Gematik Reviews Potential Actions Against Medisign Amid Card Exchange Delays

The German national agency for digital healthcare infrastructure, Gematik, is closely monitoring the activities of Medisign, a major provider of health professional and institutional cards, due to ongoing delays in the transition to new encryption standards. This shift, pivotal for the country's healthcare data security, requires the adoption of Elliptic Curve Cryptography (ECC) to replace the older RSA algorithm across multiple components of the telematics infrastructure.

All healthcare providers, pharmacies, and medical practices are mandated to update their electronic health professional cards (eHBA), institutional cards (SMC-B), and connectors to align with the new cryptographic requirements by the end of the year. The transition is considered urgent, as failure to implement the updated security measures could compromise the integrity of sensitive health data transmissions within the national system.

Reports from the field have highlighted significant delays and supply shortages affecting the distribution and activation of the required cards. These disruptions are especially concerning given the high number of cards and connectors that still need to be exchanged before the impending deadline. Gematik has urged all healthcare organizations and professionals to proactively consult with their IT providers to confirm whether their existing cards or connectors need to be replaced to meet the updated security criteria.

To ensure a seamless transition, Gematik is conducting comprehensive oversight of the card replacement process across all certified vendors. The agency has stated that it reserves the right to impose regulatory measures should any provider fail to meet their obligations or deliver on promised timelines. This intensified scrutiny follows a series of disruptions at Medisign, including a temporary halt in card production due to a manufacturing process change, which also rendered the application portal inaccessible for a period. These incidents have raised concerns within Gematik and among other stakeholders, prompting communication with the Federal Ministry of Health and associated partners about the risk of missed deadlines.

Gematik has initiated administrative hearings with Medisign to determine appropriate measures in response to the setbacks. Should there be credible indications that the card exchange cannot be completed on schedule, the agency has indicated its intention to take further action to safeguard the continuity and security of the telematics infrastructure. Gematik has also advised affected users to review their contractual and legal recourse, including potential claims for damages against service providers who do not fulfill their delivery commitments. Switching to alternative certified providers is being considered by some, though mounting demand is putting pressure on production capacities across the sector.

In response to the agency's concerns, Medisign has reported that it has resumed operations, with its new production line operational since late September. The company states that it has launched an expedited exchange program and is actively notifying up to 4,000 customers daily via email to initiate the replacement process. Medisign claims that nearly half of those contacted have already commenced the card exchange procedure. With extended shifts and a six-day workweek, the company estimates it can produce up to 2,640 eHBA cards daily, aiming to meet the national deadline despite previous setbacks.

The situation remains dynamic, with healthcare providers, pharmacies, and IT service companies working to ensure compliance with the updated cryptographic protocols in time to maintain secure and uninterrupted access to Germany's digital health infrastructure. Gematik continues to monitor developments closely, reaffirming its commitment to enforcing standards and protecting patient data within the evolving digital landscape.