Discuss your project

TOOLBOX · COMPLIANCE & NIS2

Maturity Check Medical Practices.

Health data need special protection. 12 questions for medical practices and doctors’ offices based on GTelG 2012, the Austrian Physicians Act and BSI IT-Grundschutz, with an immediate maturity level, measures and sources.

12 Questions for Medical Practices

0 of 12 answered

Stays in your browser: your answers are neither sent nor stored. They are gone when you close the page; print the report or save it as a PDF.

Answer Yes, Partially or No for each measure. Below each question it says what “Yes” means. If you do not know, choose No: a measure that nobody can confirm does not count as implemented.

  1. Question 1: Does every person sign in to the practice software and the PC with their own account, and does each role, such as reception or assistants, see only the data it needs for its task?

    Accounts and AccessImportant measure

    Yes means: no shared accounts at reception, permissions by role, default passwords changed, and accounts are locked immediately when someone leaves.

  2. Question 2: Do the screens at reception and in the treatment rooms lock automatically when nobody is in front of them?

    Accounts and AccessFoundation

    Yes means: the lock activates by itself after a short time and can only be released by signing in; the team also locks the screen when leaving.

  3. Question 3: Is sign-in with a second factor set up for email, cloud services, access from outside and remote maintenance by providers?

    Accounts and AccessKey measure

    Yes means: besides the password, all of this access requires a second factor, such as a confirmation in an app or a security key.

  4. Question 4: Have you documented your data security measures in an IT security concept?

    OrganizationFoundation

    Yes means: it is recorded in writing which measures have been taken under Article 32 GDPR and the GTelG 2012, who may access what, and how health data are transmitted.

  5. Question 5: Do health data leave the practice only in protected form: via secured networks or fully encrypted, and in cloud storage only encrypted?

    Data and BackupImportant measure

    Yes means: no findings as ordinary email, and health data in a service provider’s cloud storage are encrypted according to the state of the art. If you do not use cloud storage for health data, only the transmission counts.

  6. Question 6: Are the practice software and records backed up regularly, is a copy stored separately and protected against overwriting, and do you test recovery?

    Data and BackupKey measure

    Yes means: there is a backup plan, one copy is stored at another location and cannot be overwritten, and recovery is tested regularly, most recently successfully.

  7. Question 7: Are operating systems, practice software and network devices updated promptly according to a defined process, with clear responsibility?

    Systems and NetworkKey measure

    Yes means: it is defined who assesses and installs updates, success is checked, and devices without vendor support are replaced unless they can demonstrably still be operated securely.

  8. Question 8: Are the Wi-Fi for patients, the practice PCs and networked medical devices in separate network zones, and does a firewall control the transitions?

    Systems and NetworkImportant measure

    Yes means: the guest Wi-Fi has its own network segment without access to the practice network, devices with different security levels are separated, and a firewall only lets permitted connections through.

  9. Question 9: Does your software provider connect for remote maintenance only with your consent, and is remote maintenance, including data processing, regulated by contract?

    Service ProvidersKey measure

    Yes means: the remote maintenance software only establishes a connection after your consent, the connection is disconnected afterwards, and there is a contract with the provider on security and data processing.

  10. Question 10: Are old PCs, hard drives, printers and smartphones with patient data verifiably wiped securely or destroyed before disposal?

    Data and BackupFoundation

    Yes means: there is a defined process for wiping or destroying, including storage in printers and multifunction devices, and it is documented.

  11. Question 11: Is the team trained regularly in information security, for example on phishing and on passing on patient data?

    PeopleImportant measure

    Yes means: new employees receive an introduction, and everyone is trained regularly according to their tasks.

  12. Question 12: Is it defined what counts as a security incident, who then decides and who must be informed, including notification of the Data Protection Authority?

    Incidents and EmergenciesImportant measure

    Yes means: a short arrangement known to everyone names those responsible, current contacts, including those of your software provider, and the steps for a data breach.

0 of 12 answered

HOW THE CHECK CALCULATES

Traceable
Instead of Gut Feeling.

12 questions, at most 25 points. The measures are based on the sources named, and individual implementation examples are recommendations by TOMORIS; weights and levels are an assessment by TOMORIS based on the effect of a measure.

  • 01

    Answers Become Points

    Yes counts 1, Partially 0.5 and No 0 points, each multiplied by the weight of the question. If you do not know, choose No.

