A Bigger Record, By Default
On July 15, 2026, gematik — the state-owned operator of Germany's digital health infrastructure — began piloting expansion stage "ePA 3.1.3" of the elektronische Patientenakte (ePA), the electronic patient record every statutory health insurance holder has been enrolled in by default since January 15, 2025 unless they filed an objection (gematik). The pilot, running in Hamburg, Franconia, and parts of North Rhine-Westphalia, adds an electronic medication plan (eMP) that links e-prescriptions, medication lists, and dosing instructions into one continuously updated view, reaching roughly 36% of insured people — those on three or more prescribed medications — with a nationwide rollout planned for autumn 2026 (ad-hoc-news.de).
The medication plan is, on its own terms, a genuinely useful feature. Polypharmacy — patients juggling several prescriptions from different doctors — is a well-documented source of dangerous drug interactions, and a record that shows every prescriber the same up-to-date medication list addresses a real clinical safety gap. Germany's health ministry frames the broader ePA in similar terms: encrypted storage on domestic servers within the telematics infrastructure, end-to-end encrypted communication, and a record that insurers themselves cannot read (Bundesgesundheitsministerium). Since October 1, 2025, doctors, hospitals, and pharmacies have been legally required to use the system, which is what makes cross-provider visibility possible at all.
Steelmanning the Case for Opt-Out
The strongest argument for the opt-out design, rather than opt-in, is structural: Germany tried an opt-in health record for over a decade under the previous elektronische Gesundheitsakte framework, and adoption stalled in the single digits because almost nobody proactively signs up for infrastructure they don't yet need. An emergency-room record is only useful if it exists before the emergency. Public health systems from Denmark to Estonia have made the same trade — defaulting citizens into shared health data infrastructure precisely because affirmative consent produces coverage too sparse to be clinically useful. Germany's Federal Ministry of Health has been explicit that the ePA "remains voluntary" in the sense that objection is always available and reversible (BMG; BfDI) — this is opt-out with an exit, not a closed system.
Where the Design Still Falls Short
But an exit that almost nobody uses is functionally different from meaningful consent, and the data on actual engagement is not reassuring. A forsa survey commissioned by the consumer-rights federation vzbv (fieldwork November 3–7, 2025; n=1,037 statutory insured) found that while 94% of respondents were aware they now had an ePA, 71% of those aware were not actively managing it — reviewing its contents, restricting document categories, or exercising the fine-grained controls the system nominally offers — and only 9% had filed an objection or deleted their record (datensicherheit.de). That is the predictable result of default-on infrastructure: the record fills with data, including now a live medication history, largely on autopilot.
Germany's data protection body, the BfDI, has been the clearest institutional voice underscoring that objection rights exist for a reason — insured people can object to the ePA's creation entirely under §342 SGB V, or to specific sensitive categories under §344 SGB V, at their insurer, via an ombudsman, or through the ePA app itself (BfDI). netzpolitik.org's reporting on the opt-out transition raised a sharper technical point: pseudonymized health data intended for research use can often be re-identified from just a few auxiliary data points — age, postal code, or a child's birthdate — undercutting the assumption that pseudonymization alone protects privacy once records scale nationally (netzpolitik.org). The same reporting noted the opt-out conversion itself cost insurers roughly €114 million annually, plus €5 million a year to maintain the objection pathway — a nontrivial administrative bet that most people would rather not have to make an active choice.
The Real Policy Question Isn't the Medication Plan
The eMP pilot itself is sound engineering aimed at a real safety problem, and Germany deserves credit for building interoperable rather than siloed provider systems. The concern is compounding: every expansion stage — medication plans now, AI-assisted findings processing and full-text search planned for 2027 — adds to a record that most enrollees are not actively curating, on infrastructure whose research-data-sharing function (pseudonymized data forwarded to a federal research data center by default, per BfDI guidance) itself requires a separate objection people mostly don't know to file. Proportionate regulation here doesn't mean scrapping opt-out; it means gematik and the health ministry owe insured people an active, periodic notification — not a buried settings menu — before each new data category goes live by default. A record this useful is worth building. It's only worth building on consent that people have actually exercised, not consent inferred from silence.