When the consultation room moves online.
What it really takes to certify a video tool that doctors and patients can trust — and why most of the apps in everyday clinical use would not pass the audit.
A patient describes a chest pain that woke them at 3 a.m. A psychiatrist asks an adolescent how often the intrusive thoughts return. An oncologist reviews the report from yesterday's CT and explains, gently, what comes next. None of these conversations should be observable, retrievable, or replayable by anyone other than the two people in the call. And yet, almost every video tool in everyday clinical use was designed first for marketing webinars, then patched into healthcare afterwards.
For most of the past decade, telemedicine has been built on borrowed infrastructure. The pandemic pushed practitioners onto whatever consumer-grade conferencing tool worked: signing-up, joining, screen-sharing — under enormous time pressure, with no time to ask where the media servers were located, who held the encryption keys, or what happened to the recording cache when the call ended. The result is an enormous installed base of video sessions running through services that were never designed to satisfy European data protection law, and certainly not designed for the asymmetric trust relationship between a doctor and a patient.
Germany's regulators noticed early. In Annex 31b to the Bundesmantelvertrag-Ärzte — the Federal Master Agreement that governs how statutory health-insurance physicians may treat their patients — the National Association of Statutory Health Insurance Physicians (KBV) wrote down a precise, technical, and unforgiving definition of what a permissible video consultation tool actually has to do. Any provider that wishes to be listed by the KBV as a certified video service must obtain two independent attestations: one for data protection and one for information security. There is no halfway grade. There is no self-assessment. The audit is done by a recognised independent body — and in practice, the most rigorous of these is TÜV Informationstechnik (TÜVIT).
Two attestations, one architecture
The data-protection half of the certification is performed under Article 42 of the GDPR, the article that authorises formal certification mechanisms as a means of demonstrating compliance. Auditors examine the entire processing chain: the lawful basis for each operation, the principles of purpose limitation and minimisation, the security of processing under Article 32, the documentation of every processor and sub-processor, and the operational reality of fulfilling data subject rights — access, rectification, erasure, portability, and objection. This is not a paper review. The auditors look at the actual deployment, the actual configuration, and the actual logs.
The information-security half is harder still. Auditors begin with a penetration test against the live infrastructure — probing for unauthenticated endpoints, misconfigured TURN relays, replayable session tokens, weak ciphers, and the long tail of media-handling flaws specific to WebRTC stacks. Once the penetration phase is closed out, the engagement moves to Trusted Site Video Consultation (TSVC), TÜVIT's purpose-built certification scheme for telemedicine. TSVC inspects the technical and organisational controls around the call itself: how media is transported, how it is encrypted, whether anything is persisted to disk in violation of the specification, whether any operator — including the platform vendor — could read or replay an in-flight conversation, and how the system behaves when something fails.
The certification confirms what most clinicians already suspect: a video tool is not safe simply because it works. It is safe when an independent laboratory has tried to break it, watched it under load, read its source documentation, and signed a certificate against a published standard.
— AMVLET Clinical Security PracticeWhy ISO 27001 is the load-bearing wall
Underneath both attestations sits the international standard for information security management: ISO/IEC 27001:2022. Telemedicine certification verifies a single application against a specific use case. ISO 27001 verifies the entire organisation — the policies that govern how the application is built, the controls that protect the people who run it, the supply chain that feeds into it, and the incident response capability that activates when something goes wrong. The 2022 revision of the standard reorganised Annex A into 93 controls across four domains: organisational, people, physical, and technological. AMVLET is audited against all of them.
The combination matters. ISO 27001 without telemedicine certification is a generic information-security claim. Telemedicine certification without ISO 27001 is a single-product attestation that says nothing about whether the company behind it can sustain that posture beyond the certification window. The two together — independent ISMS certification from one auditor, video-specific certification from another, both maintained on a continuous surveillance cycle — is what regulators are actually asking for when they require "verifiable security." Anything less is a marketing claim with a logo on it.
What the audit actually looked for
The certification scope was the AMVLET video subsystem in its standard deployment configuration: end-to-end encrypted media between authenticated session participants, federated server topology with EU-resident infrastructure, no third-country routing, no plaintext recording paths, and the full administrative console used by clinical operators. Auditors verified that the platform's encryption implementation does not retain key material beyond the lifetime of a session, that no platform operator — at any privilege level — can attach an observer to an in-flight call, and that all media is purged from cache at session termination. Penetration tests were run against the publicly reachable surface and against the internal trust boundary; both phases closed without findings of high or critical severity.
For practitioners, the practical effect is straightforward. A video consultation conducted on AMVLET satisfies the technical requirements of Annex 31b BMV-Ä for German statutory health-insurance care, the security requirements of Article 32 GDPR for any EU member state, and — under the certification mechanism of Article 42 — provides a presumption of compliance that supervisory authorities can recognise without re-auditing every deployment. For everyone else: it is the same standard your colleagues will eventually be required to meet. We chose to meet it now.