Institute for Medical Microbiology and Hygiene: Tasks, interfaces, representative duties

With Section 23 of the Infection Protection Act (IfSG) in the version dated July 20, 2011, most recently amended several times, hospital hygiene has moved from the purely medical area into a clearly regulated set of duties with supervision by the health authorities and the state authorities. The recommendations of the Commission for Hospital Hygiene and Infection Prevention (KRINKO) at the Robert Koch Institute define the recognised state of medical science in accordance with Section 23 Paragraph 3 IfSG, supplemented by the KRINKO-BfArM recommendations for the reprocessing of medical devices. Microbiological institutes provide the laboratory diagnostic basis for this: pathogen identification, resistance testing, typing in outbreaks, water and environmental samples, supplemented by epidemiological evaluation. Without these findings, every hygiene measure remains blind, every outbreak remains unexplained and every remediation decision is difficult to justify.

This article is aimed at hygiene officers in clinics, care facilities, rehabilitation centres and large practices, at hospital management and at laboratory management at microbiological institutes. It describes the tasks of an institute for medical microbiology and hygiene, the legal interfaces according to IfSG, the cooperation with the hygiene officer and the hygiene commission, the obligations in outbreak management, the requirements for sampling according to DIN EN ISO 19458 as well as the documentation and reporting channels via the electronic reporting system DEMIS. CIVAC is the compliance platform and officer-as-a-service in which hygiene officers manage their reporting lines, audit templates and reporting paths in an audit-proof manner.

An institute for medical microbiology and hygiene fulfils four central sets of tasks that form the backbone of infection prevention in hospitals. Firstly, routine diagnostics close to the patient: pathogens from blood, urine, wounds, respiratory tract, stool, cerebrospinal fluid and aspirates are cultured, identified using MALDI-TOF mass spectrometry, checked for resistance to relevant antibiotics and diagnosed promptly. Secondly, hygiene and environmental diagnostics: water samples according to the Drinking Water Ordinance, air conditioning system samples according to VDI 6022, endoscope processing samples according to KRINKO-BfArM recommendations, surface and hand samples in the outbreak. Thirdly, epidemiological surveillance: resistance and pathogen statistics in accordance with Section 23 Paragraph 4 IfSG, participation in the national surveillance systems KISS and SARI and antibiotic consumption surveillance ADKA-if-RKI. Fourth, the scientific and advisory function: statements for the hygiene commission, training of staff, outbreak investigation with molecular typing and advice to management on strategic hygiene decisions.

Accreditation is carried out regularly in accordance with DIN EN ISO 15189 for medical laboratories by the German Accreditation Body, supplemented by the requirements of the German Medical Association's guidelines for quality assurance of laboratory medical examinations (Rili-BÄK). The microbiological-infectious quality standards (MiQ) of the National Reference Centre and the DGHM provide methodological guidelines for almost every sample material. Hospitals, nursing homes and rehabilitation clinics often work with external microbiological institutes, contractually secured through service contracts with clear SLAs for sample duration, reporting of findings and emergency on-call availability on weekends and public holidays. In the CIVAC workspace, hygiene officers document these contracts together with the sampling plan, the KRINKO list of measures and the reporting line to management. The appointment certificate, signed, filed, verifiable. The clinic-laboratory interface turns from an informal telephone relationship into a documented, verifiable and KRINKO-compliant structure that can be verified in audits, in the event of damage and in the awarding process. For more on the role profile, see Hygiene Officer.

Four sets of rules provide the set of obligations for the interface between the microbiological institute and the clinic. Firstly, the Infection Protection Act, in particular Section 6 (doctors' obligation to report), Section 7 (laboratory reporting obligation), Section 23 (hospital hygiene, obligation to appoint hygiene specialists and formation of a hygiene commission) and Section 36 (obligations in facilities). Secondly, the Medical Device Operator Ordinance (MPBetreibV) with requirements for the reprocessing of medical devices, the regular microbiological controls according to the system and the obligation to appoint a representative for medical device safety in accordance with Section 6. Thirdly, the KRINKO recommendations, which specify the state of medical science in accordance with Section 23 Paragraph 3 IfSG, with thematic volumes on surveillance, multi-resistant pathogens (MRSA, MRGN, VRE), water hygiene, reprocessing of endoscopes, structural-functional requirements, hand hygiene and personnel qualifications. Fourth, the Drinking Water Ordinance in the version dated June 20, 2023, with notification and examination obligations for large-scale drinking water heating systems (Legionella) as well as for sensitive areas such as intensive care units, hematology and neonatology.

