[{"data":1,"prerenderedAt":375},["ShallowReactive",2],{"navigation-docs_en":3,"/en/blog/kbv-it-security-guideline-390-sgb-v-medical-practices-microsoft-365-october-2026-posts_en":51,"/en/blog/kbv-it-security-guideline-390-sgb-v-medical-practices-microsoft-365-october-2026-surround-posts_en":364},[4],{"title":5,"path":6,"stem":7,"children":8,"page":25},"En","/en","en",[9],{"title":10,"path":11,"stem":12,"children":13,"page":25},"Docs","/en/docs","en/1.docs",[14,26],{"title":15,"path":16,"stem":17,"children":18,"icon":25},"Getting Started","/en/docs/getting-started","en/1.docs/1.getting-started/1.index",[19,21],{"title":20,"path":16,"stem":17,"children":-1},"Introduction",{"title":22,"path":23,"stem":24,"children":-1},"Migration Roadmap","/en/docs/getting-started/migration-fahrplan","en/1.docs/1.getting-started/2.migration-fahrplan",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Technologies","/en/docs/technologies","en/1.docs/2.technologies",[31,35,39,43,47],{"title":32,"path":33,"stem":34,"children":-1},"Nextcloud","/en/docs/technologies/nextcloud","en/1.docs/2.technologies/1.nextcloud",{"title":36,"path":37,"stem":38,"children":-1},"Matrix / Element","/en/docs/technologies/matrix","en/1.docs/2.technologies/2.matrix",{"title":40,"path":41,"stem":42,"children":-1},"ONLYOFFICE","/en/docs/technologies/onlyoffice","en/1.docs/2.technologies/3.onlyoffice",{"title":44,"path":45,"stem":46,"children":-1},"Ubuntu Linux","/en/docs/technologies/ubuntu","en/1.docs/2.technologies/4.ubuntu",{"title":48,"path":49,"stem":50,"children":-1},"Keycloak","/en/docs/technologies/keycloak","en/1.docs/2.technologies/5.keycloak",{"id":52,"title":53,"authors":54,"badge":60,"body":62,"date":307,"description":308,"extension":309,"faq":310,"howto":326,"image":356,"meta":358,"navigation":359,"path":360,"seo":361,"stem":362,"__hash__":363},"posts_en/en/3.blog/32.kbv-it-security-guideline-390-sgb-v-medical-practices-microsoft-365-october-2026.md","KBV IT Security Guideline §390 SGB V meets the October 2026 Microsoft 365 double outage – why 170,000 German medical practices, MVZs and dental practices need a sovereign alternative now",[55],{"name":56,"to":57,"avatar":58},"europioneer Team","/",{"src":59},"/favicon.svg",{"label":61},"Medical Practices & MVZ",{"type":63,"value":64,"toc":297},"minimark",[65,69,129,134,147,151,175,179,213,217,260,264,286,290],[66,67,53],"h1",{"id":68},"kbv-it-security-guideline-390-sgb-v-meets-the-october-2026-microsoft-365-double-outage-why-170000-german-medical-practices-mvzs-and-dental-practices-need-a-sovereign-alternative-now",[70,71,72,73,77,78,81,82,77,85,77,88,77,91,77,94,97,98,101,102,105,106,97,109,112,113,120,121,124,125,128],"p",{},"On ",[74,75,76],"strong",{},"6 October 2026",", ",[74,79,80],{},"Microsoft 365"," went down across Europe for the second time within four weeks. This time ",[74,83,84],{},"Microsoft Teams",[74,86,87],{},"Exchange Online",[74,89,90],{},"SharePoint",[74,92,93],{},"OneDrive",[74,95,96],{},"Defender XDR"," and ",[74,99,100],{},"Purview"," were affected – Microsoft's own status dashboard pointed to a faulty configuration in ",[74,103,104],{},"Azure Front Door",". For Germany's roughly ",[74,107,108],{},"170,000 contract physicians",[74,110,111],{},"85,000 contract dentists",", this is more than an annoyance: it is the third concrete piece of evidence in one quarter that processing patient data in a cloud operationally run by a US corporation is incompatible with the IT security guideline under ",[114,115,119],"a",{"href":116,"rel":117},"https://www.kbv.de/documents/infothek/rechtsquellen/bekanntmachungen/richtlinien/IT-Sicherheitsrichtlinie_390_KBV.pdf",[118],"nofollow","§390 SGB V",", which has been binding since ",[74,122,123],{},"1 October 2025",". The accompanying BSI implementation notes now say so without ambiguity: Microsoft 365 and OneDrive are not usable for patient data in a statutory-insurance physician or dental practice. This article explains what §390 SGB V actually demands, why the October outage is a driver rather than a coincidence, and how a practice can switch to a ",[74,126,127],{},"sovereign European