Key Takeaways
- Since July 1, 2024, § 393 of the German Social Code, Book V (SGB V) allows healthcare providers in Germany's statutory health insurance system (GKV), as well as statutory health and long-term care insurance funds, to process health data in the cloud only if a current C5 attestation is in place. The obligation also covers their processors, which includes most health SaaS providers.
- Your hosting provider's C5 attestation is not enough. The attestation has to cover the service that processes the data, and that is your SaaS product.
- Since July 1, 2025, a Type 2 attestation has been mandatory. Services first placed on the market after June 30, 2025 can rely on a Type 1 attestation for their first 18 months.
- For Type 2 audit periods starting on or after June 1, 2027, only the new C5:2026 catalog applies, with 168 basic criteria instead of the previous 121.
- Under the C5 Equivalence Ordinance (C5GleichwV), an ISO/IEC 27001 certification can serve as a bridge for up to 24 months, provided there is a binding plan to close the C5 gaps.
Does my healthcare SaaS need a C5 attestation?
If you process health data in the cloud on behalf of a medical practice, hospital, care service, or insurance fund, the answer is usually yes, even if you don't host anything yourself and even if your company is based outside Germany. What matters most is who your customers are.
C5 is the Cloud Computing Compliance Criteria Catalogue published by the German Federal Office for Information Security (BSI). At first glance, § 393 SGB V is aimed at physicians in the statutory system, hospitals, pharmacies, and therapy professions. But it applies not only to the healthcare providers listed in Chapter 4 of SGB V and to the health and long-term care insurance funds, but also to their processors. If you sell software that these professionals use to process patient data, you share a large part of the responsibility for information security. What a C5 attestation is in general and how the audit works is covered in our guide to the C5 attestation.
Many software providers only find out they are affected in a sales conversation, when the prospect's procurement team suddenly asks for the C5 attestation. Shortly before signing, that quickly becomes a dealbreaker if you have neither a certificate that is accepted in the interim nor a firm date for your Type 2 attestation.
In fast-growing software companies, a new legal requirement competes with long to-do lists and doesn't always get attention right away. Startups and scale-ups that build software for medical practices, care professionals, or pharmacies are obligated too. At that point, a criteria catalog of more than 200 pages can look like an impossible hurdle.
This table gives you a first orientation:
Is my hosting provider's C5 attestation enough?
No. § 393 requires the attestation from the party that processes the data (§ 393 Abs. 3 Nr. 2 SGB V), and as a SaaS provider, that is you. Your customers also have to implement the complementary customer criteria listed in your audit report (§ 393 Abs. 3 Nr. 3 SGB V).
I hear this misconception again and again in conversations with health SaaS providers. I like to explain it with an image: a secured building doesn't replace a locked office. In the same way, the hosting provider's attestation doesn't replace the attestation of the software provider that processes the data.
You still need your hosting provider's attestation. Toward your host, you are the customer, so you have to implement its complementary customer criteria for your own C5 attestation to hold up. Your auditor excludes the host's infrastructure from your audit and relies on the host's attestation and audit report instead (the carve-out method). The host's attestation is a building block for yours, not a substitute. A C5 attestation always covers only the services that were audited, never the provider as a whole.
The same applies to subprocessors. If you don't sell to practices directly but to software providers that serve them, C5 affects you just as much. An example from practice: you offer an AI transcription API that a practice management system (PVS) vendor builds into its product. Your contract is with the PVS vendor, not with the practice. Because patient data still runs through your API, you are a subprocessor in the supply chain. Your customer has to pass the requirements on to you contractually and will ask for the C5 attestation.
Two other misconceptions I hear often. The obligation doesn't go away just because your customers haven't asked for it yet. And pseudonymization doesn't exempt you: pseudonymized health data remains personal data under the GDPR. Only fully anonymized data is exempt.
What does § 393 SGB V require for cloud software in healthcare?
§ 393 SGB V allows cloud processing of health and social data only under four conditions. The C5 attestation is one of them, but not the only one.
- Processing location: Processing must take place in Germany, the EU, a state with equivalent status, or a country with an adequacy decision (§ 393 Abs. 2 SGB V). This also applies to access: customer support from third countries without an adequacy decision is not permitted. Standard contractual clauses don't change that.
- Technical and organizational measures: The processing company must define and implement appropriate, state-of-the-art technical and organizational measures (TOMs) for information security. Which standard applies depends on the customer: practices, hospitals, and insurance funds are subject to different requirements under §§ 390 and 391 SGB V.
- Current C5 attestation: It must cover the catalog's basic criteria.
- Customer criteria: The complementary customer criteria listed in the audit report must be implemented.
The requirements of the German Social Code, Book X (SGB X) and the Federal Data Protection Act (BDSG) continue to apply as well. A C5 attestation doesn't replace a proper data processing agreement. We summarize the additional obligations that come with the GDPR in our overview of GDPR requirements.
The C5 attestation also helps you in sales. On request, you can have attested systems listed on the platform of the Competence Center for Interoperability in Healthcare (KIG, § 393 Abs. 7 SGB V). Practices, hospitals, and health and long-term care insurance funds find your product there directly when they look for a cloud provider that meets § 393 SGB V.
C5 Type 1 or Type 2: which attestation do I need under § 393?
In principle, Type 2. The two types don't differ in content: Type 1 assesses whether the controls are suitably designed at a specific date, while Type 2 assesses whether they operate effectively over a period of time. We explain the differences in detail in our guide to C5 Type 1 and Type 2.
Until June 30, 2025, a Type 1 attestation was sufficient for § 393. Since July 1, 2025, a Type 2 attestation has been mandatory. The only exception is for services first placed on the market after June 30, 2025: for them, a Type 1 attestation is enough for the first 18 months, and Type 2 is required from month 19.
