Hygiene in hospitals: obligations, KRINKO recommendations and governance

Hygiene in hospitals has been a strictly regulated area since the 2011 amendment to the Infection Protection Act (IfSG) and the 2017 amendment. Section 23 IfSG obliges heads of hospitals, prevention and rehabilitation facilities to ensure the necessary hygiene measures and to take into account the recommendations of the Commission for Hospital Hygiene and Infection Prevention (KRINKO) at the Robert Koch Institute and the Commission for Anti-Infectives, Resistance and Therapy (ART). The 16 federal states specify the obligations through their own hygiene regulations, which regulate staffing, hygiene plans and surveillance and can differ from one another in detail.

This article explains which obligations hospital operators have today, which roles the staff covers (hygiene officer doctor, hygiene specialist, hospital hygienist), how a hygiene plan according to KRINKO is structured and how you can document surveillance, training, inspections and audits in such a way that every inspection by the supervisory authority or a certifying body remains traceable in accordance with DIN EN ISO 9001 or KTQ. You will receive concrete information on staffing, the obligation to carry out nosocomial surveillance in accordance with Section 23 Paragraph 4 IfSG, the processing of medical devices in accordance with MPBetreibV and the integration with internal quality management. CIVAC is a German compliance platform and officer-as-a-service with workspace, 490 ready-to-use audit templates, ISO/IEC 27001:2022 ISMS and EU data residency according to standard, tailored to everyday hospital life and the burden of proof logic according to § 630h BGB.

The legal foundations of hospital hygiene form a three-tier system of federal law, state law and professional recommendations. At the federal level, Section 23 IfSG regulates the basic obligations: ensuring the necessary hygienic measures, appointing hygiene staff, nosocomial surveillance, reporting obligations in the event of increased occurrence of multi-resistant pathogens in accordance with Section 23 Paragraph 4 Sentence 2 IfSG and compliance with the KRINKO and ART recommendations. According to Section 73 IfSG, violations can be punished with fines of up to 25,000 euros, and in serious cases with criminal consequences for the medical and commercial management as well as claims for damages from injured patients.

At the state level, the state hygiene regulations specify the obligations. They regulate personnel ratios (approximately one hygienist per 100 to 200 beds), qualification requirements for hospital hygienists and hygiene officers, doctors, minimum content of the hygiene plan and obligations to participate in the hygiene commission, which usually meets at least four times a year. The regulations differ in detail between the 16 federal states, but cover all KRINKO core recommendations. Anyone who operates several locations in different countries must systematically record these differences, otherwise they will be noticeable during inspections.

The KRINKO recommendations at the Robert Koch Institute form the technical basis. They have the status of generally recognised rules of hygiene and are used as a benchmark in liability proceedings. According to Section 630h of the German Civil Code (BGB), anyone who does not implement it bears the burden of proof that a deviation was justified. The Hygiene Officer documents in the workspace which KRINKO recommendation was implemented, when, with which measure and which proof of training. In this way, conformity can be proven in the event of a dispute. The appointment certificate, signed, filed, verifiable. This systematic record keeping protects the clinic management against the accusation that current recommendations were not implemented or were implemented late.

The IfSG and the state hygiene regulations require a graduated role system with clear responsibilities. At the top is the hospital hygienist (specialist in hygiene and environmental medicine or similarly qualified), who has overall professional responsibility, takes part in the hygiene commission and issues opinions on complex issues. In smaller hospitals, this function can be performed on a consultative basis by an external hospital hygienist; in maximum care providers, a full-time hospital hygienist must be available and be provided with a sufficient allocation of positions.

Hygienists (HFK), who are nursing staff with two years of in-service training at a state-recognised academy, work at the operational level. The staff ratio according to the state hygiene regulations is one HFK per 100 to 200 beds, and is narrower in high-risk areas such as intensive care units, oncology or bone marrow transplantation. The HFK accompanies surveillance, outbreak management, training and inspections and is the central contact person for the wards in everyday life, with a reporting line to the hospital hygienist.

