§ 203 StGB and AI documentation: when a provider is a “contributing person”
A provider becomes an “other contributing person” within the meaning of § 203 paragraph 3 StGB (German Criminal Code) as soon as it can learn patient secrets while working for the practice. Passing information to it is then not an unauthorised disclosure, in so far as it is necessary for that work — and the practice must ensure the provider is placed under an obligation of secrecy.
Reviewed editorially against product behaviour and the stated primary sources; not individual medical or legal advice.
This overview is general information, not legal advice. Which content, deadlines and forms apply to a specific practice should be clarified with the practice's own legal or data protection advisers.
What § 203 StGB protects
§ 203 paragraph 1 StGB makes it a criminal offence to disclose without authorisation a secret entrusted to someone in a professional capacity. Number 1 of the list names physicians expressly. What is said in the consultation falls under it, whether or not it later reaches the record.
What matters for choosing software is the level: this is criminal law. A processing agreement under Art. 28 GDPR answers the data protection question and leaves the criminal one open. The two assessments run side by side, and both have to be passed.
Assistants, contributing persons, and the difference
§ 203 paragraph 3 StGB distinguishes two groups. Professional assistants and persons working in the practice in preparation for the profession — the medical assistant, the trainee — are placed on the same footing as the person bound to secrecy; nothing is disclosed to them.
Since November 2017 a second group stands beside them: other contributing persons. These are third parties who contribute to the practice of the profession without being employed by the practice — IT maintenance, data centre operation, the provider of a documentation application. Passing information to them is not an unauthorised disclosure in so far as this is necessary in order to make use of their work.
“Necessary” is the boundary here, not a formality. It asks which details the provider needs in order to deliver exactly the service it was engaged for — not which details would be convenient to send along.
The duty that stays with the practice
§ 203 paragraph 4 StGB turns the responsibility around. It is not only the contributing person who discloses a secret who commits an offence, but also the person bound to secrecy who failed to ensure that the contributing person was placed under an obligation of secrecy. The same duty continues when the provider in turn brings in further persons.
For the practice that means the obligation of secrecy is not an accessory to the contract, it is the act whose omission criminal law addresses. It belongs in writing, with a date and a named person, in the same way the practice binds its own staff.
- Everyone at the provider who could learn something is named and bound to secrecy.
- The undertaking is in writing and can be found inside the practice.
- The provider in turn binds the people it brings in.
- The information passed on is limited to what the service requires.
- When the chain of parties changes, the undertakings follow.
Whether a provider contributes is decided by the data path
A provider that can never learn a patient secret does not contribute to the practice of the profession in this sense. So the first question is not what the product is called but which content it carries where — and for documentation tools the answer is almost never the same for all three paths of audio, transcript and draft.
With KiPT Voice the audio file stays on the practice computer. Transcript text goes to the provider configured in the settings, unless a local model is set up there; in that case the text does not leave the practice either. Knowing the data path is knowing who has to be bound.
Five questions before a pilot
The questions are deliberately framed so that an answer has to be in the provider's documentation and cannot be produced in a sales conversation.
- Which of the three contents — audio, transcript, draft — leave the practice computer, and to whom?
- Who at the provider and at its own service providers can access them?
- Is there an obligation of secrecy for those people, and in what form?
- Does the provider bind its own sub-processors, and is the practice told about changes?
- Can the amount of transmitted content be limited, for example by a local model?
What § 203 StGB does not govern
The provision says nothing about where processing happens, nothing about encryption and nothing about retention periods. Those points come from the GDPR and from professional law; they belong to the same decision but not to the same norm.
Conversely, no contract cures a disclosure that was not necessary for the work engaged. Whoever wants to assess both together assesses the data path first and the paperwork second.
Frequently asked questions
Is a processing agreement under Art. 28 GDPR enough?
No, it answers only the data protection side. § 203 StGB additionally requires the practice to ensure that contributing persons are placed under an obligation of secrecy. Many providers cover both in one document; what matters is that both are in it.
Is a medical assistant a contributing person?
No, she is a professional assistant under § 203 paragraph 3 StGB, and nothing is disclosed to her. The rules on other contributing persons concern third parties outside the practice.
What does “necessary” mean in practice?
What may be passed on is what the engaged service needs. For a documentation application that is the text of the conversation, if the draft is to be produced from it — not necessarily the audio file, and not the rest of the patient record.
Does it matter where the provider is based?
For § 203 StGB what counts is who can learn the secret, not the location. Location is a data protection question under the GDPR and is answered separately; both questions belong in the same assessment before a pilot.
Does a local model change the assessment?
Yes, because the data path changes. If the draft is produced by a model on a computer in the practice, no external provider learns the text of the conversation — and then there is nobody to bind for that step.