Contact
Phone & 24/7 emergency hotline+49 2932 465265-0 Emailinfo@rootsektor.deMon–Fri 8:00 a.m.–5:00 p.m. CET/CEST · outside business hours: 24/7 emergency hotline
Request a pentest quote Report an emergencyIndustries
Security for patient data and patient care.
In hospitals, medical practices, and laboratories, patient care depends on functioning IT – and patient data is among the most sensitive information there is. Our penetration test makes healthcare cybersecurity measurable and shows where attackers could strike – with due consideration for ongoing operations. For hospitals, medical care centers (MVZ) and practices, care facilities, laboratories, and MedTech manufacturers.
Challenges
Hospital information system (HIS), picture archiving and communication system (PACS), lab software, patient portals, the telematics infrastructure (Germany’s secure healthcare network), and countless connected devices – healthcare IT has evolved over many years and is tightly interconnected. An attacker can use any of these connections to move deeper into your network.
Under Art. 9 GDPR, health data belongs to the special categories of personal data, and many professional groups are also subject to the duty of confidentiality under § 203 StGB (German Criminal Code, professional secrecy). A data breach carries serious legal consequences – and costs the trust of your patients.
Ransomware attacks have already forced hospitals in Germany, too, to stop admitting emergency patients. When the HIS, lab, or imaging systems fail, more than just data is at risk.
Medical devices running outdated operating systems, remote maintenance by manufacturers, and complex permission models for physicians, nursing staff, and administration create gaps – for example, when a role can see more data than it should.
Tell us about your systems, your medical technology, and your compliance obligations. We plan the test so that patient care always comes first.
Benefits
We proceed the way an attacker would – with the caution that running a healthcare facility demands. In the end, you know where you are really vulnerable and which measures will make your organization more secure the fastest.
We test networks, applications, remote access, and Active Directory for the paths through which ransomware typically gets in.
Can administrative staff read medical findings, does a referral portal expose medical letters meant for someone else, or can one site access another site’s data? We test roles and interfaces for exactly these kinds of gaps.
Every remediated vulnerability is one less attack path. This reduces the risk that your HIS, lab, or imaging systems fail and processes have to switch to paper.
The report and test certificate document your measures for auditors, supervisory authorities, hospital clients, and insurers.
Services
We combine the tests that fit your facility – from the hospital network to the health app.
External attack surface, internal networks, and the separation of administration, medical technology, building technology, and guest Wi-Fi.
Misconfigurations and attack paths in the directory service – often the decisive lever in ransomware attacks.
Patient and referral portals, online appointment booking, and web-based clinical applications, including their interfaces.
Health apps and digital health applications (DiGA) according to OWASP MASVS – with a view to the requirements of the technical guideline TR-03161 issued by the BSI (Germany’s Federal Office for Information Security).
Connected medical devices, building management systems, and IoT components – carefully and in coordination with your medical technology team and manufacturers.
Freely accessible wards, unattended workstations, phishing, and calls to the service desk – we test how well your processes protect you.
Compliance
Penetration tests provide technical evidence for legal and industry-specific requirements. They replace neither an ISMS nor the actual compliance audit or certification.
Data protection & professional secrecy
Health data enjoys special protection under Art. 9 GDPR. Art. 32 requires state-of-the-art measures and a process for regularly testing their effectiveness. In addition, professionals bound by secrecy must oblige the service providers who assist them to maintain confidentiality.
Hospitals & practices
Hospitals with 30,000 or more inpatient cases per year count as critical infrastructure under German law (KRITIS) and must regularly demonstrate their IT security to the BSI. Regardless of this, Section 391 of the German Social Code, Book V (SGB V) requires all hospitals to take precautions in line with the state of the art, which the industry-specific security standard (B3S) defines in more detail. NIS2 also covers healthcare providers of medium size and above.
MedTech & software
The Medical Device Regulation (MDR) requires software to be developed according to the state of the art, including information security; MDCG 2019-16 and IEC 81001-5-1 specify this further. For DiGA, BSI TR-03161 is the authoritative guideline.
Patient care takes priority in every phase. Our methodology is the same across all industries – we adapt time windows and testing techniques to hospital and practice operations.
We clarify goals and constraints. We put confidentiality and professional secrecy in writing before the project starts.
Together, we define systems, exclusions, test windows, and contact persons – systems used directly in patient care are flagged separately.
Within 24 hours of scoping (on business days), you receive a fixed-price quote with no hidden costs.
We test within agreed time windows and handle patient data as sparingly as possible. We report critical vulnerabilities immediately – during the test, by phone or email to the agreed contact person.
An executive summary for management, technical details with CVSS ratings, and concrete measures for IT and medical technology. If you wish, we discuss the results together.
We retest remediated vulnerabilities free of charge. You can present the test certificate to auditors, partners, and insurers.
FAQ
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
We plan every test so that patient care comes first. We exclude patient-facing systems and medical devices in active use from active testing or test them only in coordination with your medical technology team and the manufacturer, for example on spare devices. We agree on test windows, escalation paths, and abort criteria together in advance.
As sparingly as possible. We demonstrate access with as few records as possible and redact personal data in our evidence. We agree on confidentiality and professional secrecy in writing before the project starts – if you wish, including a confidentiality undertaking for professionals bound by secrecy under § 203 StGB.
Yes, with particular care. We preferably test devices, interfaces, and network connections on test or spare devices and analyze whether your medical technology is sufficiently separated from administrative and guest networks. The greater risk often lies not in the device itself but in outdated operating systems, default passwords, and open remote maintenance access.
Yes, as a technical building block. A penetration test shows whether your measures are effective against real attacks and documents scope, methodology, and findings in a way auditors can follow. However, it does not replace your ISMS or the actual compliance audit.
Yes. Smaller facilities are also targeted by ransomware and phishing, often via unsecured remote access or outdated systems. For practices of physicians contracted with statutory health insurance, the KBV’s IT security guideline sets out minimum requirements. A compact external and internal test shows exactly where you should make improvements.
We test the app, backend, and interfaces – according to OWASP MASVS and MASTG for mobile applications and OWASP ASVS for web and APIs. In doing so, we take the requirements of BSI TR-03161 into account. Our report supports your technical documentation but does not replace a certification.
Yes. In the event of a cyberattack, our Incident Response & Forensics team helps remotely and on-site to contain the incident, secure evidence, and restore systems in an orderly manner. For reporting obligations, we provide the technical facts – for example, for notifying the data protection supervisory authority under Art. 33 GDPR and, if your facility falls under NIS2 or operates a critical facility, for reporting to the joint reporting office of the BSI and the BBK (Federal Office of Civil Protection and Disaster Assistance). Outside business hours, you can reach us via our 24/7 emergency hotline at +49 2932 465265-0.
Whether you run a hospital group, a practice, a lab, or a MedTech company: tell us about your situation. For your penetration test, you receive a fixed-price quote within 24 hours of scoping (on business days).
Diese Seite gibt es auch auf Deutsch.