Software and IT security under § 17 MPBetreibV
Software can itself be a medical device, for example to analyse image data or control a therapy. For certain software, the German Medical Devices Operator Ordinance (MPBetreibV) has contained its own operator duties since 2025: § 17 has applied since 1 August 2025. In this guide, “operator” means the person or organisation legally responsible under the MPBetreibV, not the individual user of the software.
Which software is affected?
§ 17 applies to software as a medical device of classes IIb and III under Regulation (EU) 2017/745 (MDR) and to software as an in-vitro diagnostic device of classes C and D under Regulation (EU) 2017/746 (IVDR). For other software, the general rules of the ordinance apply, for example on maintenance and instruction.
Before operation: installation and instruction
The operator may only have such software operated and used if, beforehand, the manufacturer, or an authorised person acting in agreement with the manufacturer, has verified that it has been properly installed and has instructed a person appointed by the operator, based on the instructions for use, the accompanying safety-related information and the maintenance information. The instruction covers the proper use and operation of the software and its permissible connection with other devices. Afterwards, the software may only be operated or used by persons who have been instructed accordingly.
The installation check can also be carried out by remote access if the technical conditions allow. The special rule in § 17 paragraph 1 sentence 1 does not apply to digital health applications under § 33a SGB V (German Social Code, Book V) or digital care applications under § 78a SGB XI (Book XI).
IT security reviews
If the software is operated and used in a healthcare facility, the operator must carry out appropriate IT security reviews, or have them carried out, in accordance with the generally recognised rules of technology (allgemein anerkannte Regeln der Technik). They must be suitable for identifying risks and impairments of performance at an early stage and reducing them as far as possible. They must be carried out no later than every two years, at the end of the month in which the software was installed or the last IT security review was carried out. Earlier review may be necessary depending on the conditions of use and environment.
A record documenting the date and results must be prepared for each IT security review. Where a device logbook (Medizinproduktebuch) must be kept for the device under § 13 MPBetreibV, the deadlines, date and result of mandatory IT security reviews must also be documented there.
Who may carry out the review: The operator may only commission persons, companies or bodies that meet the requirements of § 5 MPBetreibV for the device concerned.
Updates and renewed instruction
Maintenance of software includes installing safety-relevant software updates (§ 7 MPBetreibV). If an update changes handling during operation and use by more than a minor degree, renewed instruction is required under § 4 MPBetreibV.
What matters in practice
Software is easy to overlook in daily work because it does not sit on a shelf. In our experience, these points most often lead to gaps:
- The installation date or the date of the last IT security review is not recorded, even though it determines when the next two-year deadline expires.
- IT security reviews exist as loose reports and cannot be matched to the product.
- Updates are installed but neither documented nor checked for a need for new instruction.
- Responsibility between the IT department and medical engineering is unclear.
How Aurel helps
Aurel assigns deadlines, completed measures and related evidence to the respective device and highlights upcoming deadlines in advance. This lets you manage review dates and records for software in a structured way, without maintaining parallel spreadsheets.
Book a call