Reference project
Ophthalmology practice, Berlin Prenzlauer Berg
Our first fully completed project: network re-cabling and segmentation of an operating ophthalmology practice, including complete data-protection and contract documentation.
Starting point
Cabling grown over time, no network separation
The practice was running on cabling that had grown organically with no consistent standard, and a single flat network: reception, diagnostic devices, and the practice Wi-Fi for patients all shared the same network. For a facility processing special-category health data, that is an avoidable risk, and a point the KBV guideline on IT security in medical practices addresses explicitly.
Target picture
Separated networks, documented responsibility
The goal was an infrastructure that is cleanly separated on the technical side, with its legal basis documented just as cleanly, so practice management can stay calm during an audit by the data-protection authority or the regional medical association.
Structured Cat6A cabling
Complete re-cabling of all treatment and administrative rooms with Cat6A cable, centrally consolidated and documented via labeled patch panels.
UniFi network technology
A UniFi Cloud Gateway Ultra as the central gateway, a UniFi Switch Lite 8 PoE connecting workstations and devices, and a UniFi U6+ access point providing internal Wi-Fi plus a separate guest Wi-Fi.
VLAN separation by functional area
Three separate VLANs: one for practice administration and reception, one for diagnostic and medical devices, one for patient Wi-Fi, with no cross-talk between the networks.
Complete compliance documentation
A §203 StGB confidentiality undertaking, an IT services agreement, and a data processing agreement (DPA) under Art. 28 GDPR: all signed before installation began.
Hardware used
| Gateway | UniFi Cloud Gateway Ultra |
|---|---|
| Switch | UniFi Switch Lite 8 PoE |
| Access point | UniFi U6+ |
| Cabling | Cat6A, throughout |
Legal documentation
| Confidentiality | §203 StGB confidentiality undertaking |
|---|---|
| Services | IT services agreement |
| Data protection | DPA under Art. 28 GDPR |
| Alignment | Aligned with the KBV guideline |
Result
A network the practice no longer notices (in the best sense)
Reception, diagnostic devices, and guest Wi-Fi now run on separate, documented VLANs. The cabling is built to last for years, and practice management has every legally relevant document signed and archived, instead of having to track it down in an emergency.