In short and in plain language
The ePA is a digital record for health data. Everyone with public health insurance can have one. If you do not want it, you can say no.
The care service may also look into the record. Only the nurses who care for the person may do this. Every look into the record is written down.
Relatives can help. They may run the record for a person if that person wants it. You can also say: this care service should not look into the record.
A care service can explain all this on its website. Then relatives know the answers before the first talk.
We write and build this page for your care service.
Since 1 July 2025 (Section 341(8) SGB V), home care services and care homes in Germany have had to meet every requirement for accessing the electronic patient record, the ePA. For relatives, this raises questions that usually come up in the first consultation or on the phone: What can the care service see in my mother's record? Who adds entries? How long does access last, and how do I object if I do not want it? The answers are in Book V of the German Social Code (SGB V), spread across many sections. An explainer page on the care service's website can turn them into plain sentences, state openly how far the service has got with the connection and build trust before the first home visit. This article sets out the access rights of care staff as the law words them, shows the routes to objecting and describes the building blocks such a guide page needs.
Key takeaways
- Home care services and care homes had to meet every requirement for ePA access by 1 July 2025 (Section 341(8) SGB V). About half of all care facilities are now connected to the telematics infrastructure (gematik, TI-Atlas 2026).
- Registered nurses may read findings, the medication plan, emergency data, doctors' letters and care data where care requires it (Section 352 SGB V). They cannot see the insurer's billing data, and access lasts 90 days by default (Section 342 SGB V).
- Care services can add the medication plan, emergency data and care data to the ePA, tell the patient beforehand and record any objection (Section 349(2) SGB V). If the insured person asks, they must upload data from ongoing care.
- To shut out a single care service, people object in the ePA app or with their health insurer's ombudsperson office (Section 353(2) SGB V). Objecting to the whole record deletes it with all its data (Section 344(3) SGB V).
- Up to five representatives, such as relatives, can manage the ePA (gematik). An explainer page on the care website states where the service stands and answers questions on access, entries and objections before the first consultation.
Since July 2025: care facilities and the ePA
Under the law, the electronic patient record (ePA) is a record managed by the insured person, which the statutory health insurers provide to their members. Using it is voluntary for the insured (Section 341(1) SGB V). Since 15 January 2025 (Section 342(1) SGB V), everyone with statutory health insurance has received an ePA unless they objected within six weeks (Section 344(1) SGB V) of being informed by their insurer. The nationwide rollout to practices, hospitals and pharmacies began on 29 April 2025 (Federal Ministry of Health). Since 1 October 2025 (Federal Ministry of Health), they have been required to use the ePA.
Care has its own deadline. Home care services and care homes under Book XI had until 1 July 2025 (Section 341(8) SGB V) to meet every requirement for ePA access and for connecting to the telematics infrastructure. The telematics infrastructure (TI) is the secured network through which practices, hospitals, pharmacies and care facilities exchange health data. The deadline requires the service to be technically ready. The law does not impose on care the duty to fill every record that applies to doctors' practices (Section 347 SGB V). More on that below.
The people asking are usually relatives. In December 2023, just under 5.7 million people in Germany were in need of long-term care (Federal Statistical Office). Almost nine in ten, or 86 percent (Federal Statistical Office), were cared for at home. 3.1 million (Federal Statistical Office) received only the care allowance and were looked after mainly by relatives, while another 1.1 million (Federal Statistical Office) were cared for together with, or entirely by, home care and support services. 800,000 (Federal Statistical Office) lived in care homes with full inpatient care. Behind many of these arrangements is a daughter, a son or a partner who sorts out paperwork, coordinates appointments and now also wants to know what happens to the patient record.
The record itself is now widely known: 80 percent of the population know the ePA, according to the survey of insured people in the TI-Atlas 2026 (gematik). Among care facilities, the picture is more mixed. About half (gematik, TI-Atlas 2026) are now connected to the TI. Relatives can therefore easily get two different answers from two services: one is connected and works with the record, the other is not yet. An explainer page that states the service's own status openly takes this uncertainty out of the conversation.
Being ready does not mean filling every record
What the care service may see in the ePA
Section 352 SGB V lists exhaustively who may access the data in the ePA: it says that "only the following persons" may do so. For care, three professional groups are named: general nurses and paediatric nurses, geriatric nurses, and registered nurses under the generalist qualification, in each case where they are involved in the insured person's care (Section 352 sentence 1 nos. 9 to 11 SGB V). They may read, store and use data under Section 341(2) nos. 1 to 11 SGB V where this is necessary for care. Data arising from nursing care they may also process, which includes creating it themselves.
