How secure is the electronic patient record (ePA)?

Strict security measuresn

“A high level of data security is a key feature of the electronic patient record,” explains Kevin Röthel, digital expert and team leader of the Telematics-eSolutions department at AOK Rheinland/Hamburg. “Access to patient data is strictly regulated and requires secure authentication, for example via the electronic health card or the new identity card and a PIN.”

Encryption and secure servers

The health data in the ePA is securely stored and encrypted on a dedicated network, the telematics infrastructure. This network connects various stakeholders in the healthcare sector, including doctors, hospitals and pharmacies, and enables the secure exchange of data.

ePA applications are being reviewed

“Unauthorised access must be prevented. The encryption of patient data therefore meets the highest standards whilst still enabling secure use in day-to-day healthcare practice,” says Claudia Plattner, President of the Federal Office for Information Security (BSI). Her agency helped to develop the guidelines against which all ePA apps are assessed. This is carried out by gematik, the national agency for digital medicine, which is responsible for the secure networking of the healthcare system in Germany.

Control over access permissions

Insured persons can specify which individuals are permitted to access which data in the ePA and for how long this access is valid. They can also set certain documents, such as diagnostic reports or doctors’ letters, so that only they themselves can view them. Prof. Ulrich Kelber, Federal Commissioner for Data Protection and Freedom of Information, recommends in an interview with AOK: “Every insured person should think carefully about which information may be shared with whom.” He adds: “All insured persons should therefore familiarise themselves with the access rights management for their data.”

If insured persons are unable or unwilling to use the ePA themselves, they may appoint a representative, such as a relative. Alternatively, access can also be arranged via the health insurance fund’s ombudsman service. The ombudsman service is an independent body that mediates and provides support in the event of disputes or queries.

No access to data for health insurance funds

The data in the ePA is accessible only to authorised parties – AOK Rheinland/Hamburg is not one of them. Whilst health insurance funds are responsible for providing the ‘ePA for all’, they do not have access to the data in the file. This is regulated by law and protects the data of insured persons. If you switch health insurance providers, the ePA is transferred to the new provider in encrypted form. No personal health data is exchanged in the process. You can object to the ePA at any time, even after the patient record has been introduced.

Would you like to find out more about the ePA? Find out more at ePA for all | AOK