Concerns Raised Over Electronic Patient File Rollout

The rollout of the electronic patient file (EPA) began recently, transitioning into a phase where its use will become mandatory by October. This initiative, championed by outgoing Federal Health Minister Karl Lauterbach, aims to enhance the digitalization of healthcare in Germany.

Despite its potential benefits, the Chaos Computer Club (CCC) has expressed significant concerns regarding the premature launch of the EPA. The group underscores unresolved security vulnerabilities that were highlighted through simulated attacks conducted last year. Although Lauterbach asserted that comprehensive security measures have been implemented in collaboration with the Federal Office for Information Security (BSI), the CCC remains skeptical.

Bianca Kastl, a representative of the CCC, criticized the updates made to address these security weaknesses, stating they are insufficient to cover the identified flaws in the system's security architecture. She emphasized that the attacks on the EPA remain feasible with minimal effort, labeling the decision to proceed with the rollout as rushed.

Kastl articulated that a secure launch would have required an independent assessment of the security risks, transparent communication of these risks to affected parties, and an open development process throughout the project's lifecycle. Currently, she notes, none of these prerequisites are being met.

While Lauterbach indicated at a recent health digitalization expo that mass attacks on the EPA are now no longer possible, Kastl countered that risks to individual patient files persist. She referred to earlier admissions by Lauterbach regarding the impossibility of guaranteeing 100% security for individual files, acknowledging that daily security issues arise in medical practices.

The disparities in safety requirements for digital healthcare solutions highlight an ongoing challenge. As the new Minister of Health, Nina Warken, prepares to take office, the CCC's expectations for improvements in the security process for digital solutions remain muted. Kastl noted that similar demands were made to both Lauterbach and his predecessor, Jens Spahn, without any significant progress.

As the EPA is integrated into the healthcare system, the focus will likely continue to be on addressing these critical security concerns to ensure patient safety and trust in digital health solutions.