AVV for Heilpraktiker: which providers need one

As a Heilpraktiker, a state-licensed non-medical practitioner, you need a data processing agreement, in German an AVV, with every provider that handles patient data for you. That covers cloud practice software, your website host, your email provider and your IT support. The duty comes from Art. 28 DSGVO and applies to a solo practice as much as to a hospital.

Most practices find out about the AVV late. The practice software asks you to accept one during setup, the IT technician never mentions it, and the booking tool buries it in the terms. This guide explains what the contract is, which providers need one and which do not. It then shows what the text must contain and what changes because your files hold health data.

What is an AVV and when do you need one?

An AVV, short for Auftragsverarbeitungsvertrag, is the written contract between you and a company that processes personal data for you, on your instructions, for your purposes. The DSGVO calls you the controller and the company the processor. The contract makes the processor follow your instructions and keep the data as safe as you must (Art. 28 (3) DSGVO).

The DSGVO, the EU's data protection regulation, draws the line with two definitions. The controller decides why and how personal data is processed. The processor processes it on behalf of the controller (Art. 4 (7) and (8) DSGVO).

In your practice, you decide which patients you treat, what you write down and how long you keep it. A cloud provider that stores those files decides none of that. It only follows your instructions. That makes it a processor.

Three tests tell you whether a provider is a processor. Does it handle personal data from your practice at all? Does it act for your purposes rather than its own? Does it follow your instructions rather than make its own decisions about the data? Three times yes, and you need an AVV. The European Data Protection Board explains the tests in its guidelines on controller and processor.

The contract has to exist before the provider touches any data. You may only use processors that offer sufficient guarantees for security (Art. 28 (1) DSGVO). The supervisory authority can ask to see the contract at any time. A verbal arrangement or a trusting handshake does not count.

The contract must be in writing, and the regulation says electronic form is fine (Art. 28 (9) DSGVO). The agreement you accept with a click in your software account is therefore a valid AVV, as long as its content is complete.

Which practice providers need an AVV and which do not?

A processor acts on your instructions, so your cloud software, host, email provider, IT support, booking tool and shredding service need an AVV. Your tax adviser (Steuerberater), your lawyer, a laboratory and the postal service make their own decisions about the data. They are separate controllers and need no AVV.

The Bavarian data protection authority publishes a list of typical cases (LDA Bayern, FAQ on distinguishing processing on behalf). It sorts most providers into one of the two groups. The table applies that list to a Heilpraktiker practice.

One case needs a closer look. A billing service that writes and sends invoices in your name is a processor. A billing service that buys your claims and collects them as its own creditor is a separate controller. Then you need a legal basis for handing the data over, which for health data means the patient's explicit consent, best in writing (DSK, short paper 13 on processing on behalf).

The same logic settles the question of software installed on your own computer. A program that runs locally and never sends data to the vendor needs no AVV, because the vendor never processes anything. Once the program backs up to the vendor's cloud or lets the vendor log in for support, the AVV is due.

What about free tools and foreign providers?

A free tool is a processor just like a paid one. The price does not change who gives the instructions. Free email, free calendar sharing, free cloud storage and free video calls all need an AVV once patient names or appointment details pass through them. Many free consumer accounts do not offer one at all. That is a sign to switch to the business version or to a different provider.

A provider outside the EU raises a second question on top of the AVV. Patient data may only leave the EU with an adequacy decision for the destination or with appropriate safeguards such as standard contractual clauses (Art. 44 to 46 DSGVO). For the United States, the Data Privacy Framework applies to companies on the certification list kept by the US Department of Commerce. Check that list before you accept a US provider's AVV, and prefer a provider that stores your data in the EU.

What must an AVV contain under Art. 28 DSGVO?

The regulation prescribes the content. An AVV must state the subject, duration, nature and purpose of the processing, the type of data and the people affected. It must also name your obligations and rights. It then binds the processor to eight duties, from acting only on your instructions to deleting the data at the end (Art. 28 (3) DSGVO).

Two details matter more than they look. First, the security clause usually points to an annex with the technical and organisational measures, called TOM in German. Read that annex. It should name encryption, access controls, backups and the location of the servers.

A security annex that only promises "state of the art" tells you nothing. Second, the sub-processor clause often lists the providers your provider uses, such as a data centre or a support tool. That list shows you where your patient data really ends up.

A processor that ignores your instructions and decides for itself what to do with the data becomes a controller for that processing (Art. 28 (10) DSGVO). The contract is what keeps the roles clear when something goes wrong.

