A hospital campus has three doors an attacker actually needs.
Reception, ward, server room. Understand these three places and you understand how hospitals get attacked: through people on shift work, through networked medical devices, and through a hospital information system that has grown along with the building. We test exactly that route, with patient safety as the hard limit and with a report that fits Section 391 SGB V (formerly Section 75c) and the B3S standard of the German Hospital Federation.
Every hospital must take appropriate technical and organizational measures reflecting the state of the art. Since March 26, 2024, this obligation sits in Section 391 SGB V.
Section 391 SGB V replaces 75c
March 26, 2024
With the Digital Act, Section 75c became Section 391 SGB V. The fixed two-year deadline was dropped; security awareness measures for staff are now mandatory. A single test does not prove the state of the art for good.
fully inpatient cases per year
30,000
Above this threshold a hospital counts as critical infrastructure, with additional obligations under the BSI Act.
The floor plan: how an attack moves through your hospital
The plan shows the route we take most often in hospital assessments. It starts at the most open point of the building and ends where patient records and billing live. Click an area to see what happens there and what we test there.
We never actively attack medical devices during live operation. We test their network connectivity, remote maintenance access and the separation from other networks. The ICU, operating theaters and anything with direct patient impact are off-limits, and that is set down in writing before every test.
The plan moves through the four areas on its own. A click stops it so you can read one area at your own pace.
Reception Open door, no time
What an attacker finds here
Open entrances, a steady stream of visitors and outside contractors, reception desks that sit unattended at times. Cleaning, medical equipment service and catering already move through the building unannounced. A white coat, a clipboard and the line “I am here from technical services for the maintenance” open more doors here than in almost any other industry.
What we test here
Simulated access attempts posing as a technician or a delivery driver, tailgating at side entrances, how staff handle an unfamiliar badge. Who in the building knows, and how our people identify themselves the moment they are challenged, is settled in advance.
At the bedside sit networked medical devices: infusion pumps, monitors, imaging systems. They are often maintained by the manufacturer and rarely covered by classic IT security concepts. Add staff on shift work who hear three call bells at once and have no spare minute to check a phishing email or a caller with a pretext.
What we test here
Phishing and pretexting simulations tailored to shift work. Logged-in workstations in the ward office, access to patient data from the corridor, remote maintenance access to the devices. The devices themselves stay untouched.
Whether a single compromised machine stays a local problem is decided between the rooms: in the separation between the HIS, the medical device network and administration, in access rights, and in Active Directory hardening. Without that separation, the way from a ward workstation to the central system is short.
What we test here
Network segmentation, permissions, Active Directory. We test how far an attacker gets from a ward network and what stops them, with network scans and manual testing within the agreed scope.
The hospital information system is the central system for patient records, billing and ward workflows, grown over many years and connected to many third-party systems. Each interface is a way in, and usually nobody has the complete picture of them anymore. In the SiKIS research project commissioned by the BSI, Fraunhofer SIT examined the two most widely used hospital information systems in Germany and documented significant vulnerabilities; the BSI published the results in March 2025.
What we test here
Interfaces, remote maintenance, access to the server room, the permissions concept. Systems with direct patient impact are analyzed passively only. If anything unexpected affects production systems we stop immediately; the emergency contact is named beforehand.
Four dates that set the frame for every hospital board: an obligation, a research finding, an incident and a legal reform.
Section 75c SGB V comes into force
Since then hospitals have been required to take appropriate organizational and technical measures reflecting the state of the art. Since March 26, 2024, this obligation sits in Section 391 SGB V, which no longer contains the two-year update rule. Applying an industry-specific security standard that the BSI has found suitable is named in the law as one way to meet this obligation.
Wertachkliniken: running a hospital without IT
Bobingen and Schwabmünchen
According to media reports, the Wertachklinik hospital group was hit by a ransomware attack in early September 2024. IT systems were disconnected from the external network as a precaution to prevent further spread. The criminal police opened an investigation.
Based on public reporting. Access Granted was not involved in this incident.
SiKIS documents vulnerabilities in HIS
In the SiKIS research project commissioned by the BSI, Fraunhofer SIT systematically examined hospital information systems and documented vulnerabilities. The finding concerns the class of systems, not a single hospital.