What lies behind these numbers is tangible for relatives: findings, diagnoses and treatment reports, the electronic medication plan, emergency data, doctors' letters, the dental bonus booklet, the child health booklet, the maternity record and vaccination records, health data the insured person has added themselves, notes on organ donation declarations, lasting powers of attorney or advance directives, data from digital health applications, data on nursing care and prescription data from e-prescriptions (Section 341(2) SGB V). Expressly excluded are the data held by the health insurer on services used, in other words the billing data (Section 352 sentence 3 SGB V).
For the question "May the care assistant look as well?" there is a clear rule. Care assistants with a training course regulated under state law lasting at least one year (Section 352 sentence 1 no. 12 SGB V) may access the record within the registered nurse's authorisation, where this is necessary for their work and happens under a registered nurse's supervision. Support workers, housekeeping and administrative staff are not on the list. Anyone without an electronic health professional card needs authorisation from a person who has one. The system records who accessed the record and who authorised it (Section 339(5) SGB V).
| Person in the care service | Access to the ePA | Legal basis |
|---|---|---|
| Registered nurse (generalist qualification) | read and add care data where necessary for care | Section 352 sentence 1 no. 11 SGB V |
| Geriatric nurse | read and add care data where necessary | Section 352 sentence 1 no. 10 SGB V |
| General or paediatric nurse | read and add care data where necessary | Section 352 sentence 1 no. 9 SGB V |
| Care assistant with at least one year of training | within a registered nurse's authorisation, only under supervision | Section 352 sentence 1 no. 12 SGB V |
| Support worker, housekeeping, administration | no access of their own, not named in the list | Section 352 sentence 1 SGB V |
Access is tied to care. Registered nurses may access the record in a timely connection with treatment unless the insured person has objected. That connection is shown by the electronic health card or the insured person's digital identity (Section 339(1) SGB V). From that moment, the length of access is preset: 90 days (Section 342(2) no. 1(l) SGB V) by default for doctors' practices and care, among others, and three days (Section 342(2) no. 1(l) SGB V) for pharmacies. The insured person can set the length themselves in the app, with a minimum of one day (Section 342(2) no. 1(m) SGB V) and an unlimited option. For a service that supports someone over years, this belongs on the explainer page: once the authorisation lapses, it takes a new check with the health card or a longer authorisation in the app.
It must be logged electronically and verifiably who accessed the data and which data were accessed.
The insured can view these logs in the app (Section 342(2) no. 1(n) SGB V). People who do not use the app can request them from their health insurer's ombudsperson office (Section 342a(5) SGB V). For relatives, this is a strong argument that rarely appears on explainer pages: every look into the record leaves a trace that the family can check.
Who adds entries to the ePA and who deletes them
Filling the record is regulated with different degrees of strictness. Doctors' practices must upload data from current treatment, such as lab results, findings reports and electronic doctors' letters (Section 347 SGB V). Hospitals must upload discharge letters, among other things (Section 348(3) SGB V). For registered nurses, Section 349(2) SGB V sets out an option: they can add data from the specific current care, including the electronic medication plan, emergency data, data on nursing care and prescription data. Interest is high: 76 percent of care homes expect the electronic medication plan to make information more complete and up to date (gematik, TI-Atlas 2026).
Duties come with this that relatives should know about. The service must tell the insured person which data are to be transferred to the ePA. If they object, the service records this in its documentation (Section 349(2) SGB V). Before adding data whose disclosure could lead to discrimination or stigma, such as on mental illness, it must expressly point out the right to object (Section 347(1) SGB V, applied to care through Section 349(2) SGB V). And if the insured person asks, the service must upload data from ongoing care, provided it processes them electronically and the person has consented to the transfer (Section 349(3) SGB V).
What is in the record does not have to stay there. The insured may delete data themselves and restrict access to data; at their request, those with access must also delete data (Section 337(2) SGB V). Individual documents can be set in the app so that only the insured person can process them (Section 342(2) no. 1(v) SGB V). Before deleting, the app points out that access can also just be restricted and explains the consequences (Section 342(2) no. 1(q) SGB V). On the explainer page, one paragraph with a reference to the health insurer is enough. Explaining how to use the app is the insurer's job, not the care service's.
- Doctor's practice: must upload data from current treatment, such as findings reports and doctors' letters (Section 347 SGB V).
- Hospital: must upload discharge letters, among other things (Section 348(3) SGB V).
