Data protection in the medical practice: the 5 everyday pitfalls and when you need a data protection officer

After reading this article, you will know whether your practice needs a data protection officer, which everyday situations go wrong most often and how to train your team in a verifiable way. The basis is Art. 9(1) GDPR: health data is a special category of personal data and may only be processed under strict conditions, regardless of the size of the practice.

By the Provimedia editorial team · As of: July 2026 · This article is general information and not legal advice.

Why do special rules apply in a medical practice?

Two things are decisive. First: Art. 9(1) GDPR prohibits the processing of health data in principle. An exception applies only for the provision of healthcare, via Art. 9(2)(h) in conjunction with Art. 9(3) GDPR: processing may then only be carried out by staff who are bound by professional or equivalent confidentiality obligations.

Second, the medical duty of confidentiality, which is subject to criminal penalties under Section 203 of the German Criminal Code (StGB), applies in parallel. Anyone who discloses another person's secret without authorisation risks imprisonment of up to one year or a fine. Confidentiality and data protection are not synonyms: both sets of obligations apply in parallel and must be complied with at the same time.

What this means for you: check that all employees are bound to confidentiality in writing.

Which everyday situations are risky?

The biggest risks rarely arise from complex IT attacks but from everyday routines. The following table shows the most common situations and the correct practice for each.

The practice software itself is also relevant, because the contractual classification matters here:

• If the software runs through an external data centre or cloud provider, that provider usually processes the data as a processor within the meaning of Art. 28 GDPR. This requires a valid AVV (data processing agreement).
• With external laboratories or specialists to whom findings are passed on, by contrast, there is often no processing relationship: these bodies use the data for their own treatment purposes under their own responsibility. What is needed here is a sound legal basis for the transfer, not an AVV.

Technically, Art. 32 GDPR requires appropriate measures such as password protection, automatic screen locks, encrypted transmission channels and a defined procedure for data breaches. Organisationally, discretion mainly means privacy screens at reception, locked filing cabinets and a considered approach to fax, email and courier services.

Does a practice need a data protection officer?

Under Section 38(1) of the German Federal Data Protection Act (BDSG), controllers must appoint a data protection officer if they generally have at least 20 persons permanently engaged in the automated processing of personal data. Many small and medium-sized medical practices do not reach this 20-person threshold and are therefore not obliged to appoint one.

Regardless of the number of people, an obligation to appoint may nevertheless arise, for example if processing requires a data protection impact assessment.

Important: if there is no obligation to appoint, the substantive duties under the GDPR do not fall away. Even without a data protection officer, every practice must:

• keep a record of processing activities,
• inform patients about the processing of their data,
• meet its accountability obligation under the GDPR, that is, document compliance with the principles and be able to demonstrate it.

How are practice staff trained?

The German National Association of Statutory Health Insurance Physicians (Kassenärztliche Bundesvereinigung, KBV) expressly points out that practice staff must be informed about confidentiality and data protection. Medical assistants have daily contact with particularly sensitive data, at reception, on the phone and in billing.

They should therefore know the legal foundations:

• what special categories of personal data are,
• what rights patients have,
• and how a suspected data breach is to be reported.

A cross-industry GDPR basics training provides exactly this foundation for the entire practice team, including a dated certificate of participation for each employee. However, it does not replace an in-house briefing on the specific procedures on site, such as handling the respective practice management software, the practice's own authorisation concept or the reporting channels in the event of an incident. This fine-tuning remains the responsibility of the practice management.

Frequently asked questions (FAQ)

May patients' names be called out in the waiting room?

This is problematic from a data protection perspective. There is no express prohibition, but the principle of data minimisation clearly argues against calling out names and diagnoses loudly in the waiting area. Supervisory authorities therefore recommend alternatives such as call numbers, a discreet signal at reception or collecting patients directly from the waiting room.

Must every medical practice appoint a data protection officer?

No. The obligation under Section 38(1) BDSG generally applies only from at least 20 persons who are permanently engaged in automated data processing. Many solo and group practices do not reach this threshold. Irrespective of this, an obligation may also arise below this threshold, for example for certain types of processing; a voluntary appointment may nevertheless make sense.

How long must patient records be kept?

Under Section 630f(3) of the German Civil Code (BGB), the treatment record must in principle be kept for ten years after the end of treatment. Other regulations may provide for different, sometimes longer periods, for example for X-ray images. In case of doubt, the longer period applies.

What happens in the event of a data protection violation in the practice?

Violations may be examined by the competent supervisory authority and punished with a fine under Art. 83 GDPR, the amount of which depends on the individual case. In the event of a breach of confidentiality, criminal consequences under Section 203 StGB as well as civil claims by the affected patients also threaten.

Provimedia's GDPR basics training gives your entire practice team a shared, documented foundation, clearly presented and completable online.

Sources

• EUR-Lex: Regulation (EU) 2016/679 (GDPR), in particular Arts. 9, 28 and 32
• gesetze-im-internet.de: Section 38 BDSG – data protection officers of non-public bodies
• gesetze-im-internet.de: Section 203 StGB – violation of private secrets
• gesetze-im-internet.de: Section 630f BGB – documentation of treatment
• Kassenärztliche Bundesvereinigung (KBV): data protection in the practice