Four industries. One common requirement: attributable Windows logon.

What's hard here

Clinical staff sign in and out dozens of times a shift. Passwords get written under keyboards. Shared accounts make access-trail reconstruction impossible. The contactless and PKI cards your hospital already issues can serve as logon tokens, but typically aren't wired into Windows out of the box.

German clinics: the regulatory map

German hospitals and practices answer to a denser stack of obligations than almost any other sector. CodeB is deployed in this environment because it lines up cleanly with each one:

• DSGVO & BDSG — patient records are special-category data under Art. 9 GDPR. Per-user authentication is the foundation of any defensible data-protection impact assessment. Shared accounts undermine that on day one.
• § 203 StGB — Verschwiegenheitspflicht — German criminal law holds doctors, dentists and clinical staff personally responsible for protecting patient secrecy. Strong, attributable Windows logon makes the technical case that access was constrained to authorised individuals.
• § 75c SGB V — since 2022, every German hospital must implement IT security "nach dem Stand der Technik". The Bundesärztekammer and DKG read this as mandating MFA on clinical workstations. CodeB is the MFA layer sitting at the Windows logon screen itself.
• B3S Krankenhaus & KRITIS — the industry-specific security standard for hospitals under § 8a BSIG. Section 5 (Identity and Access Management) explicitly requires strong authentication for clinical systems. CodeB delivers that without bolting on a separate IAM platform.
• KHZG funding — the Krankenhauszukunftsgesetz earmarked 15 % of digitalisation funds specifically for IT security. CodeB qualifies as an eligible measure under FT 10 (IT security), so the rollout is fundable through your KHZG-Antrag.

How CodeB is deployed

Featured case study

Automatic logon to T2Med (Java clinic software).

T2Med is the Java-based clinic software in widespread use across primary-care practices. With CodeB, the clinician taps an NFC card once and lands inside T2Med, already signed in — no Windows password, no T2Med password, no TOTP code typed by hand.

Watch · T2Med auto-logon demo

How it works

The CodeB Credential Provider secures the Windows logon with a second factor — NFC card or TOTP — and at the same time enables passwordless logon. An authorised NFC card or TOTP code fully replaces the username-and-password step. Hold a registered card to the reader and the Windows session opens.

The bundled Web SSO engine extends the same authentication into web apps, classic Windows apps and Java-based desktop applications. It detects the application's login window, fills the right credentials, and — if a TOTP code is required — calculates and enters it. T2Med is a typical example: once configured, the clinician taps once and T2Med opens already authenticated.

Four-step setup

1. Download CodeB. Get codeb_tray.zip from our download site.
2. Install the Credential Provider. Run CredentialProviderInstaller.exe from the zip and click Install Credential Provider.
3. Add a Web SSO entry for T2Med. Run CodeBWebSSO.exe, click Add Domain, enter t2med, click Done. A default t2user account is pre-created for the demo system — replace it with your own credentials or add more users as needed.
4. Start the tray helper. Run codeb_tray.exe from the zip — this is the process that injects credentials into T2Med at runtime.

Result: the next time T2Med starts, the clinician is signed in automatically.

What's hard here

OT environments tolerate very little disruption. Updating Windows is a quarterly event, not a Tuesday. Operators wear gloves; touchscreens are clumsy; cards get lost. Yet NIS2 and customer audits now demand individual attribution of every action that touches the MES.

How CodeB is deployed

What's hard here

OEM machine controllers are built on whatever Windows version was current when the machine left the factory — and they stay in service for ten to twenty years, often on networks with no internet at all. The HMI typically has two user populations: the shift operator who runs the machine, and the service engineer who reconfigures it. Both need attributable logon, and increasingly under NIS2 because the host industry (food, pharma, energy, water, manufacturing of essential goods) is in scope.

How CodeB is deployed

What's hard here

Office environments are heterogeneous: laptops on the road, desktops on-prem, Azure Virtual Desktop for contractors. Auditors expect cryptographically attributable logon — but most environments still rely on a password and a SMS code, both phishable.

How CodeB is deployed