In each department, the hospital also appoints a hygiene representative doctor (HBA) and a nursing hygiene representative (HBP). They are not full-time employees, but perform the function in addition to their clinical work, usually with a time quota of 0.1 to 0.2 VK. They translate the hygiene commission's decisions into everyday ward life, train colleagues and remind them of standards. Every order is made in writing, with a task description, hourly quota and reporting line to hospital hygiene. In the CIVAC workspace, appointment certificates, proof of training and task matrices are stored in such a way that all proof of roles can be viewed in 30 minutes. The auditor calls, the evidence is ready. Licence the workspace for your internal representatives or have our representatives appointed, for example for periods of vacancy or to support smaller hospitals without a full-time hospital hygienist.

According to Section 23 Paragraph 5 IfSG, the hygiene plan is the central control document for hospital hygiene. It must be in writing, updated regularly and accessible to staff at any time. The KRINKO recommendation requirements for hygiene plan and hygiene organisation provides the structure. A complete hygiene plan includes ten to fifteen main chapters: basic hygiene, hand hygiene, personal hygiene, surface cleaning and disinfection, processing of medical devices, laundry hygiene, food hygiene, waste disposal, drinking water hygiene, ventilation systems, construction hygiene, outbreak management, employee protection and training. Appendices supplement specific SOPs, flowcharts and contact lists.

Each chapter describes the goal, legal basis, relevant KRINKO recommendation, specific measure, responsibility, documentation and training requirements in a uniform structure. If you make the plan too short, you lose the depth of detail; If you make it too long, you risk that the staff will no longer use it. A sensible solution is linked standard operating procedures (SOPs), which describe individual measures in two to four pages and are referenced in the plan so that the plan remains navigable.

The obligation to update applies to every new KRINKO recommendation, every change to the state hygiene regulations and after every outbreak with a change in measures. A systematic review is carried out at least once a year, documented with minutes of the Hygiene Commission meeting. Versions must be archived because, in the event of liability, what is relevant is which version was valid at the time of the event and which person released it. In the CIVAC workspace, every version is automatically versioned and every change is documented with the date, person responsible and reason. The FAQ library links each measure with the associated KRINKO recommendation so that the technical background can be accessed at any time and training courses can be documented directly from the plan. Audit-proof, documented, Section 23-proof. This structure significantly reduces the effort required for annual review because every change in the source system is automatically incorporated into the plan and does not have to be transferred manually.

Section 23 Paragraph 4 IfSG obliges hospitals to continuously record nosocomial infections and pathogens with special resistance. A list regulates which infections and pathogens are recorded, which the RKI determines after consulting with KRINKO and ART and publishes it in the federal health bulletins. The current list includes, among others, MRSA, VRE, multi-resistant gram-negative pathogens (3MRGN, 4MRGN), Clostridioides difficile as well as nosocomial postoperative wound infections, ventilator-associated pneumonia and CVC-associated sepsis in intensive care patients.

The records must be evaluated, assessed and implemented into hygiene measures taking into account the local conditions. The data must be retained for ten years. In the event of frequent occurrences, an immediate report to the health authority is mandatory in accordance with Section 6 Paragraph 3 IfSG, supplemented by the KRINKO definitions of outbreaks and clusters as well as an assessment of epidemiological plausibility.

In practice, surveillance is now recorded via two standard systems: KISS (Hospital Infection Surveillance System) of the National Reference Centre (NRZ) at the Charité Institute for Hygiene and Environmental medicine and SARI (surveillance of antibiotic use and bacterial resistance). Participation is voluntary, but in fact it is standard in many companies and a prerequisite for many certifications. Hospitals export their data quarterly and receive benchmark comparisons to comparable hospitals. In the CIVAC workspace, the surveillance data is linked to the hygiene plan and training records so that in the event of an outbreak there is a closed chain of evidence: recorded cases, measures taken, trained employees, documented effectiveness. Deadline begins as soon as we become aware of it. The reporting line to management and the health department is stored in the workspace with contact details, escalation levels and templates for reporting, so that no time is lost searching for contact persons. Audit-proof, documented, § 23-firm.

