Health data compliant hosting for a clinic website in Berlin in 2026

The verdict in three sentences

A clinic brochure site can stay on ordinary hosting, but as soon as a form collects a pre-operative questionnaire, a prescription or a medical history, you need health-grade certified hosting (in Germany, a provider with a BSI C5 attestation and ISO 27001, in line with the 2024 Digital Act rules on cloud use in healthcare). The 2026 budget sits between 150 and 800 EUR per month excluding VAT depending on volume and service level, which is 20 to 40 % more than standard hosting. The right architecture separates the public website from the data collection module, which shrinks the certified scope and therefore the bill.

What brings a clinic website into the health data scope

Under GDPR Article 9, health data is a special category, and German law (the Digital-Gesetz and section 393 SGB V) requires cloud services processing health data to hold a current C5 attestation. A Berlin clinic publishing its opening hours, doctors and facilities is not affected. But once a patient fills in an anaesthesia questionnaire online, uploads a report or lists their medication, the database receiving that information must sit with a certified provider.

The classic trap: a "Reason for your request" field in the contact form, where the patient spontaneously types a diagnosis. Data protection authorities then consider that you process health data. Either you constrain the field (closed list, warning notice) or you route that form to the certified environment.

How much certified health data hosting costs in 2026

European providers with health-grade certifications have broadened their offers. OVHcloud, Scaleway, Outscale and German players such as IONOS and Open Telekom Cloud offer certified environments with different service levels. The figures below are 2026 orders of magnitude for a clinic website with a data collection module, excluding application management.

One-off costs come on top: the data protection impact assessment (DPIA) costs 1,500 to 4,000 EUR depending on whether your DPO or an external firm runs it, migrating the collection module 3,000 to 9,000 EUR, and a yearly penetration test 4,000 to 8,000 EUR. For a clinic, that budget is modest compared with the risk: GDPR fines reach 4 % of global turnover or 20 million euros, and the Berlin data protection authority has made healthcare a recurring audit priority.

The architecture that limits scope and cost

The most rational approach splits the website into two building blocks. The brochure site (content, SEO, news, recruitment) stays on fast, affordable hosting with a CDN. The collection module (questionnaires, uploads, patient portal) runs on a dedicated subdomain, for example forms.clinic-example.de, on certified hosting, with encryption at rest, access logging and strong authentication for clinical staff who read the answers.

This split avoids paying certified rates for pages that do not need them, and simplifies audits: the certified scope only contains what touches the patient.

Mini case study

Anna, CFO of a 60-bed day surgery clinic in Berlin, receives 9,000 pre-operative questionnaires a year, today on paper and then retyped. Retyping takes 6 minutes per file, 900 hours a year, roughly 27,000 EUR of administrative time. The project: moving the form to a certified module at 280 EUR per month (3,360 EUR a year), a DPIA at 2,500 EUR, development and migration at 7,500 EUR. First-year cost: 13,360 EUR. If 70 % of patients fill in online, the clinic saves about 18,900 EUR of retyping in year one, with payback in under nine months, not counting fewer cancelled procedures caused by incomplete questionnaires.

FAQ

Can a WordPress clinic website run on certified health hosting?

Yes, provided the provider is certified for the relevant activities and form plugins store data inside the certified environment. In practice we recommend a separate collection module, since 60 to 80 % of WordPress vulnerabilities come from third-party plugins.

Is a DPIA required for a simple pre-operative questionnaire?

Yes, large-scale processing of health data is on the supervisory authorities' lists of processing requiring a DPIA. Plan 1,500 to 4,000 EUR and 2 to 4 weeks, updated at every major change to the module.

What is the difference between certified infrastructure and certified managed services?

An IaaS provider with a C5 attestation covers the infrastructure, but if your agency also administers the application, its own processes and contracts must meet the same standard. Certified managed services add 400 to 1,500 EUR per month.

How long does a migration to certified hosting take?

Allow 4 to 8 weeks for a clinic: 1 to 2 weeks for scoping and the DPIA, 2 to 4 weeks for development and testing, then a gradual cutover. Historical data must be migrated encrypted and the old copy deleted.

What does a clinic risk by storing questionnaires on uncertified hosting?

A formal notice from the data protection authority, then a fine of up to 4 % of turnover, plus reimbursement issues where statutory health insurance rules apply. Several European healthcare fines in 2025 exceeded 100,000 EUR for security failures.

Let's scope your project. We design the split between public website and certified module, the DPIA and the migration of your forms, with an indicative budget and a 4 to 8 week schedule. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.