HinSchG for Hospitals + Care: Section 203 StGB Conflicts

Main article: HinSchG: Setting up an internal reporting office — setting up the internal reporting office in eight steps, with procedural deadlines, GDPR obligations and a 30-point checklist.

1. § 203 StGB vs. whistleblower protection

The relationship with medical confidentiality is governed by § 5(2) no. 4 HinSchG — not by § 8 HinSchG: a report or disclosure does not fall within the scope of the HinSchG in so far as it is precluded by the duty of confidentiality of doctors, dentists, pharmacists or members of another healthcare profession which requires state-regulated training for practising the profession or for using the professional title. The only exception concerns veterinarians, in so far as breaches of legal provisions on the protection of commercially kept farm animals are concerned (§ 2(1) no. 3(k) HinSchG). The practical consequence for hospitals and care institutions: treatment errors can be reported internally as long as the report manages without the patient secrets covered by the duty of confidentiality — that is, without patient names and without identifying treatment data.

In addition, § 6(3) HinSchG applies: persons who, in the course of their work for a reporting office, obtain information subject to a provision on confidentiality or secrecy must apply those provisions themselves from the moment the information is received, and must respect the legitimate interests of the persons concerned in the same way as the whistleblower. § 8 HinSchG, by contrast, does not govern the relationship with § 203 StGB — it contains only the confidentiality requirement regarding the identity of the whistleblower, of the persons who are the subject of the report and of the other persons named in the report.

Austria: the Austrian Whistleblower Protection Act (HSchG, Federal Law Gazette I No. 6/2023) draws the line in parallel: it applies to undertakings and legal persons in the public sector with 50 or more employees (§ 3(1); internal whistleblowing system under § 11(1)) and expressly does not apply to the duties of confidentiality of the statutorily regulated healthcare professions (§ 3(6) no. 1 HSchG).

What applies on the other side of the line: in so far as a report falls within the material scope, the protective rights also apply in hospital and care operations. In Germany, the act covers criminal offences and certain breaches subject to administrative fines that serve the protection of health (§ 2(1) nos. 1–3 HinSchG), as well as breaches of numerous listed federal, Länder and EU legal provisions; the full wording of the administrative-fine alternative is set out in section 2. For such reports, the whistleblower cannot be held legally responsible under § 35 HinSchG for obtaining the reported information, provided that obtaining it does not as such constitute a separate criminal offence; nor does the whistleblower breach any disclosure restrictions, provided that there were sufficient grounds to believe that passing on the information was necessary to uncover a breach. In Austria, the material scope is narrower — it covers the EU areas including public health, product safety and data protection, plus the corruption offences under §§ 302 to 309 StGB (§ 3(3) HSchG); the exemption from liability is set out in § 22(1) and (2) HSchG.

Step to take before the individual-case question: answer the question once for each professional group and document the outcome: medical staff, nursing professionals, therapeutic professions, administration. The benchmark is the scope exclusion in § 5(2) no. 4 HinSchG set out in the opening paragraph of this section; in addition, the duty of confidentiality must stand in the way of the specific report. The outcome determines for which groups the scope exclusion can be considered at all; the legal classification itself belongs in the lawyer's assessment.

The specific report is on the table — may it be processed? The table summarises the three constellations that must be kept apart in hospital and care operations.

Open boundary — please clarify with a lawyer: which groups of employees in hospitals and care institutions fall under § 203 StGB in the individual case, and how far the criminal-law protection of secrets extends in detail, is not covered by this article. The classification of a specific report — patient-related information or internal breach without patient reference — belongs in the lawyer's assessment before the first investigative step.

2. Reporting channels for treatment errors

Treatment errors run along two separate tracks which do not replace one another: the clinical incident reporting system CIRS (Critical Incident Reporting System) and — for breaches within the meaning of § 2 HinSchG — the internal reporting office. The legal basis for CIRS in hospitals is § 136a(3) SGB V in conjunction with § 135a(2) SGB V: the Federal Joint Committee (G-BA) sets minimum standards for risk management and incident reporting systems as well as requirements for cross-institutional incident reporting systems (G-BA quality management directive).