According to KRINKO and WHO, hand hygiene is considered the most important individual measure for preventing nosocomial infections and is specifically checked in almost every inspection. The KRINKO recommendation for hand hygiene in healthcare facilities defines five indications (Five Moments for Hand Hygiene according to WHO): before patient contact, before aseptic work, after contact with potentially infectious material, after patient contact, after contact with the patient's environment. Each indication must be operationally documented in the hygiene plan.

Alcoholic hand disinfection is standard, hand washing with soap only when there is visible contamination or if Clostridioides difficile is suspected, because alcohol is not effective against spores. The prerequisite is accessible donors (usually at every patient bed, in functional areas, at entrances and in preparation rooms) and sufficient skin-friendly preparations according to the VAH list with documented suitability. The compliance rate can be measured via the Clean Hands Campaign (ASH) at the Charité University Hospital, which has been certifying hospitals (bronze, silver, gold) since 2008.

Staff must be trained in hand hygiene at least annually, and new employees must be trained before starting work. Training courses must be documented with date, content, participants and learning success (often multiple-choice test with 80 percent threshold). The hygiene officer doctor randomly checks compliance via observations or electronic compliance monitoring systems on the donors. In the CIVAC workspace, hand disinfectant consumption data, observation results and training evidence are brought together and linked to audit templates. This creates reliable evidence of compliance that can be presented at every inspection. Others run compliance like a filing cabinet. We run it like software. Licence the workspace for your internal representatives or have our representatives appointed, tailored to the size and level of specialization of your company and with a connection to the Clean Hands campaign as well as to KISS and SARI modules for ongoing data transfer.

The reprocessing of medical devices is regulated in accordance with Section 8 MPBetreibV and the joint KRINKO/BfArM recommendation on hygiene requirements for the reprocessing of medical devices. It can only be carried out if the processing is carried out using validated processes in such a way that the success of these processes is comprehensibly guaranteed. The responsibility lies with the operator, usually represented by the head of the central sterilization (CSSD) with certified specialist qualifications according to specialist courses I to III as well as additional further training modules for endoscope reprocessing.

Medical devices are classified into risk classes: non-critical (contact with intact skin), semi-critical (contact with mucous membrane) and critical (penetration of skin or mucous membrane). Within semi-critical and critical, a distinction is also made according to reprocessing difficulty (A or B), for example flexible endoscopes as class B. For each class there are specific requirements for cleaning, disinfection and, if necessary, sterilization, validated by routine and periodic tests with documented results.

The validation of the reprocessing processes is carried out in accordance with DIN EN ISO 15883 (cleaning-disinfecting devices) and DIN EN ISO 17665 (steam sterilization). According to Section 9 MPBetreibV, the records must be kept for at least five years, and for implants for 20 years. According to the Medical Devices Law Implementation Act (MPDG), violations can trigger fines of up to 30,000 euros and, in serious cases, the withdrawal of the operating licence, supplemented by civil liability towards injured patients. Validation reports, batch documentation, maintenance protocols and training certificates for CSSD personnel are linked in the CIVAC workspace. This means that the reprocessing process can be completely traced for every implanted or used medical device, including the devices used and validation statuses at the time of reprocessing. This traceability is central for implant registers and liability issues years after the procedure, as well as for recall campaigns if a reprocessing device shows defects. Audit-proof, documented, § 8 MPBetreibV-proof.

An outbreak of nosocomial infections is defined according to KRINKO as the increased occurrence of infections with an epidemiological connection. Just two cases can cause an outbreak if a connection is plausible, for example due to proximity, identical pathogens or shared exposure. The obligation to report to the health authority in accordance with Section 6 Paragraph 3 IfSG takes effect immediately, usually within 24 hours of recognising the connection by hospital hygiene.

Outbreak management follows a standard process: immediate measures (isolation, cohorting, stopping admission if necessary), outbreak team (hospital hygienist, HFK, ward management, medical management, if necessary external advice from RKI or state health authority), cause analysis (microbiology, Environmental investigation, personnel screening, equipment analysis), catalogue of measures (intensified cleaning and disinfection, training, structural and technical adjustments if necessary) and documentation. Each phase must be logged with a time stamp and person responsible so that the timing remains traceable.