  • 02

    Weight by Effect

    Key measure (3, here 4×): Directly protects against the most serious consequences of an attack or outage: data loss, standstill or the takeover of accounts and access. Important measure (2, here 5×): Makes an incident less likely or limits its extent and duration. Foundation (1, here 3×): Organizational prerequisite that works through the other measures, such as responsibility, overview or documentation.

  • 03

    Percentage and Level

    Points reached divided by possible points, rounded down to whole percent. Level 1 Getting Started: 0 to 39 percent. Level 2 Foundations: 40 to 69 percent. Level 3 Advanced: 70 to 89 percent. Level 4 Established: from 90 percent.

  • 04

    Key Measures Set a Limit

    If a key measure is answered with No, the maturity level stays at level 2 at most, even if the percentage is higher. The report lists the open measures sorted by weight.

BASIS

What the
Questions Are Based On.

Health data are special categories of personal data (Article 9 GDPR). Physicians and their assistants are bound by professional secrecy (Section 54(1) ÄrzteG 1998); records must be kept for at least ten years (Section 51(3)).

For healthcare providers, the Health Telematics Act 2012 governs data security in the electronic transmission of health data and requires all data security measures to be documented on the basis of an IT security concept (Sections 3 to 8 GTelG 2012).

For the technical measures, the BSI IT-Grundschutz Compendium, Edition 2023, serves as a model. It is a framework of the German Federal Office for Information Security (BSI) and not a legal obligation in Austria. Whether NISG 2026 applies to your practice depends on activity and size; check this with the NIS2 check.

More on the Healthcare & medical practices industry · NIS2 Applicability Check (German) · All Downloads

QUESTIONS

Good to Know.

How is the maturity level calculated?

Each answer gives points: Yes 1, Partially 0.5, No 0, multiplied by the weight of the question (key measure 3, important measure 2, foundation 1). This checklist has 12 questions and at most 25 points. The points reached give a percentage, rounded down, which determines the level: level 1 Getting Started 0 to 39 percent, level 2 Foundations 40 to 69 percent, level 3 Advanced 70 to 89 percent, level 4 Established from 90 percent. If a key measure is answered with No, the maturity level stays at level 2 at most.

Where do the questions come from?

From the Health Telematics Act 2012, the Physicians Act 1998, the GDPR and the BSI IT-Grundschutz Compendium, Edition 2023. The Compendium is a framework of the German Federal Office for Information Security (BSI) and not a legal obligation in Austria; it serves as a model for the technical measures. Every question names its citation.

What does the GTelG 2012 require of a medical practice?

Healthcare providers may only transmit health data electronically if the identity of the patients and of the healthcare providers involved, their roles, and confidentiality and integrity are ensured (Section 3(4)). Confidentiality is ensured by networks secured according to the state of the art that provide at least cryptographic or structural protection, access only for a closed or definable user group and authentication, or by procedures that achieve full encryption (Section 6(1)). In a processor’s cloud storage, health data may only be stored in encrypted form (Section 6(3)). All data security measures must be documented on the basis of an IT security concept (Section 8(1)).

Does NIS2 apply to medical practices?

That depends on activity and size. Healthcare providers are listed in Annex 1 of NISG 2026; as a rule they are covered if they are at least a medium enterprise, that is from 50 employees or with an annual turnover and annual balance sheet total of more than EUR 10 million, with partner and linked enterprises generally counted as well (Sections 24 and 25). In exceptional cases, the cybersecurity authority can also classify smaller entities by decision (Section 26). Whether this applies to your practice can be checked with the NIS2 applicability check.

Is the result proof or legal advice?

No. The check is a self-assessment based on your answers. It does not replace an audit or legal advice and does not prove that legal or professional requirements are met. The weights and levels are an assessment by TOMORIS; the measures are based on the sources named, and individual implementation examples are recommendations by TOMORIS.

Are my answers transmitted or stored?

No. The questionnaire and evaluation run entirely in your browser; your answers are neither transmitted to TOMORIS nor to third parties and are not stored, not even on your device. Only when you choose “Discuss the Result” does the contact form take over industry and maturity level as the topic, not your individual answers.

How do I save the report as a PDF?

In the report, choose “Print or Save as PDF” and select “Save as PDF” or “Microsoft Print to PDF” as the printer in the print dialog. Only the report is printed, in light colors even in dark mode.

TOOLBOX

More
Tools.

YOUR NEXT STEP

You Have the Result.
What Comes Next?

We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.

Discuss the Result