Where the HinSchG track begins: in Germany, § 2(1) no. 2 HinSchG covers breaches subject to administrative fines in so far as the provision infringed serves to protect life, limb or health, or to protect the rights of employees or their representative bodies; for patient safety, the first alternative is relevant. If a report falls within this area, the procedural deadlines from section 6 run irrespective of what happens in the CIRS process.

Classification in the individual case:

• Incident without a breach within the meaning of § 2 HinSchG — purely learning from the error: CIRS track (§ 136a(3) SGB V in conjunction with § 135a(2) SGB V).
• Incident involving a criminal offence, or a breach subject to an administrative fine of a provision protecting life, limb or health or protecting the rights of employees or their representative bodies — for example concealing or suppressing a report: additionally the HinSchG track (§ 2(1) nos. 1 and 2 HinSchG).
• Report that cannot manage without patient-identifying details: no HinSchG track, in so far as the duty of confidentiality stands in the way — see the decision table in section 1.

Practical recommendation for the demarcation: keep the report file and the case file separate and document the classification under section 1 before investigative steps begin. This makes it possible to observe the access limit of § 8(1) HinSchG, under which the identity may only become known to the persons responsible for receiving reports and taking follow-up measures and to those supporting them.

3. Reporting channels alongside the reporting office: who reports where?

A report to the BfArM does not replace the internal reporting office under § 12 HinSchG: information on breaches of pharmaceutical law goes separately to the Federal Institute for Drugs and Medical Devices (BfArM), and the obligation under § 12 HinSchG remains unaffected; which reporting and notification duties under pharmaceutical law exist vis-à-vis the BfArM in detail, and with which deadlines, is not covered by this article. As state external reporting offices, the HinSchG designates, among others, the federal external reporting office at the Federal Office of Justice (BfJ) (§ 19(1) and (4) HinSchG) as well as special external reporting offices at BaFin (§ 21 HinSchG) and at the Federal Cartel Office (Bundeskartellamt) (§ 22 HinSchG).

Who reports where — the reporting channels evidenced in this article:

HinSchG protection applies in parallel: if the same facts fall within the material scope of § 2 HinSchG, the prohibition of reprisals (§ 36(1) HinSchG) and the exemption from liability (§ 35 HinSchG) apply irrespective of the fact that the BfArM was additionally informed. The whistleblower alone decides on the reporting channel: they choose between the internal and the external reporting office and should give preference to the internal report where internal remedy can be effective and no reprisals are to be feared (§ 7(1) HinSchG). Obstructing reports or the subsequent communication, or attempting to do so, is prohibited (§ 7(2) HinSchG).

Austria: the protection covers reports to internal as well as external bodies (§ 6(1) HSchG). Which external body is competent and within which period it makes known the outcome and the follow-up measures is set out in section 6.

4. Care institutions: headcount, threshold, sanction

Where many part-time and marginally employed staff work, the threshold of 50 employees is reached earlier than a calculation in full-time equivalents would suggest — counting is by headcount. Home supervision (care institutions — care quality and patient safety) applies in addition to whistleblower law, without replacing the obligation under § 12 HinSchG (overview of the parallel contact points: section 5).

How counting works: § 12(1) sentence 1 in conjunction with (2) HinSchG obliges employers with, as a rule, at least 50 employees to set up and operate at least one internal reporting office. Heads are counted, not full-time equivalents: full-time, part-time and fixed-term employees, apprentices, marginally employed staff, interns and temporary agency workers from six months onwards count in full; self-employed subcontractors as a rule do not count. The transitional period under § 42 HinSchG for employers with 50 to 249 employees expired on 17 December 2023; § 40(2) no. 2 HinSchG has been applicable since 1 December 2023. In Austria, the obligation applies from 50 employees onwards (§ 3(1) in conjunction with § 11(1) HSchG).

