Hygiene in hospitals: legal framework, roles and evidence in 2026

According to Section 23 Paragraph 3 of the Infection Protection Act (IfSG), hospital managers must ensure that the measures necessary according to the state of medical science are taken to prevent nosocomial infections and to avoid the further spread of pathogens. What sounds abstract is operationally translated into a hygiene plan, hygiene commission, appointment of representatives and a complete audit logbook.

This article classifies hospital hygiene in 2026 according to legal frameworks, roles, evidence and digital tools. We show which gaps the health authorities most often address in supervisory discussions and how the CIVAC compliance platform and Officer-as-a-Service bundle the duties in one workspace. Compliance platform and officer-as-a-service in one tool.

The Infection Protection Act of July 20, 2000 in the version of the last amendment forms the federal framework. Section 23 IfSG requires the recording of nosocomial infections, multi-resistant pathogens and antibiotic consumption. Section 36 IfSG extends the obligation to care facilities, doctors' practices with outpatient surgery and dialysis facilities.

The recommendations of the Commission for Hospital Hygiene and Infection Prevention (KRINKO) at the Robert Koch Institute are also binding at the federal level. According to Section 23 Paragraph 3 IfSG, they have a presumptive effect: whoever implements them meets the state of medical science.

A medical hygiene regulation applies at the state level. Bavaria, North Rhine-Westphalia, Baden-Württemberg and all other states have different detailed regulations for the appointment of the hygiene officer, the hygiene commission and reporting obligations.

There are also sectoral rules: the TRBA 250 for biological agents, the Medical Device Operator Ordinance (MPBetreibV), the DIN EN 13060 for sterilization and the DIN EN 16442 for Endoscope preparation.

For digitally managed patient files, the GDPR with Art. 9 for health data and the ISMS mandatory environment according to ISO/IEC 27001:2022 also applies.

Supervision is the responsibility of the health authorities of the districts and independent cities. They carry out unannounced inspections and can issue immediately enforceable orders in accordance with Section 16 IfSG.

Section 23 Paragraph 5 IfSG obliges every hospital to create a written hygiene plan, update it regularly and make it accessible to all employees. The KRINKO recommendation 2010 specifies the minimum content.

Mandatory chapters are basics of hospital hygiene, risk assessment of areas, hand and skin disinfection, surface disinfection, processing of medical devices, laundry processing, waste disposal, pest control, structural requirements and pathogen-specific measures for MRSA, VRE, Clostridioides difficile and multi-resistant gram negatives Pathogens.

The update takes place at least once a year, based on new findings or after outbreaks. Versioning with release date, responsible person and change history is a mandatory part of the audit file.

Employees are instructed in the content. KRINKO recommends initial instruction when starting work and repeated annually. Participation in training must be verifiably documented, for example via electronic learning platforms.

A common weak point is discoverability. If the hygiene plan is difficult to find on the intranet or is not currently available on a ward, the supervisor complains about this in the inspection report. Audit-proof, documented, § 23-proof.

CIVAC maps the hygiene plan in the workspace with versioning, training module and location distribution. The appointment certificate, signed, filed, verifiable.

The staffing follows the 2009 KRINKO recommendation on personnel and organisational requirements. There are three roles to fill.

Hospital hygienists are specialists in hygiene and environmental medicine or specialists with an additional qualification in hospital hygiene. The KRINKO recommends a full-time position with 400 beds or more, with additional requirements for risk areas such as intensive care units, oncology or burns surgery.

Hygienists are nursing specialists with two years of further training. KRINKO recommends one full-time position for every 100 to 150 beds in risk areas and 200 to 300 beds in general care.

Hygiene-commissioned doctors must be appointed in every specialist department. They take over communication between the department and the hygiene commission and introduce the subject-specific hygiene requirements.

Hygiene officers in nursing complement the structure at ward level. They are the operational interface between hygiene specialists and everyday care.

If you cannot maintain the staffing level, you can appoint external hygiene officers. CIVAC delivers the appointment certificate, specifications, reporting line and ongoing support. Licence the workspace for your internal representatives or have our representatives order it.

Section 23 Paragraph 4 IfSG obliges the continuous recording of nosocomial infections and MRE. The data is evaluated, compared with the national reference centre and submitted to the hygiene commission.

At least postoperative wound infections, pneumonia, sepsis, urinary tract infections and infections with MRSA, VRE, carbapenem-resistant enterobacteria and Acinetobacter baumannii are recorded. The criteria follow the CDC and ECDC definitions.

The comparison data is provided by the modules of the Hospital Infection Surveillance System (KISS) at the National Reference Centre for Surveillance of Nosocomial Infections. Participation is voluntary, but in fact the gold standard.

The evaluation is carried out comparatively according to the 2013 KRINKO recommendation, with measures taken in the event of statistically noticeable deviations from the reference collective. The results are presented to the hygiene commission and the hospital management.

In the event of outbreaks, there is an obligation to report outbreaks to the health department in accordance with Section 6 (3) IfSG. Deadline begins as soon as we become aware of it. Two or more infections with the same pathogen with an epidemiological connection trigger the report.

CIVAC integrates the surveillance data into the workspace reporting and automates the reporting logic for outbreak criteria. The auditor calls, the evidence is ready.

