New in the NIS2 scope · § 390 SGB V · TI connection
Cybersecurity for medical care centers & practice networks
Medical care centers and practice networks have been directly regulated for the first time since the NIS2UmsuCG — alongside the IT security guideline under § 390 SGB V, TI connectivity, and gematik requirements for e-prescriptions, e-sick notes, and ePA. We combine awareness, phishing simulation, vulnerability management, and a managed SOC for providers operating across multiple locations.
TYPICAL ATTACK SCENARIOS
Why MVZs are particularly vulnerable.
Distributed locations with different starting points, shared infrastructure, and high integration via practice management systems (PVS) and TI — a successful attack spreads quickly across all locations. The typical patterns are documented and can be addressed.
OUR SOLUTIONS
A consistent level of security across all locations.
Four coordinated services — centrally managed, rolled out for each location. Proof of compliance for NIS2, KBV, and gematik is generated automatically as a shared byproduct.
Continuous training
Phishing Simulation as a Service
Campaigns with realistic lures — fake KBV notices, referrals, lab emails, e-prescription notifications. Click and report rates by site, trends over time — the only hard effectiveness metric for awareness efforts.
Employee Resilience
Security Awareness Training
Modular training courses on MFA, e-prescription security, TI connector protection, and handling compromised accounts. Tailored separately for physicians, MFA staff, and administrative personnel. Proof of NIS2 Article 21(g)- and KBV-compliant training at the push of a button.
Know the attack surface
Vulnerability Management
Multi-site asset inventory: which PVS versions, which operating systems, which open ports at each site. A consolidated patch plan instead of 20 individual Excel lists. Direct input into the KBV audit and NIS2 risk management.
24/7 Managed SOC
Incident Detection & Response
Monitoring across all locations with a focus on unusual patterns in PVS access, e-prescription activity, and KIM traffic. Rapid isolation of individual locations before ransomware can spread. Ready-made NIS2 incident reports if things still get serious.
WHY ENTROPY CS
Multi-location security without bloating your IT department.
Managers of medical care centers need a partner who keeps the full spectrum of cybersecurity and outpatient healthcare regulations in view — not three separate service providers, each with its own tunnel vision.
Multi-location as the basic design
Our architecture is designed from the ground up for distributed organizations. Location-specific metrics, a consolidated group-wide view, and a standardized evidence structure — without you having to do any reporting work yourself.
Regulatory compliance from a single source
We address NIS2, Section 390 of the German Social Code V (SGB V), and gematik requirements in a bundled way. We produce the evidence once and deliver it in the formats expected by BSI, KBV audits, and auditors.
Practical implementation
We know that a site can’t just be closed “quickly” for a rollout. All measures are integrated during ongoing operations, with minimal potential disruption to consultations and billing.
The questions we regularly hear from MVZ management, medical directors, and IT managers in practice networks.