After the outbreak has ended, a final report will be issued with an assessment of effectiveness, lessons learned and, if necessary, adjustments to the hygiene plan and SOPs. Anyone who works cleanly here protects patients and the clinic management alike, because liability processes are often based on the outbreak report and the speed of reaction documented therein. An outbreak template is stored in the CIVAC workspace that contains all mandatory fields: initial report, team composition, catalogue of measures, microbiological findings, environmental findings, personnel findings, proof of training, reports to the health department with answers, final assessment. The template is one of 490 ready-to-use audit templates and is continually updated. If desired, CIVAC accompanies outbreak management as an officer-as-a-service with hygiene expertise on call, billable based on actual effort, with handover in 2 working days instead of the traditional 2-6 weeks. Licence the workspace for your internal representatives or have our representatives order it. The auditor calls, the evidence is ready. This speed is crucial if the health department schedules on-site appointments at short notice after an unusual pathogen finding and expects complete documentation.

A hygiene plan is only as good as its implementation in everyday life. Training, inspections and internal audits are the link. Training for all staff is mandatory at least annually, with topic-specific in-depth training for risk areas (OR, ITS, oncology, neonatology). New employees are trained before starting work. Evidence of training includes date, content, participants with signature or electronic confirmation, learning success and duration.

Inspections are carried out at least every six months by a hygiene specialist and hygiene officer, and more frequently in high-risk areas. Inspection logs document observed defects, measures to correct them, deadlines and those responsible. A review takes place after the deadline has expired. Audits by external bodies (e.g. as part of a KTQ or DIN EN ISO 9001 certification) rely on internal documents and should be conducted in the same structure to avoid duplication of work.

Linking with quality management according to KTQ, ISO 9001 or JCI is a good idea: hygiene indicators become part of the quality indicators, hygiene reports flow into QM reporting, audit findings trigger action plans. In the CIVAC workspace, training, inspections, audits and QM metrics are conducted in a data room. An inspection automatically generates a protocol that is linked to the hygiene plan and the affected SOPs. Measures go into a task pool with a deadline and person responsible, reminders run automatically. This creates a consistent audit trail that is equally viable for inspections, certifications and liability issues. EU data residency is standard, so that patient data and hygiene certificates do not leave the region and the requirements of the Federal Data Protection Act and the GDPR are met. The appointment certificate, signed, filed, verifiable. This creates a continuous reporting line from the station to the management, without information getting lost in email inboxes or paper folders and responsibilities remaining unclear.

Hygiene in hospitals is now a governance issue at management level and is no longer an operational detail for the nursing management. The requirements from IfSG, KRINKO, ART, MPBetreibV, state hygiene regulations and quality management come together in a system that can hardly be controlled without digital support. Anyone who keeps hygiene on paper folders loses time during inspections, risks gaps in the document chain and cannot respond to authorities' inquiries within 24 hours, which in turn weakens the burden of proof in the event of liability.

An integrated workspace bundles hygiene plan, SOPs, surveillance data, training certificates, inspection protocols, outbreak documentation, maintenance protocols and appointment certificates in one platform. Each obligation is linked to its legal basis, each measure to the person responsible and the deadline. Reports to management and the health department are created with just a few clicks from the existing data, without the content having to be maintained twice or different versions.

CIVAC is the compliance platform and officer-as-a-service that makes this integration possible. 25 representative roles are live, including the hygiene representative. 490 audit templates are ready for use, the workspace links hygiene with ISO/IEC 27001:2022 ISMS if the clinic is certified, as well as with ESG and quality reports. Licence the workspace for your internal representatives or have our representatives order it. If you would like to have your company's hygiene documentation checked or switch from paper to workspace, write to info@civac.de or use the contact form. Handover in 2 working days instead of the classic 2-6 weeks, including migration of existing hygiene plans, connection to KISS and SARI surveillance and handover of a complete appointment certificate with a description of tasks to the management and the hygiene commission. Turn reading into an assignment.