A laboratory result needs to reach the treating practice, a discharge letter must be sent to the clinic providing follow-up care, and a medical image needs to be shared with a specialist. Healthcare depends on information reaching the right people promptly and reliably.
Cloud services can make this exchange easier. They allow documents to be made available digitally and accessed by authorised users. At the same time, health data places strict demands on content protection, access management and the operation of the systems involved.
Medical practices, hospitals and laboratories therefore need to align the technical capabilities with legal and organisational requirements.
What Cloud Computing Means in Healthcare
Cloud computing involves providing IT resources over a network. These resources include storage, computing power and applications. A healthcare organisation might use a service for sharing files or run medical software in a cloud environment.
Different deployment models are available:
- Private cloud: The infrastructure is dedicated to a single organisation. It can be operated internally or by a service provider.
- Public cloud: A provider offers services to multiple customers. “Public” does not mean that the stored data is publicly accessible.
- Hybrid cloud: Multiple independent cloud infrastructures are connected, for example a private environment and external cloud services.
These terms describe how the infrastructure is provided. Whether a solution is suitable for health data also depends on its specific implementation: security measures, contracts, processing locations and applicable legal requirements. A private cloud is therefore not automatically secure, and a public cloud is not ruled out in principle. Source: BSI — Security Recommendations for Cloud Computing Providers
Typical Use Cases in Everyday Healthcare
One common use case is sharing findings and treatment records between healthcare organisations. Instead of sending documents through different channels, they can be made available in a designated environment. Access permissions determine who can receive the relevant content.
Cloud services can also support collaboration within an organisation. Documents needed by several teams can be accessed across different locations. Suitable version control helps users identify the current version.
For patients, secure digital access can make it easier to obtain their own medical results. Their identity, access rights and the scope of the information made available must be established reliably.
Other use cases include cloud-based healthcare applications and collaboration on research projects. These require a separate assessment of which data may be processed and for what purpose. The fact that information is technically available does not permit unrestricted further use.
These use cases are also described on the existing TeamDrive healthcare page.
Health Data Requires an Appropriate Legal Basis
Under Article 9 of the GDPR, health data belongs to the special categories of personal data. Processing it requires a legal basis under Article 6 and an applicable exception to the prohibition on processing under Article 9.
Explicit consent is one possible basis, but it is not mandatory for every processing activity. Providing medical care may also permit processing where the relevant legal conditions are met.
If a cloud provider acts as a data processor, the relationship must be governed by a contract in accordance with Article 28 of the GDPR. This includes instructions, security measures and the use of additional processors. Whether a data protection impact assessment is required depends particularly on the risks associated with the planned processing. Source: GDPR, particularly Articles 6, 9, 28 and 35
Professional confidentiality must also be considered. In Germany, Section 203 of the Criminal Code (StGB) permits the involvement of other persons assisting with professional activities, such as external IT service providers, under certain conditions. These include the necessity of their involvement and their obligation to maintain confidentiality. Encryption helps protect the content, but it does not replace an assessment of these requirements. Source: Section 203 StGB, in German
Additional Requirements Under Section 393 SGB V
Healthcare providers within the scope of Section 393 of Germany’s Social Code, Book V (SGB V), health and long-term care insurance funds, and their respective data processors are subject to specific requirements when processing social and health data through cloud services.
These requirements include permitted processing locations, an establishment of the data-processing entity in Germany, and appropriate technical and organisational measures reflecting the state of the art. Security assurance reports are also required, along with implementation of the corresponding customer controls identified in the audit report.
As a general rule, the provision has required a current C5 Type 2 attestation since 1 July 2025. Transitional rules apply to newly introduced systems. Equivalent security assurance may also be accepted under specified conditions.
When selecting a service, organisations should therefore check which systems and services the assurance actually covers. An audited data centre alone does not automatically address every requirement relating to the cloud application being used. Sources: Section 393 SGB V, in German, German Federal Ministry of Health — Digital Act FAQ, in German
Secure Cloud Use Requires Clear Procedures
Implementation starts with the intended workflow: which information will be made available, who needs it and which systems are involved? The answers determine the requirements for permissions, interfaces and operation.
For practical use, organisations should establish the following:
- Access permissions: Staff and external collaborators receive only the permissions they need for their tasks. Access is revoked when they leave.
- Content protection: Encryption and key management must suit the intended use. With end-to-end encryption, recovery in the event of lost keys must also be considered.
- Endpoint protection: Devices used to open documents also require appropriate security measures.
- Contingency planning: Responsibilities, recovery procedures and any necessary alternative workflows must be defined for service disruptions.
- Ending the service: Data export, deletion and a potential change of provider should be clarified before signing the contract.
These decisions form part of secure cloud use throughout a service’s lifecycle. Responsibility for them cannot be delegated entirely to the provider. Source: BSI — Secure Use of Cloud Services, in German
Cloud Storage, Backup and Archiving Serve Different Purposes
Storing a file in the cloud does not constitute a complete archiving strategy. Medical records must be managed in accordance with retention periods and documentation requirements.
Under Section 630f of the German Civil Code (BGB), treatment records generally have to be retained for ten years after treatment has ended, unless other provisions specify different retention periods. This does not establish a general statutory requirement to retain all patient records for 30 years.
When a treatment record is amended, the original content and the time of the amendment must remain identifiable. This also applies to electronic records. Source: Section 630f BGB, in German
Technical planning should distinguish between three tasks: operational storage makes records available for everyday use. A backup enables recovery after data loss. Archiving preserves documents and their traceability for the required period.
Long-term readability is also part of this planning. File formats, export options and any necessary migrations should be included in the strategy. Cloud storage alone does not resolve this issue.
The Electronic Patient Record Is a Separate Application
Germany’s electronic patient record, known as the ePA, and a cloud service for file sharing serve different purposes. The ePA is an application within Germany’s telematics infrastructure, with its own access and objection rules. It is not equivalent to an ordinary shared folder.
The ePA for people covered by statutory health insurance uses an opt-out model. Healthcare providers’ access is subject to defined conditions. Health insurance funds cannot view the medical content of the ePA. Source: German Federal Ministry of Health — ePA for All, in German
An additional cloud service can support other information-sharing processes. Its role should be clearly defined in relation to the ePA and existing practice or hospital information systems.
From a Specific Workflow to a Suitable Solution
A useful starting point is a clearly defined process, such as sharing selected documents between a medical practice and a laboratory. This makes it possible to assess whether permissions, usability and technical integration work in everyday practice.
The quality of a cloud solution also depends on whether staff can use it reliably. Clear responsibilities and straightforward procedures help ensure that the intended sharing process is actually followed.
For information about implementing these workflows with TeamDrive, visit our page on cloud solutions for medical practices, hospitals and laboratories.