alternative"," in roughly 120 days.",[130,131,133],"h2",{"id":132},"the-october-2026-double-outage-as-proof-of-missing-resilience","The October 2026 double outage as proof of missing resilience",[70,135,136,137,97,140,142,143,146],{},"Between ",[74,138,139],{},"8 September 2026",[74,141,76],{}," there were two large-scale Microsoft 365 incidents with multi-hour total outages across parts of Europe. The first affected ",[74,144,145],{},"Microsoft Teams for Education"," across Europe; the second spread to Exchange, SharePoint, OneDrive and the Defender security dashboard. For a contract practice such an outage means: no patient contact by email, no electronic physician letter going out, the shared calendar is dark, Teams case conferences with referrers cannot happen. §390 SGB V Annex 1 (sections A1 and A5) requires documented and productively tested recovery procedures – a multi-hour total outage without a local fallback does not qualify. The long-standing habit of treating Microsoft as \"too big to fail\" is firmly disproven by two major outages in a single month.",[130,148,150],{"id":149},"what-390-sgb-v-requires-of-every-practice","What §390 SGB V requires of every practice",[70,152,153,154,158,159,162,163,166,167,170,171,174],{},"The renumbered guideline – before the GVWG and the SGB V restructuring known as ",[114,155,157],{"href":156},"/en/blog/bsi-it-grundschutz-microsoft-365","§75b SGB V"," – splits every practice into three sizes. ",[74,160,161],{},"Small practice",": up to five people regularly engaged in data processing. ",[74,164,165],{},"Medium practice",": six to twenty people. ",[74,168,169],{},"Large practice / MVZ",": 21 or more people, or data processing at substantial scale. Annexes 1 to 3 stack the obligations; Annex 4 covers medical large-scale equipment such as CT, MRI or digital X-ray; Annex 5 covers the decentralised TI components – connector, VSDM, eRezept module, ePA module and TI messenger. A medium practice therefore has to implement ",[74,172,173],{},"22 to 40 individual measures",", an MVZ considerably more. Core items include multi-factor authentication, network segmentation between the practice management system and office IT, encrypted backups with a documented recovery test, and provable patch management.",[130,176,178],{"id":177},"why-the-bsi-implementation-notes-rule-out-microsoft-365","Why the BSI implementation notes rule out Microsoft 365",[70,180,181,182,185,186,190,191,194,195,198,199,203,204,207,208,212],{},"The ",[74,183,184],{},"BSI implementation notes for the IT security guideline"," – drafted jointly with the KBV – explicitly name Microsoft 365, OneDrive and comparable public-cloud services as unsuitable for processing patient data. The reason is the ",[114,187,189],{"href":188},"/en/blog/cloud-act-2026","CLOUD Act",": US authorities can compel the handover of data operationally controlled by a US corporation – regardless of server location or EU contract clauses. Patient data is simultaneously covered by ",[74,192,193],{},"Article 9 GDPR"," (special categories) and ",[74,196,197],{},"§203 StGB"," (professional secrecy under German criminal law). This constellation has already been examined for ",[114,200,202],{"href":201},"/en/blog/microsoft-365-copilot-law-firms-tax-advisors-professional-secrecy-2026","law firms and tax advisors"," and applies to physicians in mirror image: the practice owner, as the holder of professional secrecy, is personally liable when they expose protected data to an environment that gives third parties structural access. Microsoft's ",[74,205,206],{},"Sovereign Public Cloud"," does not change this structurally as long as Microsoft remains the operator – see the debate around ",[114,209,211],{"href":210},"/en/blog/sovereignty-washing-microsoft-365-local-municipalities-2026","\"sovereignty washing\" with Microsoft 365 Local",".",[130,214,216],{"id":215},"what-a-390-compliant-sovereign-alternative-must-meet","What a §390-compliant sovereign alternative must meet",[70,218,219,220,223,224,228,229,232,233,236,237,239,240,243,244,247,248,251,252,255,256,212],{},"A suite that contract physician practices