C5 certificate as the key to compliance
The German Digital Act (Digital-Gesetz) allows the use of cloud services in the healthcare sector, but only under strict conditions. Cloud providers may only offer their services if they have obtained a C5 certificate from the Federal Office for Information Security (BSI). If a cloud provider uses the services of third parties, it must be checked whether a C5 certificate is required.
C5 certificate
According to Section 393 (3) No. 2 of Book V of the German Social Code (SGB V), cloud providers must present a C5 certificate for their cloud systems and technologies. The certificate confirms that all relevant security and data protection requirements have been met. The certificate is based on the BSI C5:2020 criteria catalogue, which comprises a total of 125 criteria from 17 subject areas and is divided into basic and additional requirements.
Who is responsible?
The primary addressees of the SGB V obligation are cloud providers. These often use third-party services for various components. There is a debate as to whether a cloud provider must provide a certificate from the third party or an additional certificate of its own. Although the wording of the provision of SGB V is open and there are differing opinions, the spirit and purpose of the regulation, which is to ensure comprehensive data protection, and the C5 criteria catalogue, which contains specific requirements for the use of subservice providers, provide an overall solution. It requires both the cloud provider and the subservice provider used to be C5 certified.
Practical implementation
Cloud providers have two options for submitting a C5 certificate: With the inclusive method, the provider includes the subservice provider’s security measures in its own C5 audit. With the carve-out method, the security measures of the subservice provider are excluded and verified by a certificate from the subservice provider. In practice, the carve-out approach is recommended. It allows cloud providers to focus on their own security measures, which has benefits such as minimizing cost and effort.
With the German C5 equivalence regulation, alternative security certificates can now be recognized as equivalent to the C5 certificate. Alternatives are ISO/IEC 27001, ISO 27001 (based on the BSI standard “IT-Grundschutz”) or the Cloud Controls Matrix version 4.0. An additional requirement is the submission of a detailed action plan.
Additional requirement: Transfer to third countries
In addition to the C5 certificate, Section 393 SGB V contains a territorial restriction on data processing. Health data may only be processed within the European Union (EU), the European Economic Area, Switzerland, or countries for which the EU Commission has issued an adequacy decision. For US cloud providers, certification under the Data Privacy Framework Program is also required, even if the current adequacy decision for the US is in place.
Fazit
Cloud providers need their own C5 certificate. The C5 certification of subproviders must also be checked. The privately maintained list ‘BSI C5 Attestations’ provides an overview of which providers hold a C5 certificate.
back