NIS2 implementation act in force
The BSI Act was recast. For KRITIS hospitals the obligations remain and grow. Whether a hospital below the KRITIS threshold is covered as an important or particularly important entity depends on its size and type.
Section 391 SGB V names an industry-specific security standard found suitable by the BSI, in practice the B3S of the German Hospital Federation, as a way to meet the state of the art. The standard is organized into topic areas. The matrix shows which module covers which area, how we proceed there, and where patient impact limits the test.
Connectivity, segmentation and remote maintenance access of the devices
The devices themselves are never actively attacked
actively tested
passive analysis only
The mapping helps you prepare your evidence. Whether an area counts as fulfilled is decided by your own B3S review, not by our report. We deliver the technical findings and their classification.
Night shift · 10:30 pm
What an access attempt at a hospital actually looks like
The main entrance closed hours ago; the emergency department did not. Someone in work clothes, toolbox in hand, badge on a lanyard, follows a nurse through the door onto the ward and mumbles something about a fault in the utility room. Nobody asks, because three call bells are going at once and because outside technicians at this hour are nothing unusual. A little later that person is alone in the ward office in front of a logged-in workstation, or at the door to the server room.
That is exactly how we test, but never without agreement. If the attempt gets spotted and stopped, that is a good result, not an embarrassing one.
How a hospital pentest runs
Patient safety comes first. That is why our approach at hospitals is coordinated more closely than in other industries.
01
Scope with patient safety in mind
Together we define which systems get actively tested and which are only analyzed passively. For anything with direct patient impact the rule is: test more cautiously, or skip it, when in doubt.
02
Testing with an emergency contact
Information gathering, network scans and manual testing within the agreed scope. An emergency contact is named. If anything unexpected affects production systems we stop immediately.
03
Report with B3S mapping
Every finding is rated by severity, exploitability and impact on hospital operations, and documented with recommendations, a management summary and mapping to the B3S.
The modules behind it
Section 391 SGB V and the B3S ask for evidence on several levels at once. These modules work together for that, and each has its own page.
Section 391 SGB V (Section 75c until March 2024) does not prescribe a specific test method. It requires appropriate measures reflecting the state of the art, explicitly including security awareness measures for staff. A penetration test is the standard technical instrument to show that the measures taken actually work. Without regular testing you have no evidence, in the event of an incident, that you met your obligation.
The industry-specific security standard of the German Hospital Federation is a way, found suitable by the BSI, to translate the state of the art under Section 391 SGB V into concrete measures. For KRITIS hospitals a recognized B3S is the usual benchmark for evidence under the BSI Act. For smaller hospitals it is a useful, voluntary reference that Section 391 SGB V explicitly names as a way to comply.
Yes, within a tightly agreed scope. Medical devices are subject to their own regulatory requirements and must not be put at risk during live operation. That is why we test the devices' network connectivity, segmentation and remote maintenance access rather than actively attacking the devices themselves.
Before any test we jointly define which systems get actively tested and which are only analyzed passively. For anything with direct patient impact the rule is: test more cautiously, or skip it, when in doubt. A defined emergency contact and an immediate stop for unexpected effects are a standard part of every hospital assessment.
The ICU, operating theaters and anything with direct patient impact. This list is set down in writing before the test and you can extend it as you see fit. Our people identify themselves the moment they are challenged, and as soon as patient care could be affected anywhere, we stop before it comes to that.
Yes, that is part of the Physical Pentest module. We simulate realistic access attempts, for example posing as a technician or a delivery driver, and check whether reception, access controls and server rooms hold up. The approach is agreed in advance with a defined group on your side.
The recast BSI Act has applied since December 6, 2025. Hospitals with 30,000 or more fully inpatient cases per year remain critical infrastructure. Whether a smaller hospital is covered as an important or particularly important entity depends on its size and type. Our free NIS2 exposure check gives a first, non-binding assessment.
That depends on scope: number of sites and systems, whether medical device networks are included, whether physical and social engineering testing are part of it. After a free initial consultation we know your scope and you receive a fixed-price quote.
The state of the art under Section 391 SGB V keeps moving.
One short call is enough to settle scope and timing. You then receive a fixed-price quote, with no obligation.
