The ePA is the result of a years-long political process aimed at fundamentally modernising the German healthcare system. The driving vision: a digitally connected system in which medical information is available securely, quickly and completely wherever it is needed for your treatment. The legal foundations are anchored in §§ 341 ff. SGB V (German Social Code Book V) and the Digitale-Versorgung-Gesetz (DVG, German Digital Healthcare Act).

In a first phase from 2021 to 2024, the ePA was based purely on voluntary participation — the “opt-in” principle. As uptake was extremely low, the legislature reversed the principle: since 15 January 2025, the “opt-out” procedure applies, under which an ePA is created automatically for every person with statutory health insurance unless they have actively objected (BMG, 2025c). Legally, this silence is treated as informed consent. This is precisely the crux that data protection advocates and patient representatives strongly criticise: many people may not have understood the full implications of their insurers’ information letters. The result: millions of people have an ePA without consciously knowing it.

Since 1 October 2025, all healthcare providers have been legally obliged to use the ePA and store relevant treatment data (AOK-Bundesverband, 2025a). This obligation ceases as soon as you object as a patient. For highly sensitive data, providers are explicitly required to inform you of this right (§ 347 SGB V, German Social Code Book V).

The ePA is a dynamic system fed from three different sources:

• Your healthcare providers: Medical reports, doctors’ letters (especially hospital discharge letters), digital health documents such as your vaccination record or maternity record.
• Your health insurance fund — the often invisible, automatic data flow: Unless you object, your insurer automatically transfers billing data (ICD-10 diagnosis codes) and e-prescription data for the medication list into your ePA (gematik GmbH, 2025a). This data stream runs in the background — without you actively noticing.
• You yourself: The ePA is legally defined as a record “managed by the insured person”. You can upload your own documents at any time — scanned old doctors’ letters, a pain diary, information about an advance directive.

Despite all legitimate concerns, there are understandable arguments in favour of the ePA. Policymakers promise increased patient safety in emergencies, as vital information such as allergies or current medication is quickly available. Duplicate examinations can be avoided. And for the first time, you gain a complete overview of your own health history and can take an active part in the treatment process (BMG, 2025c).

For people without serious data protection concerns and without ongoing psychotherapy, the ePA can be a sensible instrument. The decision is yours.

At the end of 2024, the Chaos Computer Club demonstrated serious conceptual security flaws in the telematics infrastructure — including the theoretical possibility of mass access to third-party records (Kastl & Tschirsich, 2024). gematik responded with fixes. The fundamental problem remains: absolute security is an illusion. Once health data has been stolen, it cannot be “reset” — the damage is permanent.

By default, every practice you grant access to can view, for 90 days, all documents you have not actively hidden. An orthopaedist could theoretically read the discharge report from your psychosomatic clinic. The entire burden of control rests on your shoulders. Professional bodies such as the Bundespsychotherapeutenkammer (BPtK, Federal Chamber of Psychotherapists) sharply criticise this model because it contradicts the basic principle of data minimisation (BDP, 2024). As early as 2020, the Federal Commissioner for Data Protection (BfDI) warned of precisely this scenario.

The Gesundheitsdatennutzungsgesetz (GDNG, German Health Data Use Act) creates the basis for using ePA data in pseudonymised form for research from around 2026 onwards (BMG, 2025b). Here too, an opt-out applies. Critics warn of the risk of re-identification: with a combination of rare diseases, specific treatment histories and demographic data, it could theoretically be possible to trace records back to individual persons. It is a fundamental trade-off between the collective benefit for research and your individual right to informational self-determination.

The eGK (electronic health card) is the key to the ePA. If it falls into the wrong hands and is used in a card reader, someone could gain unauthorised access — precisely because the PIN is often waived in treatment contexts. The CCC experts showed that practice ID cards can be obtained fraudulently. The probability for any individual is low, but not zero. Practical advice: treat your eGK like a credit card, report any loss to your insurer immediately, and check the access log in the app from time to time (Netzpolitik, 2025).

Health data — especially psychotherapeutic data — is among the most personal information there is. If such data becomes known against your will, it can be detrimental to those affected. Think of professional contexts: if a company doctor were to see confidential mental health data, it could affect the employment relationship. Or in your private life: not everyone wants a co-treating doctor from their closer social circle to learn which diagnoses they have. To some extent, it is your responsibility to prevent this — by consciously hiding sensitive content. The former Federal Data Protection Commissioner Ulrich Kelber warned that lowered security standards could permanently damage citizens’ trust — and trust is the very precondition for the system to work at all (Netzpolitik, 2025).

The 90-day rule and how to master it: By default, a practice is granted access to your ePA for 90 days. Via the app or the ombuds office, you can shorten or extend this period individually for each practice, or revoke access at any time (KBV, 2025).

Hiding vs. deleting — the strategic difference:

• Hiding is the most flexible method: a hidden document remains stored in your ePA but is visible exclusively to you. For everyone else, it is as if it did not exist.
• Deleting is the definitive step: a deleted document is removed irrevocably. A practice is not obliged to upload a document you have deleted a second time.

The access log — your personal monitoring instrument: Every single access to your ePA is fully logged. In the app, you can see at any time which practice accessed which data and when (gematik GmbH, 2025b). If anything seems wrong, contact your health insurance fund immediately.