German Data Protection Commissioner Urges Genuine Patient Choice as ePA Research Data Use Begins

Key Takeaways

• The BfDI has issued recommendations, based on a survey of 1,500 insured persons, urging the German Federal Government to strengthen transparency and granular user controls in the electronic patient file (ePA).
• From the end of October 2026, pseudonymized medication list data can be extracted for research unless insured persons object.
• Compliance teams at organizations handling German health data should treat this as a signal of regulatory expectations on consent, control, and transparency.

Deep Dive

The BfDI has issued recommendations, based on a survey of 1,500 insured persons, urging the German Federal Government to strengthen transparency and granular user controls in the electronic patient file (ePA). From the end of October 2026, pseudonymized medication list data can be extracted for research unless insured persons object. Compliance teams at organizations handling German health data should treat this as a signal of regulatory expectations on consent, control, and transparency.

The key operational development is the timeline. From the end of October 2026, pseudonymized data from the ePA medication list can be extracted for research purposes under an opt-out model, meaning insured persons must actively object to prevent use. The survey data shows why this matters: 83 percent want detailed control over data access, 55 percent of those objecting cite data protection and security concerns, and more than four in ten respondents do not fully understand the ePA's features. About 5.85 million insured persons are actively using the ePA, per gematik, and more than two-thirds of respondents would share data with physicians and researchers. Together, these figures point to a risk of objections, complaints, and reputational harm if transparency is weak.

For compliance professionals, the practical implications fall mainly on health insurers, healthcare providers, digital health vendors, research institutions, and any financial institution with health data exposure, such as insurers or benefits administrators. Recommended actions include:
- Review opt-out and objection handling processes for effectiveness and speed.
- Assess whether pseudonymization controls meet GDPR standards, including re-identification risk.
- Update privacy notices and user communications to plain language.
- Confirm that granular access controls are available and usable.
- Document the legal basis and data protection impact assessments for any secondary use of ePA data.
- Monitor German legislative developments on automated health data analysis.

Risk implications are moderate and mostly forward-looking. Health data is a special category under GDPR, so deficiencies in transparency, consent, or security could trigger supervisory scrutiny, complaints, and sanctions. Weak user controls could also depress participation and undermine research objectives. Organizations that proactively demonstrate user control and clear communication will be better positioned if the BfDI's recommendations become formal requirements or enforcement priorities.

Source: Federal Commissioner for Data Protection and Freedom of Information