Sectoral special laws complement the picture. For KRITIS clinics with 30,000 or more inpatient cases per year, NIS 2 obligations with 24-hour early warning and 72-hour follow-up notification to the BSI apply. The Hospital Future Act (KHZG) and Section 75c SGB V, which prescribe IT security in hospitals, are relevant for patient safety and IT. In terms of data protection law, the GDPR applies with Art. 9 (special categories of personal data), the respective state hospital law, the Medical Professions Chamber Act and the Federal Data Protection Act. The CIVAC workspace template “Hygiene Legal Register” assigns each standard to a person responsible, documents the date of the last test, the evidence attachments and the next test interval. Audit-proof, documented, Section 23-proof. In the event of violations, fines of up to 25,000 euros are stipulated in accordance with Section 73 IfSG, in addition to state sanctions and civil and criminal liability of the management in accordance with Section 130 OWiG.

§ 7 IfSG obliges heads of examination centres to report specific pathogen evidence by name to the responsible health authority. The list includes around 50 pathogens, including Acinetobacter spp. with carbapenem resistance, Campylobacter spp., Clostridioides difficile with severe disease, Enterobacterales with carbapenem resistance, influenza viruses, Listeria monocytogenes, Mycobacterium tuberculosis complex, norovirus, Salmonella spp., Shigatoxin-producing Escherichia coli (STEC), SARS-CoV-2, Vibrio cholerae and Pseudomonas aeruginosa Carbapenem resistance. The report is made immediately, at the latest within 24 hours of becoming aware of it. Deadline begins as soon as we become aware of it. Since January 1, 2026, electronic reporting via DEMIS (German Electronic Reporting and Information System for Infection Protection) has been mandatory across the board; the fax procedure is only permitted in exceptional cases.

There are also non-name reporting obligations for HIV, Treponema pallidum, Echinococcus spp., Plasmodium spp., Toxoplasma gondii in newborns, Rubella congenita and other pathogens. Section 6 IfSG supplements the obligation of treating doctors to report suspected illness, illness and death in the case of certain illnesses. The parallel reporting from the laboratory and the practitioner is intentional: it ensures the completeness and plausibility of the data. In everyday clinical practice, timely reporting requires a well-established chain between the laboratory, hygiene officer, medical directorate and health department, with clear substitution regulations for weekend and holiday services. The CIVAC workspace maps this chain as a workflow: pathogens recorded, reporting path triggered, DEMIS confirmation archived, internal information documented to the hygiene commission, escalation to management automatically triggered in the case of critical pathogens. The auditor calls, the evidence is ready. In the event of outbreaks or unusual clusters, there is also an obligation to report in accordance with Section 6 Paragraph 3 IfSG, immediately and even without identifying the pathogen.

Section 23 (4) IfSG obliges hospitals to record and evaluate certain nosocomial infections and pathogens with special resistances and multi-resistances and to present them to the responsible supervisory authority upon request. The KRINKO recommendation “Surveillance of nosocomial infections” specifies the obligation and defines minimum indicators. In Germany, structured recording is typically carried out via the KISS system (Hospital Infection Surveillance System) at the National Reference Centre for Surveillance of Nosocomial Infections at the Charité. There are modules for intensive care units (ITS-KISS), for postoperative wound infections (OP-KISS), for newborns (NEO-KISS), for hematology-oncology (ONKO-KISS), for outpatient operating facilities (AMBU-KISS) and for resistant pathogens (MRSA-KISS, ESBL-KISS). SARI records antibiotic resistance and antibiotic consumption in intensive care units, AVS-RKI records consumption behaviour in the area.

The data is collected together with the microbiological institute. The pathogen, resistance profile, sample material, date of admission, risk factors and ward history are included in pseudonymized statistics that are sent quarterly to the reference centre. Comparative values ​​from the reference centre allow you to compare your own clinic with the median of similar hospitals and identify risk areas. Surveillance data is not only mandatory, but also a central control lever: outbreaks can be identified earlier based on statistical abnormalities, antibiotic strategies can be adapted more specifically, the effect of training programs becomes measurable, and the economic management of hygiene measures receives an empirical basis. The CIVAC workspace integrates the surveillance reports as an audit template: quarterly and annual reports, event assessments, handover to the hygiene commission, reporting line to management, versioning per template. Others run compliance like a filing cabinet. We run it like software. This creates a statistical base that not only fulfils the obligation, but also enables learning effects internally, can be incorporated into antibiotic stewardship programs and can be presented to the health department in the event of an inspection.

