Extension Granted for Electronic Health Professional ID Deadline Amid Service Provider Issues

The deadline for German healthcare professionals to transition to the new ECC-enabled electronic health professional cards (eHBA) has been postponed, following production and distribution challenges among service providers. Physicians and pharmacists now have until mid-2026 to acquire the updated version 2.1 of the eHBA, ensuring continued access to essential digital health services.

This deadline extension comes after concerns that thousands of medical practitioners could have faced operational disruptions due to delays in card issuance. The updated eHBA is crucial for secure digital signatures, a requirement for processing electronic prescriptions and other digital health records. Alongside the eHBA, the new institutional cards (SMC-Bs) are also subject to the revised timeline, preventing potential interruptions in patient care workflows.

Despite the extended deadline for eHBA and SMC-Bs, the Gematik agency has emphasized that connectors relying solely on the older RSA encryption standard must be replaced by the end of this year. Failure to do so would compromise the security of the health telematics infrastructure, which forms the backbone of Germany's digital health data exchange. While RSA-based card terminals can continue to operate until the end of 2026, the shift to Elliptic Curve Cryptography (ECC) is seen as an important step toward stronger security, although ECC is not considered resistant to future quantum computing threats.

The decision to extend the deadline follows urgent appeals from medical associations, who cited significant obstacles in card production and distribution. Service providers such as Medisign and D-Trust have encountered bottlenecks, leading to delays and complications for healthcare professionals attempting to obtain the new cards. Some doctors have reported receiving incorrect cards due to shipping errors, requiring them to return the misdelivered items at their own expense to prevent unauthorized use.

D-Trust has confirmed isolated incidents where cards were sent to the wrong recipients, attributing the mix-up to a disruption during the production and labeling process. The company assured that these cards could not be activated without the associated PIN, which is dispatched separately, and that affected cards were immediately blocked upon discovery. They are working to prevent similar issues in the future and have informed the relevant health authorities of the incidents.

Pharmacies have also experienced difficulties during the transition, particularly those using the CGM Lauer pharmacy management system. After connector upgrades, some pharmacies faced additional administrative steps to process electronic prescriptions, with each modified prescription requiring an individual digital signature. CGM has acknowledged sporadic technical problems related to batch signatures, noting that most affected customers have since received support and solutions, and that recent updates to the installation process have addressed these challenges.

As healthcare digitalization advances, the transition to updated security standards and infrastructure remains essential for the integrity of Germany's health IT systems. The extension offers practitioners and institutions more time to adapt without jeopardizing patient care, but underscores the importance of reliable service delivery and robust technical support from certified providers.