Former office · technology policy
During Nina Warken's term as health minister the electronic patient record moved from rollout to obligation, and her ministry prepared the next digital law. This page explains the system from the network up to European data rules.
In force ePA obligation for providers since 1 Oct 2025
Bill GeDIG, adopted by cabinet 15 Jul 2026
Layers 1–2
"ePA for all" starts in model regions under minister Lauterbach.
Practices across Germany can begin using the ePA, after additional security measures.
Doctors, psychotherapists and pharmacies must work with the ePA — during Warken's tenure.
Every person with statutory health insurance receives an electronic patient record (elektronische Patientenakte, ePA) unless they object. This opt-out model replaced an earlier opt-in version that relatively few people had used. The record is meant to collect doctors' letters, findings, a medication list and, over time, further documents, so that information follows the patient between practices, hospitals and pharmacies.
From 1 October 2025 the ePA stopped being optional for providers: doctors, psychotherapists and pharmacies are obliged to use it and to upload key documents from treatment, such as doctors' letters and reports of findings. For patients it remains voluntary — they can object to its creation or use at any time, and restrict which documents are visible to whom.
Security was the most serious challenge before the nationwide start. At the Chaos Communication Congress in December 2024, security researchers Bianca Kastl and Martin Tschirsich demonstrated how attackers could, under certain conditions, gain access to records at scale. The ministry and gematik postponed the national rollout until additional protections had been agreed with the Federal Office for Information Security (BSI). A further vulnerability reported in late April 2025 was closed shortly after launch, according to gematik. Data security therefore remains part of every debate about extending the ePA.
Layer 3 · 15 July 2026
The "digital law" listed among the ministry's seven themes for 2026 became the Act on Data and Digital Innovation in Health Care (Gesetz für Daten und digitale Innovation im Gesundheitswesen, GeDIG), adopted by cabinet two weeks before the reshuffle. It still requires passage through the Bundestag and Bundesrat.
Full-text search planned for early 2027 and a digital vaccination record with reminders for mid-2027. Pharmacies and health ombudspersons may help patients use the ePA.
Insurers may add their own functions to the ePA app, such as prevention tips, appointment reminders, health planners and AI-supported services like patient-friendly explanations of findings.
Insurers must offer a digital entry point via the ePA app for booking appointments, receiving a digital first assessment in acute cases and using telemedicine.
Referrals for further treatment are to be issued only electronically through approved programmes; practices report free appointments through an automated interface.
Simpler use of the health card, secure messenger communication in the telematics infrastructure and wider procurement and oversight powers for gematik.
Expansion of the research data centre, time-limited "real labs" for data processing and a framework for implementing the European Health Data Space.
Layers 4–5
Digital care produces data that can improve research and quality. Two frameworks predate her tenure and shape what any German health-data law can do.
In force since 26 March 2024, under her predecessor. It created a central data access and coordination body to lower barriers for researchers; data stay stored where they are and are brought together only for an approved project in a secure processing environment. It introduced a research secrecy obligation and rules for linking data from the national research data centre with the Länder's clinical cancer registers.
Regulation (EU) 2025/327 entered into force on 26 March 2025. It applies in stages: generally from March 2027, with the rules on secondary use of health data — for research, innovation and policy — applying from March 2029, and some data categories later still. It aims to let people access their health data across borders and to create common conditions for research use.
Innovation & patient benefit
The government's case for digital health rests on concrete benefits: fewer duplicate tests because findings are available; safer prescribing because a medication list is visible; faster access because appointments can be booked and urgent cases assessed digitally; and better research because routine data can be analysed under clear rules. Germany's medical-technology sector, much of it made up of small and medium-sized firms, is also an economic stakeholder in a functioning digital infrastructure.
Whether these benefits materialise depends on adoption. A record that patients do not open and practices fill incompletely produces little value. That is why the GeDIG focuses on everyday usefulness — search, vaccination records, booking — rather than on new infrastructure.
Open questions
The issues below recur in German digital-health debates. They are presented as general questions, not as positions attributed to particular organisations unless stated.
The December 2024 demonstrations showed that a nationwide system concentrating sensitive data is an attractive target. Every new access route — apps, pharmacies, interfaces — must be secured to the same standard.
Opt-out models raise coverage but rely on people knowing that they can object. Information campaigns and easy objection procedures are part of their legitimacy.
Allowing insurers to add services, including AI-supported ones, to the ePA app may improve usability; it also raises questions about how insurers may use insights from these services.
Obligations for providers only work if software and connections function reliably; technical problems in practices were a recurring theme around the October 2025 deadline.
Researchers want broader, faster access; data-protection advocates warn of re-identification. The GDNG, the EHDS and the Medical Registers Act each strike this balance differently.