An outbreak within the meaning of Section 6 Paragraph 3 IfSG occurs when the increased occurrence of nosocomial infections suggests an epidemic connection. Reporting to the responsible health authority must be made immediately, even if the pathogen has not yet been finally identified and there is only a reasonable suspicion. The microbiological institute takes several critical steps in the event of an outbreak. Firstly, the rapid identification of the pathogen, ideally using MALDI-TOF mass spectrometry for second identification from the pure culture. Secondly, typing using pulsed-field gel electrophoresis, multilocus sequence typing or next-generation sequencing to provide molecular evidence of clonality and thus the epidemic connection. Thirdly, the environmental examination: water, surfaces, hands, medical devices, food and air depending on the suspicion and pathogen. Fourth, advice on case definition and epidemiological evaluation.

The outbreak commission works in parallel. KRINKO recommends the formation of an outbreak management team consisting of the medical directorate, nursing directorate, hygiene specialist, hospital hygienist, microbiological institute, housekeeping and, if necessary, the health department. Tasks include: case search and case definition, catalogue of measures with isolation, cohorting, closure and staff blocking, communication to patients, relatives, employees and the public as well as the documentation of all steps. The CIVAC workspace provides the audit templates “Outbreak notification § 6 IfSG”, “Outbreak line protocol” and “Catalogue of measures”. Every step is stored in an audit-proof manner with a time stamp and person responsible, and every measure receives an effectiveness check. The external hygiene officer moderates the commission, coordinates the reporting line to management and ensures the legally compliant final documentation according to the ORION outbreak reporting scheme. A well-managed outbreak file is not only mandatory, but also the key to avoiding repeat events and to arguing with patients, relatives, the media and sponsors in the following year's analysis. It is also the basis for the subsequent adaptation of standard operating procedures, training plans and structural measures.

Section 23 Paragraph 3 IfSG obliges certain facilities to appoint hygiene specialists and to set up a functioning hygiene structure. The states specify the requirements in their hygiene regulations, such as the Bavarian Medical Hygiene Ordinance (MedHygV BY 2010, in the 2023 version), the North Rhine-Westphalia Hygiene Medical Devices Ordinance (HygMedVO 2012) or the Berlin Hygiene Ordinance. The KRINKO recommendation “Personnel and organisational requirements for the prevention of nosocomial infections” specifies staffing ratios for hospital hygienists, hygiene specialists and hygiene-commissioned doctors, staggered according to the number of beds and risk areas. For nursing facilities, rehabilitation clinics, outpatient operations and large practices with an increased range of procedures, there are analogous requirements, usually set by state law, with their own reporting obligations.

The order is made in writing by the management and, if necessary, must be reported to the health department. Mandatory components are: task description, reporting line, freedom of instruction in technical matters, access to all relevant areas, entitlement to annual training and representation regulations. The reporting line usually goes directly to the management or the medical directorate with a fixed meeting frequency. In terms of qualifications, KRINKO requires at least 40 hours of curricular training for doctors responsible for hygiene, and two years of specialist training with state recognition for hygiene specialists. CIVAC is the compliance platform and officer-as-a-service for exactly this requirement: appointment certificate in the workspace, reporting line defined, training certificates stored, audit templates for KRINKO topics ready for use, automatic reminders for training deadlines. Licence the workspace for your internal representatives or have our representatives order it. The CIVAC SLA of 2 working days also applies to the creation of the appointment certificate including notification to the responsible supervisory authority, if provided for by state law. Comparable external representative solutions typically take 2 to 6 weeks to order, with significant follow-up costs for the clinic and risks in the meantime, for example in the event of inspections or outbreaks.

Three infrastructure topics produce the most common microbiological findings outside of patient samples. Firstly, drinking water. The Drinking Water Ordinance requires an annual preliminary examination for Legionella spp. in large drinking water heating systems with a volume of 400 liters or more or a pipeline content of more than three liters between outlet and extraction. If the technical measure value is 100 CFU per 100 ml of water, measures must be taken; from 10,000 CFU there is an acute risk with a ban on the use of certain outlets and an immediate report to the health department. Sensitive areas such as intensive care units, hematology and neonatology require closer controls, if necessary with terminal sterile filters and microbiological repeat testing after renovation.