Worked example from day-to-day care: 30 full-time employees, 25 part-time employees, 8 marginally employed staff and 4 temporary agency workers assigned for six months or more add up to 67 heads. The obligation therefore applies — what counts is the 67 heads, not the full-time positions calculated from them.

Sanction and competence: anyone in Germany who fails to set up and operate an internal reporting office commits an administrative offence — a fine of up to EUR 20,000 (§ 40(2) no. 2 in conjunction with (6) HinSchG). The tenfold increase for legal persons under § 30(2) sentence 3 OWiG is expressly ordered by § 40(6) sentence 2 HinSchG only for § 40(2) nos. 1 and 3 and (3) and (4), not for the missing reporting office. For the offences carrying EUR 50,000 (§ 40(2) nos. 1 and 3, (3) HinSchG), by contrast, it does apply and leads, for legal persons — including hospital, care and holding companies — to a maximum amount of EUR 500,000. Since 15 April 2025, the Federal Office of Justice has been responsible for prosecuting and sanctioning administrative offences under § 40 HinSchG, in so far as the implementation of the act falls to the Federal Ministry of Justice or an authority within its remit (§ 1 HinSchGOWiZustV). In Austria, the district administrative authority sanctions obstruction, retaliatory measures, breaches of confidentiality and knowingly false reports with up to EUR 20,000, and up to EUR 40,000 for repeat offences (§ 24 HSchG).

5. Outsourcing the reporting office: law firm or ombudsperson as the internal reporting office

Outsourcing to a law firm or an ombudsperson is permitted under § 14(1) sentence 1 HinSchG and is an obvious choice in hospital operations, because the reporting office receives information that is subject to a provision on confidentiality or secrecy and which it must itself protect from receipt onwards (§ 6(3) HinSchG). Because of this § 203 StGB sensitivity, an external law firm as the reporting office is recommended in hospital and care operations — in legal terms this is the outsourced internal reporting office under § 14(1) sentence 1 HinSchG, not an external reporting office within the meaning of the act.

Keeping the terminology clean: 'external reporting offices' within the meaning of the HinSchG are the state bodies, among others under §§ 19, 21, 22 HinSchG (see section 3). A mandated law firm or ombudsperson, by contrast, remains the internal reporting office in outsourced form.

What outsourcing does not take away: under § 14(1) sentence 2 HinSchG, the employer itself remains obliged to take appropriate measures to remedy a breach. If the third party processes personal data on the employer's behalf in doing so, a data processing agreement with the minimum content of Art. 28(3) GDPR is required. The factors that determine the cost of outsourcing are dealt with in the main article on the internal reporting office.

Hospital and holding groups: there is no infringement procedure by the European Commission against Germany concerning group-level outsourcing under § 14 HinSchG; the whistleblower protection procedure INFR(2022)0052 for late transposition of Directive (EU) 2019/1937 ended with the CJEU judgment C-149/23 of 6 March 2025 (lump sum of EUR 34 million) and was closed on 4 June 2026. The benchmark remains Art. 8 of the directive, which ties the obligation to establish internal reporting channels to every legal entity with 50 or more employees; § 14 HinSchG applies unchanged as at 17 August 2026. Practical recommendation for groups with several holding companies: a hybrid model combining an own reporting office per company with a joint office as a third party, instead of pure group-wide outsourcing.

Parallel contact points — none exempts from § 12 HinSchG: proceedings before the home supervision authority, the medical association and the BfArM run independently; they do not supersede the obligation under § 12 HinSchG. The competence and procedures of these bodies are not covered by this article; clarify both with a lawyer in the individual case.