What changes because your files hold health data?

Everything in a patient file is health data, a special category under the DSGVO. Processing it is banned unless an exception applies (Art. 9 DSGVO). Both you and your processor have to protect it more carefully than an address list. For your providers this means stricter security, and for you it means checking that security before you sign.

Health data includes anything about a person's physical or mental health, including the fact that they came to you at all (Art. 4 (15) DSGVO). Your appointment calendar, your notes and your invoices all contain it. A processor that stores it must offer measures that fit this risk, and the regulation names encryption and pseudonymisation first (Art. 32 DSGVO). When you compare two practice software providers, this is the clause to compare.

Why the duty of secrecy works differently for Heilpraktiker

Doctors have a legal shortcut here. The criminal code lists the professions bound to secrecy and allows them to involve service providers under strict conditions (§ 203 StGB). Heilpraktiker are not on that list, because the law only names health professions with state-regulated training. Your duty of confidentiality still exists. It follows from the treatment contract (§ 630a BGB and following), from the rules of your professional association and from the DSGVO itself.

Two things follow for your AVV. First, you cannot lean on the criminal law's rules about which service providers a professional may involve. The AVV and its confidentiality clause are your main protection.

Second, the legal basis for processing health data differs. Doctors usually rely on the exception for treatment by a professional under a legal duty of secrecy (Art. 9 (2) h and (3) DSGVO). Whether that exception covers a Heilpraktiker is debated. Many practices therefore also collect the patient's explicit consent, best in writing (Art. 9 (2) a DSGVO). Ask a lawyer or your association which basis your practice relies on, and name it in your patient information sheet.

The AVV is one of three documents

The AVV sits next to two other documents the DSGVO expects from a practice. Together they show the authority that you know what you process, with whom, and how it is protected. Each of your processors should appear in all three.

The Bavarian authority publishes a filled-in sample record for a medical practice that fits a Heilpraktiker practice with minor changes. It asks the AVV question for each processing and answers it for the IT provider with yes. The patient information sheet in your practice and the privacy policy on your website complete the set, each naming your processors as a category of recipient.

How do you get and check an AVV in practice?

In most cases you do not write the AVV yourself. The provider offers its own, and you read and accept it. Established practice software, hosts, email providers and booking tools have one ready in the account settings or on request. Your job is to check it against the Art. 28 list, store a copy and note the date.

A simple routine covers it:

1. List every provider that handles data from your practice. Go through the table above, then through your bank statements for subscriptions you forgot.
2. For each one, decide whether it is a processor or a separate controller. If you are unsure, write down why you decided as you did.
3. Ask each processor for its AVV. Look in the account settings first, then write to support. A provider that cannot produce one within a few days is a provider to replace.
4. Check the text against the table of clauses above. Read the security annex and the sub-processor list, and check where the servers are.
5. Sign or accept it, download a copy and store it with your VVT. Set a reminder to check for updates once a year, because providers change their sub-processors.

Sometimes a provider has no text of its own, for example a local IT technician. Then you can start from a model contract. The Berufsverband der Datenschutzbeauftragten Deutschlands publishes a model agreement, and the IHK Frankfurt links to several more. Fill in the description of the processing yourself and attach the technician's security measures as the annex.

What happens if you have no AVV?

A missing AVV is a breach of Art. 28 on its own, even if nothing ever happens to the data. It falls in the lower fine bracket, up to 10 million euros or two percent of annual turnover (Art. 83 (4) a DSGVO). A patient whose data was mishandled can also claim compensation (Art. 82 DSGVO).

In practice, a solo practice is far more likely to get a letter from the supervisory authority than a fine of that size. The more realistic cost is time. When a patient asks what you hold about them, or a provider has a data breach, the first question is which contracts exist.

Without an AVV, you cannot show the processor was bound to your instructions. You cannot demand its help, and you cannot prove you chose it carefully. With one, those questions have answers on file. For a practice that holds health data, that paper trail is the difference between an uncomfortable afternoon and a formal procedure.

Fines for health data have been issued across the EU, including against small practices. Most were for weak security and unanswered patient requests rather than for the missing contract alone. The AVV does not prevent a provider's breach. It does define who has to do what when one happens, and it is the first document the authority will ask for.

This article is general information, not legal advice. Talk to a lawyer or your professional association for your own case.

About this blog

This blog is written by the team at Vitalmyn, who build an ordering service for practitioner recommendations. They read German health and data protection law closely because their own work depends on it. Articles here are general guides for practising Heilpraktiker.