Starting April 29, 2025, the electronic patient record (ePA) will be available nationwide for practices, hospitals, and pharmacies in Germany. This digital record is designed to simplify the management of patient information by storing essential documents such as doctor's letters, lab results, and medication plans. However, just before its launch, the initiative is facing criticism from patient advocates who accuse the government of misleading the public about the system's capabilities.
Patient advocates, including Eugen Brysch from the German Foundation for Patient Protection, have raised concerns that insured individuals will not have the option to restrict access to specific documents for certain healthcare providers. Contrary to previous assurances, it appears that if a patient wishes to block an orthopedist from viewing certain information, that information will be inaccessible to all doctors. Brysch explained, "An orthopedist can see that the patient is in many years of psychotherapeutic treatment, even if the patient only wants to make this information available to neurological specialists." This lack of granularity in data access has led to fears that sensitive health information could be exposed unnecessarily.
The ePA has been tested in pilot regions including North Rhine-Westphalia, Hamburg, and Franconia, but the rollout is now set to expand to all 75 million statutory insured persons in Germany. Outgoing Health Minister Karl Lauterbach (SPD) assured that security vulnerabilities identified by the Chaos Computer Club (CCC) have been addressed. The CCC had previously claimed they could access the technical infrastructure of the ePA, including devices used to read insurance cards, raising alarms about potential data breaches. Lauterbach stated that a mass attack is "technically no longer possible," and the Federal Office for Information Security (BSI) confirmed these claims.
Despite these assurances, Brysch and other patient advocates remain skeptical. They argue that the design of the ePA could lead to a situation where the entire healthcare sector has unrestricted access to personal health data. "The danger is great that the entire healthcare industry will have complete access to their own health data," Brysch warned. Under the current system, service providers can access patient data for up to 90 days, while access for paramedics and company doctors is limited to just three days.
Moreover, patient advocates have criticized the lack of options for patients to manage their medication lists. Once the ePA is implemented, patients will not be able to remove individual medications from their records, which could inadvertently reveal sensitive information about their health conditions. Brysch emphasized, "There is only the option not to use this list," which he believes is inadequate.
Looking ahead, the ePA will initially be voluntary for healthcare providers, but it will become mandatory on October 1, 2025. This transitional period is intended to help practices, hospitals, and pharmacies adjust to the new system. However, patients can object to the ePA at any time through their health insurance providers, who are then required to delete the electronic record and all associated data.
In addition to the concerns about data access and security, there are calls for the government to ensure that patients are adequately informed about the ePA and its implications. Thomas Moormann from the Verbraucherzentrale Bundesverband (Vzbz) has stated that the principle of contradiction must not serve as a loophole for insufficient clarification. He believes that if patients were better informed about the benefits and risks of the ePA, more would be inclined to use it actively. Moormann noted that features like digital access to vaccination records or bonus booklets could enhance its appeal.
As the launch date approaches, the government faces mounting pressure to address these concerns. Brysch has called for a temporary halt to the ePA's rollout until a more robust system for managing data access can be established. He stated, "The responsible parties have missed the chance to create easily understandable differentiation options for data access." The future of the ePA hinges on the government's ability to reassure both healthcare providers and patients that their data will be secure and that they will have control over who can access it.
Ultimately, the ePA represents a significant step towards digitizing healthcare in Germany, a concept that has been in development for over 20 years. However, as it prepares for its nationwide launch, the success of the ePA will depend not just on its technological capabilities but also on the trust it can build with patients and healthcare professionals alike. With the deadline for mandatory use looming, the government's actions in the coming months will be critical in shaping the future of patient data management in Germany.