and MVZs can actually use must meet three hard criteria. First: the ",[74,221,222],{},"operational provider"," is a legal entity whose seat and majority ownership sit in the European Union and that is not subject to the US CLOUD Act – same logic as in the ",[114,225,227],{"href":226},"/en/blog/hospital-nis2-microsoft-365-sovereign-cloud-alternative-2026","hospital NIS2 case",". Second: a ",[74,230,231],{},"BSI C5 attestation"," or an equivalent audited certification for the data-centre operations. Third: ",[74,234,235],{},"key sovereignty"," – the practice holds the encryption key itself or deposits it with a European trustee, never with the infrastructure provider. In production this means: ",[74,238,32],{}," with ",[74,241,242],{},"Collabora Online"," for files and documents, ",[74,245,246],{},"Open-Xchange"," or ",[74,249,250],{},"Mailcow"," for mail and calendar, ",[74,253,254],{},"Element on Matrix"," for internal team communication, plus a hardened Linux back end and automatic backups to a second EU location. These components also meet the ",[114,257,259],{"href":258},"/en/blog/nis2-gdpr-microsoft-paradox","NIS2 obligations in the healthcare sector",[130,261,263],{"id":262},"what-practice-owners-should-do-now","What practice owners should do now",[70,265,266,267,271,272,276,277,281,282,212],{},"The KBV began in 2026 to request the §390 SGB V implementation declaration on a sampling basis as part of its reimbursement notices. Any practice that cannot show a current, documented, and staff-trained policy risks reimbursement cuts and – in the event of a breach – personal liability under §203 StGB. The concrete path is in the HowTo section of this article: seven steps, roughly 120 days, mail and file services first, Teams replacement before shutting down the Exchange Online tenant, procedural documentation as the final mandatory step. europioneer delivers the components as an integrated stack under a German-law operating contract, server location Frankfurt am Main and optional secondary site in Luxembourg; see our ",[114,268,270],{"href":269},"/en/pricing","pricing models",", the ",[114,273,275],{"href":274},"/en/alternativen","alternatives catalogue"," and the ",[114,278,280],{"href":279},"/en/microsoft","Microsoft live tracker"," for ongoing outage observation. For a practice-specific gap analysis: ",[114,283,285],{"href":284},"/en/contact","get in touch",[130,287,289],{"id":288},"takeaway","Takeaway",[70,291,292,293,296],{},"The Microsoft 365 outage of 6 October 2026 is not the problem – it is the symptom. The problem is a years-old operational dependence on a single US vendor in a sector that §390 SGB V, §203 StGB, Article 9 GDPR and NIS2 ",[74,294,295],{},"simultaneously"," oblige to provide auditable evidence, professional secrecy, highest-category data protection and resilience. The new KBV guideline removes the last discretionary space. The technical alternative – Nextcloud, Collabora, Open-Xchange, Element, on European-controlled Linux – is productive, auditable, and in use since 2026 across public authorities, universities and hospitals. For contract physicians, MVZs and dental practices the decision window is closing.",{"title":298,"searchDepth":299,"depth":299,"links":300},"",2,[301,302,303,304,305,306],{"id":132,"depth":299,"text":133},{"id":149,"depth":299,"text":150},{"id":177,"depth":299,"text":178},{"id":215,"depth":299,"text":216},{"id":262,"depth":299,"text":263},{"id":288,"depth":299,"text":289},"2026-10-06T00:00:00.000Z","On 6 Oct 2026 Microsoft 365 fails across Europe for the second time in four weeks. The KBV guideline under §390 SGB V has been binding since October 2025 – and BSI explicitly advises against M365.","md",[311,314,317,320,323],{"q":312,"a":313},"What does the IT security guideline under §390 SGB V actually regulate?","The guideline issued by the German National Association of Statutory Health Insurance Physicians (KBV) and the National Association of Statutory Health Insurance Dentists (KZBV) under §390 SGB V – before the SGB V renumbering known as §75b – defines binding technical and organisational minimum measures for the