B3S for hospitals: requirements and evidence

This guide shows which duties apply, how evidence works and how to run the work in one portal instead of in spreadsheets and email threads.

What the B3S is and what it means legally

Section 391(1) SGB V obliges hospitals to take appropriate organisational and technical precautions according to the state of the art. They cover the systems that are decisive for the functioning of the hospital and for the protection needs of patient data. They include mandatory measures to raise the security awareness of staff (para. 2). A precaution is appropriate if the effort is not out of proportion to the consequences of a failure or to the protection needs (para. 3).

The law does not spell out the details. That is where the B3S comes in:

Origin: the B3S comes from the DKG and is publicly available on its website. It is neither a law nor a certificate.
Place in the law: under Section 391(4) SGB V, hospitals can meet their duties "in particular" by applying a B3S whose suitability the BSI has confirmed under § 30(8) BSIG. The words "in particular" leave other routes open. You should then be able to justify that your precautions match the state of the art.
Suitability: the BSI confirmed suitability on 3 November 2025 for three years, at that time under § 8a(2) BSIG in the version that applied until 5 December 2025. The new BSIG has no transition rule for such confirmations. The legislator, however, changed the reference in Section 391(4) SGB V to § 30(8) BSIG expressly as a consequential amendment only, and the BSI still lists the B3S Krankenhaus with the suitability confirmation expiring in November 2028. Version 1.3.1 is an editorial revision agreed with the BSI. You can therefore use the B3S today as a route under Section 391(4) SGB V; an explicit BSI statement that the confirmation continues under the new law does not exist so far.

Who the duties apply to

The B3S is aimed at all hospitals, not only the large ones. Which other duties apply depends on the classification under the BSI Act (BSIG), which has applied since 6 December 2025 as amended by the NIS2 Implementation Act:

Classification	Criterion	Duties	Evidence
Hospital	All hospitals	Section 391 SGB V	No regular evidence provided for
Important entity	From 50 employees or over EUR 10 million annual turnover and balance sheet total	§§ 30, 32, 33 and 38 BSIG	Documentation; review by the BSI where facts give reason (§ 62 BSIG)
Particularly important entity	From 250 employees or over EUR 50 million annual turnover and over EUR 43 million balance sheet total	§§ 30, 32, 33 and 38 BSIG	Documentation; the BSI can order audits and evidence (§ 61 BSIG)
Operator of a critical facility	From 30,000 full inpatient cases per year	Additionally § 31 and § 39 BSIG	Every three years to the BSI

Three notes on the classification:

Hospitals count as providers of health services among the entity types in Annex 1 BSIG. Hospital groups should check whether data of linked enterprises count (§ 28(4) BSIG).
The threshold of 30,000 cases is set in Annex 5, Part 3 BSI-KritisV.
For operators of critical facilities, §§ 30, 31 and 39 BSIG take the place of Section 391(1) SGB V (Section 391(5) SGB V). Practices and medical care centres in statutory medical care implement the IT security guideline under Section 390 SGB V. Outpatient care is currently not covered by the B3S.

What the B3S requires

The B3S looks at full inpatient care from admission to discharge. Its requirements carry a number (ANF) and are marked by how binding they are, for example as MUSS (must) or SOLL (should). The topics at a glance:

Management and ISMS: management is responsible for information security, adopts the policy and provides resources.
Risk management: alongside availability, integrity, authenticity and confidentiality, patient safety and treatment effectiveness are assessed.
Continuity and infrastructure: contingency planning, asset inventory, robust architecture and physical security.
Staff: awareness for all professional groups and personnel measures.
Incidents, audits and service providers: incident handling, internal and external audits, control of third parties.
Technical security: the topics range from network segmentation to secure deletion.
Medical technology: connected devices often cannot be patched or hardened like normal IT and need their own protection.

For operators of critical facilities the law also requires attack detection systems (§ 31(2) BSIG).

Important and particularly important entities should also compare the B3S with the ten minimum measures in § 30(2) BSIG, for example cryptography and multi-factor authentication. The B3S was assessed before the new BSIG and still maps its requirements to § 8a BSIG, not to the ten minimum measures in § 30(2) BSIG. Section 391(4) SGB V also refers only to the duties under Section 391. Registration (§ 33 BSIG), incident reports (§ 32 BSIG) and management training (§ 38(3) BSIG) come on top as separate duties.

How evidence works

Evidence depends on the classification, not on the B3S:

Operators of critical facilities demonstrate implementation every three years through security audits, inspections or certifications and send the BSI the results, including the deficiencies found. It can demand the underlying documentation and a remediation plan (§ 39 BSIG). The B3S forms the framework for the audit basis, and the DKG provides the Prüfnachweisplaner, an Excel planning aid.
Particularly important entities can be ordered by the BSI to undergo audits, inspections or certifications (§ 61(1) BSIG). It can order approved hospitals to present evidence no earlier than five years after the Act entered into force, unless an ordinance sets an earlier date (§ 61(3) BSIG).
Important entities are reviewed by the BSI if facts justify the assumption that duties are not being implemented correctly (§ 62 BSIG). Both groups have to document compliance with their duties (§ 30(1) sentence 3 BSIG).
Other hospitals: Section 391 SGB V provides for no regular evidence. Traceable documentation is still advisable.

