR 10 million or 2% of global annual turnover. For hospitals without international revenue: 2% of total hospital group revenue.

§ 38 BSIG-new: personal liability of the hospital managing director and the senior IT manager for negligently missed NIS2 obligations. Combined with data protection liability (GDPR Art. 82) and professional code consequences, this represents significant personal risk.

Hospital Modernization Act funding and NIS2 obligations: when subsidies and compliance align

The German Hospital Modernization Act (KHZG) provides funding under §§ 21-21c KHZG for digitalization, including IT security (funding category 10). This funding overlaps significantly with NIS2 requirements.

Specifically: KHZG funding category 10 finances measures for "improving IT security." This includes network segmentation, identity and access management, SIEM systems, and emergency plans - all NIS2 obligations under § 30 BSIG-new.

Hospitals can therefore co-finance NIS2 compliance measures using KHZG funding. The condition: the hospital must justify in its application how the measures improve IT security. NIS2 compliance as a framework provides a clear line of argument for this. Unused KHZG funding potential for IT security is a missed opportunity.

First steps

1. Determine whether your hospital must be classified as an Essential Entity (virtually all hospitals: yes).
2. Inventory all clinical IT systems: HIS, PACS/RIS, laboratory, pharmacy, intensive care monitoring.
3. Ensure that downtime procedures exist for all critical systems and are regularly practiced.
4. Identify all remote maintenance access points from HIS vendors and medical device service teams.
5. Conduct a risk analysis for complete HIS failure: how long can clinical operations continue without HIS?
6. Review open KHZG application options for IT security measures.
7. Register with the BSI.

Common pitfalls

Medical devices excluded from IT security review: Ventilators, infusion pumps, and patient monitors with network connections are IT systems in the NIS2 sense.

HIS treated as a "closed system": Modern HIS systems connect via interfaces to laboratory systems, radiology, and external services. Each interface is a potential attack path.

Emergency plans only address hardware failure, not cyberattacks: Classic BCP plans assume hardware failure. A cyberattack requires different responses: network isolation, forensics, regulatory reporting.

KHZG funding not used for IT security: Many hospitals have applied for KHZG funds for process digitalization, not for IT security. This is a missed financing opportunity for NIS2 measures.

Use the industry-specific NIS2 calculator for hospitals to verify your obligations in a few minutes.