IT of every statutory health insurance physician and dentist practice in Germany. It was drawn up jointly with the German Federal Office for Information Security (BSI) and has been productively binding in its updated version since 1 October 2025 for KBV members and 1 January 2026 for KZBV members. It affects roughly 170,000 contract physicians and 85,000 contract dentists in Germany.",{"q":315,"a":316},"Which practice sizes does the guideline distinguish?","Three categories plus two additional annexes. A small practice has up to five people regularly engaged in data processing. A medium practice has six to twenty people. A large practice or Medical Care Centre (MVZ) has 21 or more people, or performs data processing at substantial scale. Annexes 1 to 3 stack the requirements – Annex 1 applies to every practice, Annex 2 adds requirements from medium size, Annex 3 adds requirements from MVZ size. Annex 4 covers medical large-scale equipment, Annex 5 the decentralised telematics infrastructure components.",{"q":318,"a":319},"May a practice still use Microsoft 365?","The BSI implementation notes for the IT security guideline explicitly recommend not using Microsoft 365, OneDrive or comparable cloud services for processing patient data. The reason is the US CLOUD Act, which grants US authorities access to data operationally controlled by a US corporation – regardless of server location. Patient data falls under Article 9 GDPR as a special category of personal data with the highest protection level. A practice that nevertheless uses Microsoft 365 for patient data violates the guideline – with disciplinary and liability consequences for the practice owner.",{"q":321,"a":322},"Which practical risks did the October 2026 outage reveal?","The outage of 6 October 2026 was the second major Microsoft 365 incident within four weeks. Affected services included Exchange Online, Microsoft Teams, SharePoint, OneDrive, Defender and Purview – services many MVZs use for appointment management, electronic physician letters, team meetings and document storage. For contract physicians this means no patient contact by email, no access to the shared calendar, no handoff to statutory health insurance billing procedures routed through SharePoint file shares. §390 SGB V requires documented recovery procedures – a multi-hour total outage without a local fallback does not meet that bar.",{"q":324,"a":325},"Which sovereign alternative meets §390 SGB V and the GDPR at the same time?","A European-operated open-source suite with a contractually guaranteed server location in Germany or the EU, encrypted data processing with customer-controlled keys, a BSI C5 attestation or equivalent evidence, and an operator not subject to the US CLOUD Act. In practice this means Nextcloud with Collabora Online for file storage and document editing, Open-Xchange or Mailcow for mail and calendar, Element on Matrix for internal team communication, and a hardened Linux back end hosted by a German or European operator. The europioneer platform delivers these components as one productive stack for practices from two to two hundred workstations.",{"name":327,"description":328,"totalTime":329,"steps":330},"Migrate a statutory-insurance practice from Microsoft 365 to a §390-SGB-V-compliant sovereign suite","Seven-step plan for practice owners and practice managers in medium practices (6–20 people) and MVZs (21+), starting from an existing Microsoft 365 environment with Exchange, Teams and OneDrive.","P120D",[331,334,337,340,347,350,353],{"name":332,"text":333},"Data classification and §390 SGB V gap analysis","Inventory every data set with patient reference – treatment records, billing data, physician letters, appointment calendars, chats containing patient context. Tag each set under Article 9 GDPR and map it to the relevant Annex 1 to 5 of the KBV guideline. Document every Microsoft 365 service that currently processes such data. This list is the basis for later evidence shown to the regional Association of Statutory Health Insurance Physicians (KV) and in any data protection audit.",{"name":335,"text":336},"Isolate