Typical evidence includes the described scope, the decision on the implementation route, a risk analysis with date and approval, the action plan with status and owners, and training attendance records.

How to go about it

For a first inventory a spreadsheet is enough. Over several years and with many people involved it becomes hard to maintain. In Complass the same work runs in a guided project with eight phases:

Classify. The first phase guides you through the duties under Section 391 SGB V and the BSIG. You record the classification and the implementation route with reasons.
Set scope and leadership. Templates help with the scope, the policy, and roles and responsibilities. The framework comes with 15 document templates.
Work through the catalogue. The catalogue has 49 entries: the duties under Section 391 SGB V in their original wording and the B3S requirements in our own words, with references to chapters and ANF numbers. For each entry you record applicability, justification and owner. An implementation guide gives the goal, steps and minimum scope.

B3S catalogue in Complass: requirements in our own words with chapter and ANF references, applicability, justification and owner (sample project) — B3S catalogue: chapter and ANF references, applicability, justification and owner for each entry.

Record assets and risks. You keep IT systems and medical devices in the asset inventory with criticality and dependencies. You set the matrix, levels and acceptance criteria of the risk assessment yourself, so that patient safety and treatment effectiveness are taken into account.
Turn gaps into tasks. Gaps become tasks with owners, due dates and email reminders, recurring if needed and with approval by a second person.
Implement contingency planning and awareness. In business continuity management you keep the business impact analysis and the contingency and recovery plans. You assign the awareness basic course to staff, and the training proof shows the validity per person.
Check incidents. You record incidents centrally and check the reporting duty with guidance. The reporting stages under § 32 BSIG appear with their calculated deadline. You submit the report itself in the authority's reporting portal.
Bring the evidence together. Evidence files sit on the requirement, a second person reviews them, and certificates carry an expiry date with a reminder. The compliance package is exported as a ZIP with checksums. You invite your auditor free of charge, time-limited and with a log of every access.

Evidence file in the measure list marked "Accepted as evidence" by a second person — Evidence file with review by a second person.

Existing asset lists and action plans come in by import from Excel or CSV.

Practical example: a monitor that cannot be patched

An invented example: a hospital finds that a connected patient monitoring system runs on an outdated operating system and the manufacturer does not release an update.

In a spreadsheet this would be one row with a comment, and for the audit someone would have to gather everything else.

In Complass it is all connected. The monitoring system is in the asset inventory as a medical device with high criticality. The risk assessment also covers the consequences for patient safety. Medical technology gets a task to segment the network, and information security approves the result. Management formally accepts the remaining risk. The evidence sits on the matching requirement in the catalogue, and in the audit you show the chain from requirement to decision in one place.

Checklist for the start

Classification checked: Section 391 SGB V, important or particularly important entity, operator of a critical facility.
Implementation route set and justified, original B3S text from the DKG at hand.
Scope described with processes and critical systems, medical technology included.
Policy adopted, information security and owners named.
Inventory with criticality created, risk method with patient safety set.
Contingency planning and recovery arranged for the systems critical to care.
Awareness planned for all professional groups, attendance provable.
Incident procedure set: who checks the reporting duty and who reports.
Service providers and remote maintenance arranged, internal and external audits planned.
For entities under the BSIG: compared with § 30(2) BSIG, registration and management training clarified.

Frequently asked questions

Is the B3S mandatory for hospitals?

No. What is mandatory are the state-of-the-art precautions under Section 391 SGB V. The B3S is an expressly named way to meet them. Other routes, for example based on ISO/IEC 27001 or IT-Grundschutz, remain possible.

Does the B3S also apply to hospitals below 30,000 cases?

Yes. The standard is expressly aimed at hospitals below the KRITIS threshold too, and Section 391 SGB V applies to all hospitals. Below the threshold the additional duties under §§ 31 and 39 BSIG fall away. You measure the effort by appropriateness (Section 391(3) SGB V).

Does the B3S also cover NIS2?

Not automatically. Compare the B3S with § 30(2) BSIG and deal with registration, incident reports and management duties separately. In Complass, documented measures also count for the NIS2 framework through the shared control catalogue.

Does Complass contain the text of the B3S?

No. The B3S is a work of the DKG. Complass describes the requirements in its own words and refers to chapters and ANF numbers. Keep the original text at hand when you review.

The industry template for hospitals preselects the framework plus asset, business continuity and supplier management for you. In a demo we show you how requirements, risks and evidence come together in Complass.

Request a demo Try it for 14 days

Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case.