For planning, the audit period is what counts. According to the BSI, a Type 2 attestation covers an observation period of 6 to 12 months, as explained in the BSI's introduction to C5. The controls have to produce evidence from the first day of that period, such as tickets, logs, or documented reviews. The auditor takes samples from the entire period, and gaps can't be closed after the fact.
That's why I recommend starting the Type 2 audit period immediately after the Type 1 attestation. That way, you avoid unpleasant surprises in month 19.
Do new audits use C5:2020 or C5:2026?
If you're starting now, go straight for an attestation against C5:2026. For Type 2 audit periods starting on or after June 1, 2027, only the new catalog applies.
Audits that end before February 28, 2027 can run entirely under C5:2020. If a C5:2020 audit period ends between February 28 and May 31, 2027, the system description must document the planned changes toward C5:2026.
C5:2026 contains 168 basic criteria instead of the previous 121, plus 89 additional criteria. Only the basic criteria are mandatory for § 393 SGB V. New requirements include confidential computing, post-quantum cryptography, and container management. Some existing requirements, such as supply chain monitoring and tenant separation, have been tightened (BSI, C5:2026 change history). The criteria are still grouped into 17 subject areas, which structure chapter 5 of the C5:2026 criteria catalog.
How long does a C5 attestation take, and what does it cost?
With an existing ISMS based on ISO/IEC 27001, the path to a Type 2 attestation takes about 7 to 14 months, because the observation period alone is at least 6 months. Without an operational ISMS, plan more conservatively with 12 to 20 months. How to build an ISMS from scratch is covered in a separate guide.
In practice, implementing the criteria in the first place is rarely the problem. What I stress most with my clients: evidence has to be produced without gaps across the entire audit period. If you miss a review in month three, you can't make it up later.
Costs also vary widely. You need to account for software licenses, consulting, the fees of the auditing firm issuing the attestation, and internal effort. Simple Type 1 audits start in the low five figures (in euros), and complex Type 2 audits over longer periods can reach six figures. Auditing firms set their fees freely. Annual follow-up audits are usually cheaper than the initial audit.
Can ISO 27001 certification replace a C5 attestation?
Only temporarily. ISO/IEC 27001 is a solid foundation: criterion OIS-01 of C5:2026 even requires an ISMS built according to ISO/IEC 27001, though not necessarily certified (C5:2026, chapter 5.1, criterion OIS-01). Through the C5 Equivalence Ordinance, the certification can serve as a bridge for up to 24 months.
The Equivalence Ordinance requires four things in addition to the ISO/IEC 27001 certification (§ 1 Abs. 2 C5GleichwV):
- A gap documentation of the C5 basic criteria that are not yet met.
- Technical and organizational measures that cover the identified gaps.
- A milestone plan that closes these gaps within 12 months.
- Measures to obtain the Type 1 attestation within 18 months and the Type 2 attestation within 24 months of creating the milestone plan.
You must present the implementation plan and the certificate to customers and supervisory authorities without delay on request (§ 1 Abs. 3 C5GleichwV).
That's why, in my projects, we always start with ISO/IEC 27001. Its requirements cover many important basic criteria of the C5 catalog and form the foundation of your information security. After a gap analysis, we build the specific control system for your C5 attestation on top of it. How the certification audit itself works is explained in our article on ISMS certification under ISO 27001.
How does Kertos help health SaaS providers get a C5 attestation?
Kertos combines a compliance platform for controls and evidence with support from experienced experts who guide your project from gap analysis to attestation. Whether you're a young company selling your first product to medical practices or have served large hospitals for years, we help you plan the C5 attestation so that it doesn't block your sales.
On the platform, the criteria are structured so that you can link evidence directly to each observation period. Modules for asset, vendor, and risk management, as well as business continuity and incident management, cover further parts of the catalog. In the Trust Center, you share exactly the content your customers request, from the C5 audit report to your list of subprocessors.
If you'd like to see how your path to a C5 attestation can be planned, book a Kertos demo and talk through your use case with our experts.
Frequently asked questions
How much does a C5 attestation cost?
It depends mainly on the audit scope and the type of attestation. Simple Type 1 audits start in the low five figures (in euros), and complex Type 2 audits can reach six figures. Software, consulting, and internal effort come on top. Follow-up audits are usually cheaper than the initial audit.
Do I need a C5 Type 1 or Type 2 attestation?
In principle, Type 2. For a system first placed on the market after June 30, 2025, a Type 1 attestation is enough for the first 18 months. From month 19, Type 2 is mandatory (§ 393 Abs. 4 SGB V).
Is ISO 27001 certification enough for § 393 SGB V?
Only temporarily. ISO/IEC 27001 counts as equivalent if there is also an action plan to close the C5 gaps. From the date that plan is created, a Type 1 attestation must follow within 18 months and a Type 2 attestation within 24 months.
How long does it take to get a C5 Type 2 attestation?
With an existing ISMS based on ISO/IEC 27001, about 7 to 14 months; without an ISMS, more like 12 to 20 months. Most of that time is the observation period of 6 to 12 months, plus preparation and reporting.
Can our support team access health data from outside the EU?
Only from Germany, the EU, states with equivalent status, or third countries with an adequacy decision. Remote access counts as processing, too. Standard contractual clauses are not enough, because § 393 SGB V doesn't provide for them as a legal basis.
What happens if we don't have a C5 attestation?
§ 393 SGB V itself doesn't set a fine. A violation can, however, also be a GDPR violation, and customers may bring warranty claims. Healthcare providers aren't allowed to use the service without an attestation, which is why the missing attestation is usually the bigger problem in sales.
