Exception for day care and short-term care
Since March 6, under the German BSI Act (BSIG) – the German implementation of the NIS2 Directive (Directive (EU) 2022/2555) – affected entities have been required to register on the portal of the German Federal Office for Information Security (BSI). According to the BSI, only about 15,500 entities have registered so far – significantly fewer than the expected number of affected entities. The reason for the delay is often that entities encounter uncertainties and questions regarding the scope of application when assessing their compliance. This applies in particular to care services.
Care services under BSIG
The NIS 2 Directive, which is transposed into national law by the BSIG, does not contain an explicit exemption for care services. However, Annex 1, No. 4 of the BSIG refers, under the “Health” sector, to the Patient Mobility Directive (Directive 2011/24/EU). According to Recital 14 of this Directive, it does not apply to services whose “primary purpose is to assist persons who require help with routine daily activities.”
Express exception for long-term care
To date, the BSI has highlighted the explicit exception for long-term care on its website. This was justified by the wording of Recital 14 of the Patient Mobility Directive, which refers to long-term care, as well as the accompanying explicit exception in the explanatory memorandum to the BSIG. In practice, a distinction was regularly made between long-term and short-term care to determine whether the BSIG applied and whether a resulting registration requirement existed.
BSI: Exception also applies to day care or short-term care
The BSI has since moved away from this narrow interpretation and notes that – depending on the individual case – outpatient care services, as well as nursing homes and facilities providing day care and short-term care, shall do not fall within the scope of the BSIG. With reference to Recital 14 of the Patient Mobility Directive, it is not only the type of care that is relevant, but the specific service performed. The decisive factor is therefore whether the service provided primarily consists of assistance with routine daily activities.
For practice
The explicit extension of the BSIG exemption to day care and short-term care exempts many companies and facilities from the scope of the BSIG and the associated registration requirement. Nevertheless, entities may fall within the scope of the BSIG if they provide any additional medical services, which is why a careful case-by-case review is necessary. The same applies to potential coverage due to ancillary activities, such as corporate IT. A detailed and documented impact analysis therefore remains essential.
Check now if your entity is affected by NIS2 with our free NIS2 Quick-Check.
back