the practice management system and the telematics infrastructure","Keep the practice management system – typically medatixx, CGM, RED or DURIA – strictly separated on the network from any internet service that is not the telematics infrastructure. §390 SGB V Annex 5 requires this network split. The connector may only reach the TI; the office network runs on its own VLAN. This step is independent of the Microsoft replacement and must be remediated immediately if missing.",{"name":338,"text":339},"Migrate mail, calendar and address book to a European groupware server","Set up an Open-Xchange server or a Mailcow instance at a BSI-C5-attested German operator. Migrate all mailboxes with IMAP sync out of Exchange Online. Link calendars via CalDAV and CardDAV to the existing mobile devices. Deactivate Exchange Online no later than 30 days after a successful sync. Actively notify referrers and patients about the new practice email address.",{"name":341,"text":342},"Move document storage to Nextcloud with Collabora Online",{"Deploy a Nextcloud instance with Collabora Online attached":343},{" Configure server-side encryption with external key management – so even a physical server seizure does not expose plaintext":344},{" Migrate SharePoint and OneDrive content in waves of up to 100 gigabytes":345},{" Mandatory activations":346},"two-factor authentication for every account, audit log and automatic 30-day versioning.",{"name":348,"text":349},"Replace Teams with Element on an own Matrix home-server instance","Any use of Microsoft Teams for patient-related communication ends here at the latest. Roll out Element as the client for chat and internal video calls. Patient chats additionally require end-to-end encryption as a hard rule. Disable Microsoft Teams in the Entra console or have it removed by group IT (for MVZ chains).",{"name":351,"text":352},"Catch up on backup, recovery and procedural documentation","Set up a daily, encrypted off-site backup with 30-day retention and a yearly documented recovery test. Produce a procedure document naming the owners, recovery times and escalation paths. In a KV audit or a GDPR check, that document is the central evidence artefact.",{"name":354,"text":355},"Train staff and submit the declaration to the KV","Train all practice staff in a 60-minute session on the new environment, document attendance by name. Have the practice owner sign the §390 SGB V implementation declaration and archive it for ten years. Submit the declaration to the regional KV on request. For MVZs we additionally recommend an annual internal review by an external IT auditor.",{"src":357},"https://images.unsplash.com/photo-1538108149393-fbbd81895907?w=1200&q=80",{},true,"/en/blog/kbv-it-security-guideline-390-sgb-v-medical-practices-microsoft-365-october-2026",{"title":53,"description":308},"en/3.blog/32.kbv-it-security-guideline-390-sgb-v-medical-practices-microsoft-365-october-2026","fMdWzLUnO0GzHsXNyYEnhGv2z_TgO2HdaXkpnc925UY",[365,370],{"title":366,"path":367,"stem":368,"description":369,"children":-1},"openDesk hits the municipal mainstream in 2026 – Neuburg an der Donau, Oberkirch and the Swiss Federal Chancellery decision as the DACH tipping point for Germany's 10,500 municipalities","/en/blog/opendesk-municipal-mainstream-neuburg-oberkirch-swiss-federal-chancellery-2026","en/3.blog/31.opendesk-municipal-mainstream-neuburg-oberkirch-swiss-federal-chancellery-2026","On 23 Sep 2026 Behörden Spiegel documents Neuburg's openDesk switch, Switzerland approves 3,000 seats. What that means for Germany's 10,500 municipalities.",{"title":371,"path":372,"stem":373,"description":374,"children":-1},"Azure as a DMA gatekeeper in November 2026 – how German SMEs and public authorities can use the data-portability obligation to exit Microsoft 365","/en/blog/dma-azure-gatekeeper-november-2026-portability-exit-microsoft-365","en/3.blog/33.dma-azure-gatekeeper-november-2026-portability-exit-microsoft-365","The European Commission will designate Microsoft Azure a DMA gatekeeper in November 2026. What Articles 5–7 mean for data portability and your Microsoft 365 exit.",1791876238501]