Secondly, ventilation systems (RLT). KRINKO and VDI 6022 specify requirements for clean room classes, filter levels, maintenance intervals and routine microbiological testing, especially for operating rooms in room class I a. Thirdly, the processing of medical devices in accordance with MPBetreibV and KRINKO-BfArM recommendations. Endoscopes are particularly sensitive; The microbiological control after reprocessing must be carried out at least annually as part of a validated reprocessing, and more frequently for flexible bronchoscopes, duodenoscopes and ERCP devices. The microbiological institute not only provides findings, but also methodological advice on sampling according to DIN EN ISO 19458 and on the interpretation of borderline results. The CIVAC workspace documents per system and procedure: test interval, last sample, findings, measures if exceeded, next test. In routine operations, a reminder is sent to the hygiene officer 30 days before the deadline expires. The clock starts on awareness. Anyone who documents the reminder has provided proof of the supervisory obligation and risk assessment in the event of an audit. This saves later discussions with the health authority, with insurers in the event of damage and with lawsuits from patients or relatives, because the duty of supervision is fully documented at the time of the breach of duty.

Microbiological findings are special categories of personal data according to Art. 9 GDPR and are therefore subject to an increased level of protection. At the same time, the medical confidentiality obligation applies in accordance with Section 203 of the Criminal Code, supplemented by the obligation of confidentiality in accordance with the medical professional regulations. Processing in the laboratory is regularly based on Article 9 Paragraph 2 Letter h of the GDPR (health care), supplemented by state law provisions such as the Medical Professions Chamber Act, the State Hospital Act and the Federal Data Protection Act. Transfers from the hospital to the external laboratory are generally not order processing within the meaning of Art. 28 GDPR, but rather a transfer to a separate person responsible with their own duty of confidentiality and their own processing activity. Nevertheless, there is a need for contractual clarity regarding purpose, data, storage, sub-service providers, data breach communication and deletion workflows.

When transmitting data to the health authority within the framework of Section 7 IfSG, the legal basis is statutory. DEMIS has largely replaced the fax process since January 1, 2026; the data flows are end-to-end encrypted and provided with a confirmation of receipt. The following applies to internal surveillance: pseudonymized evaluation is standard; tracing back to individual patients may only be carried out by authorised persons and must be recorded. The retention periods follow Section 10 IfSG (30 years for reportable pathogens), Section 630f BGB (patient files 10 years, longer in radiation protection and transfusion medicine) and the respective medical professional regulations. In the event of a data breach, the 72-hour deadline in accordance with Article 33 GDPR applies with reporting to the responsible data protection supervisory authority. The CIVAC workspace template “Microbiology Data Flow” maps each step and assigns the legal basis, recipient, retention period, deletion workflow and responsible person. Audit-proof, documented, § 7-proof. When order processing is carried out by IT service providers, for example in the case of interfaces for the transmission of findings, an AVV in accordance with Art. 28 GDPR is also added.

Hospital hygiene and microbiological diagnostics thrive on the speed of translation: findings in the morning, measures in the afternoon, report to the hygiene commission at the end of the month, reporting line to management at the end of the quarter, annual report to the supervisory authority. Anyone who keeps this cascade as a spreadsheet on a single hard drive cannot prove it in the audit and will lose time if the health department announces an inspection. Anyone who runs it as a workspace with versioning, automatic reminders and a defined reporting line has met the minimum requirements for KRINKO-compliant hygiene management and can even prove the effort to the cost and service provider.

CIVAC is the compliance platform and officer-as-a-service for the hygiene officer role. You will receive an appointment certificate within the CIVAC SLA of 2 working days, a reporting line to management and access to 490 ready-to-use audit templates, including hygiene legal register, KISS surveillance report, outbreak protocol, drinking water examination plan, AHU maintenance certificate, MPBetreibV processing document, as well as the interface to the microbiological institute with sampling plan, contract SLA and findings archive. EU data residency, ISO/IEC 27001:2022 with 93 controls and audit-proof storage are built in. Licence the workspace for your internal representatives or have our representatives order it. Turn reading into an assignment. Write to info@civac.de or use the contact form on civac.de. You will receive a proposal, an appointment and a draft appointment certificate on the same working day. In addition, a quarterly reporting obligation to management is agreed with key figures on hygiene indicators, drinking water tests, treatment controls, open measures, surveillance statistics and the status of personnel qualifications. You also retain a designated contact person for escalations on weekends and for DEMIS reports outside of regular working hours. In this way, heterogeneous obligations result in a guided workflow and predictable economic efficiency for the hygiene organisation of your facility. The appointment certificate, signed, filed, verifiable.