Any AI is only as good as the data it is trained and tested on. In medicine, this is particularly sensitive information: diagnoses, laboratory values, images, medications. In recent years, Germany and the European Union have created the legal and technical foundations to make such data more usable – with safeguards and rights to object.
The electronic patient record (ePA)
Since 2025, people with statutory health insurance in Germany automatically receive an electronic patient record (elektronische Patientenakte, ePA) unless they object (“opt-out”). Practices, hospitals and pharmacies upload findings, doctors’ letters and the medication list, among other things. Since October 2025, its use has been mandatory for doctors. Active use by insured people is growing slowly: in a Civey survey commissioned by Pharma Deutschland in April 2026, 23.6 per cent of respondents said they actively use their ePA – almost twice as many as a year earlier.
For patient care, the ePA is mainly intended to avoid duplicate examinations and to make dangerous drug interactions identifiable. For AI research, it is of interest because it collects structured data from routine care.
The Health Data Use Act (GDNG)
The Gesundheitsdatennutzungsgesetz (GDNG), which came into force in 2024, regulates how health data may be used for research and the further development of healthcare. The central body is the Health Research Data Centre (Forschungsdatenzentrum Gesundheit) at the Federal Institute for Drugs and Medical Devices (BfArM). Data is pseudonymised there and made available only for approved purposes in a secure environment. What matters is the purpose, not who is asking: companies can also submit applications if the project serves the public good. Insured people can object to their ePA data being passed on for research purposes.
The European Health Data Space (EHDS)
Regulation (EU) 2025/327, in force since 26 March 2025, establishes the European Health Data Space. It has two aims:
- Primary use: citizens should be able to access their health data throughout the EU and share it with doctors in other Member States – for example a patient summary or e-prescriptions while on holiday.
- Secondary use: pseudonymised or anonymised data should be usable via national access bodies for research, innovation, policy-making and the training of AI. Advertising and decisions to the detriment of individuals, for example in insurance, are expressly excluded.
The obligations take effect gradually, mostly from 2027 into the early 2030s. The EHDS also provides for a right to object to secondary use.
Why good data matters so much for AI
- Representativeness: if an AI has been trained mainly on data from one population group, it may perform worse for others – for example women, older people or people with darker skin types.
- Quality: incomplete or inconsistently recorded data leads to flawed models.
- Validation: independent datasets are needed to test whether an AI is reliable outside the environment in which it was developed.
Data protection and trust
Under the GDPR, health data is one of the special categories of personal data. Pseudonymisation reduces the risk but does not rule out re-identification in every case – especially for rare diseases. The new rules therefore rely on secure processing environments in which researchers may take away only results, not the raw data. How well this works in practice will be decisive for acceptance.
What insured people can do
- Use their health insurance fund’s ePA app to see which documents are stored and to manage access.
- If necessary, object to individual documents, access by certain practices or the use of data for research – via the app or the insurance fund’s ombudsperson office.
- Weigh up the options: those who release data for research can help make medicine and AI better and fairer; an objection is possible at any time.
Conclusion
Without good health data, there is no good medical AI. Europe is attempting to strike a new balance between data use and data protection. Whether this succeeds depends on secure technology, transparency and the trust of the people whose data is used.
More on this topic: The AI Act and medicine.
Note: This article provides general information and does not constitute legal advice. As of: October 2026.
Sources
- Verordnung (EU) 2025/327 über den europäischen Gesundheitsdatenraum
- Heuking: EU-Verordnung über den Europäischen Gesundheitsdatenraum (EHDS) veröffentlicht (March 2025)
- Pharmazeutische Zeitung: Jeder Vierte nutzt ePA aktiv (April 2026)
- Bundesministerium für Gesundheit: Die elektronische Patientenakte (ePA)
- BfArM: Forschungsdatenzentrum Gesundheit
Leave a Reply