The processing of critical medical devices follows the MPBetreibV and the joint recommendation of KRINKO and the Federal Institute for Drugs and Medical Devices (BfArM) dated October 1st, 2012.

Medical devices are divided into three risk classes. Non-critical products only touch intact skin, semi-critical products touch mucous membranes or pathologically altered skin, critical products penetrate skin or mucous membranes and come into contact with blood, tissue or sterile cavities.

Validated cleaning, disinfection and sterilization procedures must be provided for each class. Validation means: documented proof that the process achieves the required result.

Processing in central sterile goods supply departments (CSSD) follows DIN EN ISO 17665 for steam sterilization and DIN EN ISO 11135 for ethylene oxide. The endoscope preparation follows DIN EN ISO 15883-4 and DIN EN 16442.

The documentation is traceable on a patient-related basis. It must be possible to determine from the documents who used which instrument during which procedure. When it comes to supervision, the most common question is the test: Show me the reprocessing documentation of the instrument from OP 3 from April 14, 2026.

CIVAC connects the reprocessing software (e.g. T-DOC, Aesculap Aicon) with the workspace audit logbook via standardised interfaces and makes research possible in seconds.

The 2009 KRINKO recommendation calls for the establishment of a hygiene commission chaired by the medical management. Members include the hospital hygienist, the hygiene specialist, the nursing director, the medical director, the pharmacist, microbiology, technology and administrative management.

The commission meets at least twice a year. It decides on the hygiene plan, evaluates the surveillance data, decides on outbreak management and monitors the implementation of the KRINKO recommendations.

Protocols are mandatory and are presented to the hospital management. They are part of the audit file and can be viewed during inspections by the health department.

The reporting includes quarterly reports to the hospital management with surveillance key figures, training status, abnormalities and action status. A summary hygiene report is produced annually.

In the event of outbreaks, the commission meets in quick succession as an outbreak team. The protocols document the procedure and are the basis for reporting to the health department.

CIVAC provides the hygiene commission in the workspace with a meeting plan, agenda, decision log and minutes archive. Others run compliance like a filing cabinet. We run it like software.

Hospital hygiene in 2026 is unthinkable without patient data. Surveillance systems, electronic patient files, processing documentation and personnel planning process health data in accordance with Art. 9 GDPR.

The interface to the data protection officer is mandatory. Processing directory in accordance with Art. 30 GDPR, data protection impact assessment in accordance with Art. 35 GDPR for the surveillance database and technical-organisational measures in accordance with Art. 32 GDPR must be checked regularly.

In addition, the hospital is classified as a KRITIS operator in accordance with Section 8a BSIG if the threshold of 30,000 fully inpatient cases per year is exceeded. This means that the KRITIS regulation also applies with state-of-the-art obligations and reporting obligations to the BSI.

The German NIS 2 implementation law will bring further obligations for hospitals in 2026. Essential facilities must maintain a documented information security management system and report incidents to the BSI within 24 hours.

The operational connection between the hygiene officer, ISB and DSB is a frequent bottleneck. Without clear reporting lines, duplication of work, gaps and delays arise in emergencies.

CIVAC bundles these roles in a platform with a common reporting line. Compliance platform and Officer-as-a-Service in one tool, with EU data residency and ISO/IEC 27001:2022-ISMS.

§ 73 IfSG provides for fines of up to 25,000 euros for violations of hygiene obligations. In the event of intentional commission causing personal injury, there are criminal consequences under Sections 222 and 229 of the Criminal Code, including imprisonment.

Supervisory measures taken by the health authorities range from written orders to the closure of individual wards to the temporary ban on hospital operations. § 16 IfSG enables measures to be implemented immediately.

The personal liability of the hospital management results from § 23 Para. 3 IfSG and additionally from § 43 GmbHG or § 93 AktG for providers organised under private law. Civil service law applies to public service providers.

Supervisory boards and administrative boards are obliged to monitor. Anyone on the supervisory board who becomes aware of hygiene deficiencies and fails to act risks internal liability.

Insurance coverage for business and professional liability only applies if proven care is taken. Anyone who does not update the hygiene plan or ignores the KRINKO recommendations will lose insurance coverage in the event of damage.

The appointment certificate for the hygiene officer documents the delegation, but does not replace the responsibility of the management. The appointment certificate, signed, filed, verifiable.

CIVAC is a compliance platform and officer-as-a-service in one. We display the hygiene plan, the hygiene commission, the surveillance interface, the training module and the appointment certificate of the hygiene officer in one workspace.

Licence the workspace for your internal representatives or have our representatives appoint them. The workspace includes 490 ready-to-use audit templates, a module for the Hygiene Commission, a training register and an audit-proof archive with EU data residency.

In the Officer-as-a-Service model, CIVAC provides an appointed hygiene officer who supports the Hygiene Commission, maintains reporting, oversees supervision and maintains the interface with data protection and information security. You retain ultimate responsibility, we deliver the work.

Getting started begins with a gap assessment. We compare the status quo with Section 23 IfSG, KRINKO recommendations and the MedHygV of the respective country. You will receive an action plan with priorities and deadlines in two working days.

We then set up the workspace, migrate existing documents, create the appointment certificates and hand them over to your hygiene structure or our external representatives.

Turn reading into a mandate. Write to info@civac.de or use the contact form on civac.de. We will respond within two working days with a specific proposal.