6. Procedure in hospital operations: deadlines, channels, expertise

Once a report is received, two statutory deadlines run in Germany: seven days for the acknowledgement of receipt (§ 17(1) no. 1 HinSchG) and three months from the acknowledgement of receipt for the feedback on planned and already taken follow-up measures and the reasons for them; if receipt was not acknowledged, the period is three months and seven days from receipt (§ 17(2) HinSchG). In Austria, it is seven calendar days (§ 9(1) HSchG) and three months from acceptance of the report (§ 13(9) HSchG). If the whistleblower turns to the state external reporting office, separate deadlines apply there: acknowledgement of receipt no later than seven days after receipt, feedback no later than three months, and six months where processing is extensive, with notification of the reasons for the extension (§ 28(1) and (4) HinSchG). In Austria, the external body is the Federal Bureau of Anti-Corruption, in so far as none of the special bodies is competent (§ 15(1) HSchG); it makes known, no later than three months, and in sufficiently justified cases no later than six months after the report is received, the conclusions it has reached and the follow-up measures it has taken (§ 17(6) HSchG).

Reporting channels: § 16(3) sentence 1 HinSchG requires internal reporting channels to allow reports to be made orally or in text form — in this respect the employer has a choice. If the oral channel is chosen, it must be available by telephone or by another means of voice transmission (sentence 2). The only mandatory addition is a personal meeting at the whistleblower's request within a reasonable time (sentence 3). The internal reporting office should also process reports received anonymously (§ 16(1) sentence 4 HinSchG); under sentence 5 there is expressly no obligation to design the reporting channels in such a way that they allow anonymous reports to be submitted. Practical recommendation for shift operations: a channel that is accessible without a work login and outside regular working hours.

Expertise, information, documentation: § 15(2) HinSchG requires the persons entrusted with the tasks of the internal reporting office to have the necessary expertise; the provision does not prescribe legal training (usual scope of training in practice: five to eight teaching units). The workforce must be informed about the reporting channels under § 13 HinSchG — in hospital and care operations typically via the intranet and notice boards, accessible for all shifts. The documentation must be deleted three years after the conclusion of the procedure (§ 11(5) HinSchG); longer retention is permitted only in so far as it is legally required. In Austria, the retention period is five years (§ 8(11) HSchG). For the processing activity 'reporting office', a data protection impact assessment under Art. 35 GDPR must be carried out in Germany; in Austria it is dispensable under § 8(13) HSchG in conjunction with Art. 35(10) GDPR.

7. Protection against reprisals for reporting employees

Anyone who reports must not be disadvantaged for doing so: § 36(1) HinSchG prohibits reprisals against whistleblowers, including threats and attempts. If a whistleblower suffers a disadvantage in connection with their professional activity and claims to have suffered it as a result of the report, it is presumed that this constitutes a reprisal; the person causing the disadvantage must then prove that the disadvantage was based on sufficiently justified grounds or was not based on the report (§ 36(2) HinSchG). Anyone in breach owes compensation for the resulting damage; the breach does not give rise to a claim to the establishment of an employment or training relationship or to professional advancement (§ 37 HinSchG). Agreements that restrict the rights existing under the act are invalid (§ 39 HinSchG).

For day-to-day shift planning: the Lower Saxony Regional Labour Court confirmed this two-stage scheme by judgment of 11 November 2024 (7 SLa 306/24). Practical recommendation: for every personnel measure taken after a report — warning, transfer, redistribution of shifts, dismissal — document the reason unconnected with the report before the measure is implemented.

Austria: measures taken in retaliation for a justified report are legally ineffective (§ 20(1) HSchG). The whistleblower only has to show prima facie evidence of the retaliation; retaliation is not to be assumed if there is a higher probability of another motive, which the acting person must in turn show prima facie (§ 23 HSchG) — a weaker standard than the German reversal of the burden of proof. The responsible person owes restoration of the lawful situation, compensation for the financial loss and compensation for the personal impairment suffered (§ 20(1) last sentence and (2) HSchG).

