KBV IT Security Guideline §390 SGB V meets the October 2026 Microsoft 365 double outage – why 170,000 German medical practices, MVZs and dental practices need a sovereign alternative now

On 6 October 2026, Microsoft 365 went down across Europe for the second time within four weeks. This time Microsoft Teams, Exchange Online, SharePoint, OneDrive, Defender XDR and Purview were affected – Microsoft's own status dashboard pointed to a faulty configuration in Azure Front Door. For Germany's roughly 170,000 contract physicians and 85,000 contract dentists, this is more than an annoyance: it is the third concrete piece of evidence in one quarter that processing patient data in a cloud operationally run by a US corporation is incompatible with the IT security guideline under §390 SGB V, which has been binding since 1 October 2025. The accompanying BSI implementation notes now say so without ambiguity: Microsoft 365 and OneDrive are not usable for patient data in a statutory-insurance physician or dental practice. This article explains what §390 SGB V actually demands, why the October outage is a driver rather than a coincidence, and how a practice can switch to a sovereign European alternative in roughly 120 days.

The October 2026 double outage as proof of missing resilience

Between 8 September 2026 and 6 October 2026 there were two large-scale Microsoft 365 incidents with multi-hour total outages across parts of Europe. The first affected Microsoft Teams for Education across Europe; the second spread to Exchange, SharePoint, OneDrive and the Defender security dashboard. For a contract practice such an outage means: no patient contact by email, no electronic physician letter going out, the shared calendar is dark, Teams case conferences with referrers cannot happen. §390 SGB V Annex 1 (sections A1 and A5) requires documented and productively tested recovery procedures – a multi-hour total outage without a local fallback does not qualify. The long-standing habit of treating Microsoft as "too big to fail" is firmly disproven by two major outages in a single month.

What §390 SGB V requires of every practice

The renumbered guideline – before the GVWG and the SGB V restructuring known as §75b SGB V – splits every practice into three sizes. Small practice: up to five people regularly engaged in data processing. Medium practice: six to twenty people. Large practice / MVZ: 21 or more people, or data processing at substantial scale. Annexes 1 to 3 stack the obligations; Annex 4 covers medical large-scale equipment such as CT, MRI or digital X-ray; Annex 5 covers the decentralised TI components – connector, VSDM, eRezept module, ePA module and TI messenger. A medium practice therefore has to implement 22 to 40 individual measures, an MVZ considerably more. Core items include multi-factor authentication, network segmentation between the practice management system and office IT, encrypted backups with a documented recovery test, and provable patch management.

Why the BSI implementation notes rule out Microsoft 365

The BSI implementation notes for the IT security guideline – drafted jointly with the KBV – explicitly name Microsoft 365, OneDrive and comparable public-cloud services as unsuitable for processing patient data. The reason is the CLOUD Act: US authorities can compel the handover of data operationally controlled by a US corporation – regardless of server location or EU contract clauses. Patient data is simultaneously covered by Article 9 GDPR (special categories) and §203 StGB (professional secrecy under German criminal law). This constellation has already been examined for law firms and tax advisors and applies to physicians in mirror image: the practice owner, as the holder of professional secrecy, is personally liable when they expose protected data to an environment that gives third parties structural access. Microsoft's Sovereign Public Cloud does not change this structurally as long as Microsoft remains the operator – see the debate around "sovereignty washing" with Microsoft 365 Local.

What a §390-compliant sovereign alternative must meet

A suite that contract physician practices and MVZs can actually use must meet three hard criteria. First: the operational provider is a legal entity whose seat and majority ownership sit in the European Union and that is not subject to the US CLOUD Act – same logic as in the hospital NIS2 case. Second: a BSI C5 attestation or an equivalent audited certification for the data-centre operations. Third: key sovereignty – the practice holds the encryption key itself or deposits it with a European trustee, never with the infrastructure provider. In production this means: Nextcloud with Collabora Online for files and documents, Open-Xchange or Mailcow for mail and calendar, Element on Matrix for internal team communication, plus a hardened Linux back end and automatic backups to a second EU location. These components also meet the NIS2 obligations in the healthcare sector.

What practice owners should do now

The KBV began in 2026 to request the §390 SGB V implementation declaration on a sampling basis as part of its reimbursement notices. Any practice that cannot show a current, documented, and staff-trained policy risks reimbursement cuts and – in the event of a breach – personal liability under §203 StGB. The concrete path is in the HowTo section of this article: seven steps, roughly 120 days, mail and file services first, Teams replacement before shutting down the Exchange Online tenant, procedural documentation as the final mandatory step. europioneer delivers the components as an integrated stack under a German-law operating contract, server location Frankfurt am Main and optional secondary site in Luxembourg; see our pricing models, the alternatives catalogue and the Microsoft live tracker for ongoing outage observation. For a practice-specific gap analysis: get in touch.

Takeaway

The Microsoft 365 outage of 6 October 2026 is not the problem – it is the symptom. The problem is a years-old operational dependence on a single US vendor in a sector that §390 SGB V, §203 StGB, Article 9 GDPR and NIS2 simultaneously oblige to provide auditable evidence, professional secrecy, highest-category data protection and resilience. The new KBV guideline removes the last discretionary space. The technical alternative – Nextcloud, Collabora, Open-Xchange, Element, on European-controlled Linux – is productive, auditable, and in use since 2026 across public authorities, universities and hospitals. For contract physicians, MVZs and dental practices the decision window is closing.