German Data Protection Commissioner Weighs in on Healthcare Digital Innovation Law

Key Takeaways

• The Federal Commissioner for Data Protection and Freedom of Information (BfDI) issued a statement on Germany's draft law implementing EU Regulation (EU) 2025/327 (EHDS Regulation) for healthcare data and digital innovation.
• The statement generally endorses the government's draft while providing detailed technical feedback on proposed amendments concerning access logging, document-level access controls in electronic patient records, research data linkability, and consent-based data processing authorization requirements.
• Healthcare organizations and health insurers operating in Germany should monitor this legislation closely as it will materially affect data governance obligations under both national law (SGB V, GDNG-E) and the EHDS framework.

Deep Dive

This statement reflects the BfDI's formal input ahead of a parliamentary hearing on Germany's draft law for data and digital innovation in healthcare (GDNG), which serves as the national implementation vehicle for the EU's EHDS Regulation (EU 2025/327). For compliance teams at financial institutions with healthcare-adjacent business lines (e.g., health insurance, digital health platforms, or health data processors), this signals that Germany's regulatory data protection authority views the draft law as a largely sound basis for EHDS implementation, while flagging specific technical and legal refinements needed before final adoption.

Key substantive points include: (1) support for person-specific (rather than role-based) access logging to electronic health record (EHR) applications under §307/§309 SGB V, with the BfDI reiterating its long-standing position that such traceability should be implemented well ahead of the EU-mandated 2030 deadline — the amendment proposes January 1, 2028; (2) endorsement of more granular, document-level access shading in the electronic patient record (ePA) under §342 SGB V, aligning with EHDS access management requirements (Art. 105(a) and Art. 14) that formally apply from March 26, 2029, but which the BfDI recommends adopting early to give insurers, ePA system operators, and gematik sufficient implementation lead time; (3) technical commentary on the cross-sectoral research code under §3(2) GDNG-E, where the BfDI views a proposed amendment as a clarifying but largely redundant change, while flagging an internal cross-reference error needing correction; and (4) clarifications on §24 and §25 GDNG-E regarding further processing of care data and authorization requirements where informed consent exists, which the BfDI views as already adequately addressed in the government's draft.

From a compliance and risk perspective, this is a precursor regulatory development rather than a finalized binding rule — organizations should treat it as an early signal of forthcoming data governance requirements rather than an immediate compliance obligation. However, firms with EU/German healthcare data processing operations should begin scenario planning around person-level access logging capabilities, granular document-level permissioning in ePA systems, and research data linkability documentation, given the BfDI's clear preference for accelerated timelines ahead of the formal 2028–2029 EHDS deadlines.

Recommended actions include: tracking the finalization of the GDNG draft law and subsequent SGB V amendments; engaging with German health data governance stakeholders (gematik, statutory health insurers) on access logging and ePA shading technical specifications; reviewing internal data processing agreements and consent frameworks against §24/§25 GDNG-E requirements; and preparing for potential acceleration of EHDS-related technical and organizational measures beyond the regulation's formal applicability dates. Risk exposure is currently moderate (legislative/reputational rather than enforcement-driven), but will escalate as the law moves toward enactment and as EHDS compliance deadlines approach.

Source: Federal Commissioner for Data Protection and Freedom of Information