German Government Declares Electronic Patient Record Safe

The German government has officially deemed the Electronic Patient Record (EPA) secure, following a series of security concerns raised during its initial testing phase, which commenced in mid-January. The Left Party took the opportunity to question the government regarding the safety measures surrounding this digital health initiative.

Concerns had arisen when the Chaos Computer Club (CCC) revealed potential security flaws, compounded by a data protection incident involving the trust service provider D-Trust. In response, the Left Party sought a comprehensive overview of the security protocols in place for the EPA.

In its response, the government outlined several measures undertaken since the identification of the security vulnerabilities. These included tightening regulations on the issuance and blocking of electronic health cards (eGK) as well as improvements in the management of insured persons' data. Furthermore, enhanced monitoring and anomaly detection systems are being implemented.

The Federal Ministry of Health (BMG) and Gematik are reportedly in close collaboration with the Federal Office for Information Security (BSI) to ensure the integrity of the system. The government also acknowledged that Gematik had been aware of a theoretical vulnerability in the EPA since August 2024, a concern raised by external cybersecurity researchers. However, this issue was classified as low-risk and primarily affected the secure issuance and use of institutional access credentials.

Looking ahead, the government confirmed that there are no remaining obstacles to the controlled rollout in designated model regions or the nationwide implementation of the EPA. The government has reassured stakeholders that the EPA will be safely accessible to medical practices, hospitals, pharmacies, and patients alike.

Plans are in place for a nationwide rollout scheduled for the beginning of the second quarter of 2025, following a testing phase that was initially expected to last about four weeks. This announcement comes as the government aims to alleviate public concerns regarding the digital health initiative.

In related news, the Gematik has recently announced additional security measures aimed at enhancing the safety of the EPA. These measures come in light of the security issues associated with the D-Trust incident, which reportedly affected over 2,000 pharmacists.

Additionally, Friedrich Merz, the leader of the CDU party, has suggested that users of the EPA should be financially incentivized, proposing a reduction in health insurance contributions for those who utilize the system. This suggestion has sparked debate, particularly among members of the SPD, who argue that such a move could result in significant financial implications for the statutory health insurance system.