8. NIS2 in hospitals: classification without a bed threshold

In Germany, NIS2 classification is determined by the type of entity in conjunction with a size threshold, not by the number of beds. Under § 28(1) and (2) BSIG 2025, an entity of a type specified in Annex 1 — which lists the health sector — qualifies as a particularly important entity if it has at least 250 employees or an annual turnover of more than EUR 50 million together with an annual balance sheet total of more than EUR 43 million. An entity of a type specified in Annex 1 or 2 qualifies as an important entity if it has at least 50 employees or an annual turnover and an annual balance sheet total of more than EUR 10 million each. Irrespective of this, operators of critical installations are particularly important entities (§ 28(1) BSIG) — for them, therefore, neither the number of employees nor turnover or balance sheet total matters. Whether a critical installation exists is governed by § 2 no. 22 BSIG in conjunction with the German KRITIS Umbrella Act (KRITIS-Dachgesetz) and the KRITIS statutory ordinance; for inpatient medical care, the threshold value there is tied to the number of full inpatient cases, not to the number of beds. The specific figure is not covered by this article — it must be looked up in the version of the KRITIS statutory ordinance applicable at the time.

What follows from this: the classification triggers the risk management measures under § 30(1) and (2) BSIG with documented compliance, the reporting obligations for significant security incidents (§ 32(1) BSIG), the registration route (§ 33 BSIG), the duties and liability of the management (§ 38 BSIG) and the proof obligation of operators of critical installations (§ 39 BSIG). These obligations are dealt with in the article on the healthcare sector linked below.

Austria: the Austrian Network and Information Systems Security Act 2026 (NISG 2026) (Federal Law Gazette I No. 94/2025) sets the thresholds in § 25(2) and (3) in parallel — a large undertaking from 250 employees or more than EUR 50 million turnover and more than EUR 43 million balance sheet total, a medium-sized undertaking from 50 employees or more than EUR 10 million turnover and more than EUR 10 million balance sheet total; there, too, the prerequisite is allocation to a type under Annex 1 or Annex 2 (§ 24). There, too, registration, reporting obligations and the self-declaration follow from the classification. Classification, registration route and reporting chains for hospitals in detail: NIS2 healthcare sector.

9. Germany and Austria in direct comparison

The core obligations largely run in parallel. What differs is the material scope, the state external body, the retention period, the evidence rule and the sanction framework — the table sets out both legal systems with sources.

10. Implementation in your institution: sequence and responsibilities

Setting things up starts with the headcount and ends with the deletion routine. The following sequence is a practical recommendation for implementation under German law (HinSchG); the Austrian equivalents are set out in section 9. The roles named are suggestions for the distribution of work within the institution; the statutory obligations fall on the employer.

• Document the headcount (HR department) — threshold under § 12 HinSchG, counting method under section 4.
• Clarify the group structure and decide on outsourcing (management) — for each legal entity; transfer to a third party under § 14(1) sentence 1 HinSchG, with the obligation to remedy remaining with the employer under sentence 2.
• Define the reporting channels (reporting office officer) — § 16(3) HinSchG; plan for a personal meeting on request.
• Demonstrate expertise (reporting office officer) — § 15(2) HinSchG.
• Data protection impact assessment (Art. 35 GDPR) and entry in the record of processing activities (data protection officer) — before the channel goes live; in Austria the DPIA is dispensable under § 8(13) HSchG in conjunction with Art. 35(10) GDPR.
• Conclude a data processing agreement (data protection officer) — before the channel goes live, where outsourcing or an IT service provider is involved, with the minimum content under Art. 28(3) GDPR.
• Inform the workforce (management together with quality management) — § 13 HinSchG, at go-live, accessible for all shifts; where a works council exists, the corresponding agreement belongs in the same round.
• Set up deadline monitoring (reporting office officer) — 7 days for the acknowledgement of receipt, 3 months for the feedback from the acknowledgement; without an acknowledgement, 3 months and 7 days from receipt (§ 17(1) no. 1, (2) HinSchG); Austria 7 calendar days / 3 months (§ 9(1), § 13(9) HSchG).
• Keep the report file separate from the case file (reporting office officer) — access limit under § 8(1) HinSchG.
• Set up a deletion routine (reporting office officer) — § 11(5) HinSchG, longer retention only in so far as legally required.