- Care service: can add the medication plan, emergency data, care data and prescription data and informs the patient first (Section 349(2) SGB V).
- Care service on request: must upload data from ongoing care with consent (Section 349(3) SGB V).
- Insured person and their representative: can hide documents, delete them or demand their deletion (Section 337(2) SGB V).
Objecting: keep the levels apart
When it comes to objecting, it pays to separate the levels, because the law knows several. Anyone who mixes them up may object to the entire record when all they wanted was to exclude one service. The overview below can go onto the explainer page almost unchanged.
| Objection to | Where | Consequence | Legal basis |
|---|---|---|---|
| the entire ePA | with the health insurer or in the app, at any time | the record and all data are deleted; a new record can be requested later, the old data do not come back | Section 344(3) and (5) SGB V |
| access by one particular care service | in the app or with the insurer's ombudsperson office | this service can no longer open the record until the objection is withdrawn | Section 353(2), Section 342a(3) SGB V |
| a single planned entry | in conversation with the care service | the entry is not made, the service records the objection | Section 349(2) SGB V |
| the digitally supported medication process | in the app or with the ombudsperson office | the data of this use case are deleted, except data transferred automatically from telematics infrastructure services | Section 353(1), Section 342(2) no. 1(s) SGB V |
For people without a smartphone, the ombudsperson office is the way in. Every statutory health insurer sets one up. It advises on all questions about the ePA, accepts objections against individual persons with access and enforces them technically (Section 342a SGB V). An objection against a single service applies until it is withdrawn (Section 353(2) SGB V). gematik expressly points out that people can turn to the ombudsperson office if they do not want an institution to have any access at all.
For the explainer page, this means the table answers the question of how, and the text below it the question of why. Name the ombudsperson office, but leave out phone numbers of individual insurers, which can change. A sentence such as "You will find your health insurer's ombudsperson office on its website or in your insurance documents" stays correct even when an insurer redesigns its pages.
Objecting is not cancelling
Relatives as representatives in the ePA
Many people in need of care do not use apps. For them, the law provides for representatives whom the insured person chooses themselves (Section 342(2) no. 1(p) SGB V). Up to five (gematik) representatives can be named in the ePA. To set this up, the two meet once in person, and the person being represented identifies themselves with an authentication method. They do not need a smartphone of their own as long as the representative has one. What a representative can take on is set out in Section 342(2) no. 1 SGB V:
- grant access to treating professionals and care services (letter c).
- set how long authorisations last, from one day to unlimited (letters f and m).
- object to individual persons with access, such as one particular service (letter h).
- object to the health insurer, for example to the record as a whole (letter g).
- view log data, in other words check who accessed the record and when (letter n).
- set documents so that only the insured person can process them (letter v).
Anyone holding a lasting power of attorney or appointed as a legal guardian can have the health card or its PIN sent to them if the power of attorney or the certificate of appointment is on file with the health insurer (Section 336(4) no. 4 SGB V). For families with children in intensive home care: the rights of the insured, including the right to object, can be exercised by the young person themselves from the age of 15 (Section 341(1) SGB V). Before that, the legal representative, usually the parents, declares any objection (Federal Ministry of Health).
One question relatives often ask late: what happens after death? The health insurer deletes the ePA twelve months (Section 344(6) SGB V) after it learns of the death. This does not apply if third parties assert and prove legitimate interests. On an explainer page, a short paragraph is enough, with a note to clear up questions about documents with the health insurer early.
The explainer page on the care website
Questions about the ePA arrive where the service is explaining things anyway: in the first consultation, on the phone, at the admission visit. A dedicated page on the care website answers these questions in advance and gives the care manager an address to point to. It fits into the area where guide pages already sit, such as the one on discharge from hospital or on the electronic service record, which also runs over the telematics infrastructure.
Where our service stands
Whether and since when the service has been connected to the telematics infrastructure and from when it uses the ePA in care, with the date of the last update.
What we see
The data types from Section 341(2) SGB V in everyday language, the note that access depends on need and that the insurer's billing data are not included.
What we add
Which data the service adds from care, such as the medication plan or care data, and that it tells the patient beforehand.
How long we have access
The preset 90 days (Section 342 SGB V), how the health card triggers access and how the family changes the length in the app.
Objections and ombudsperson
The levels of objection as a small table, with a pointer to the health insurer's ombudsperson office for people without the app.
Relatives as representatives
How relatives manage the ePA as representatives, what a lasting power of attorney means here and where the health insurer can help.
Tone decides how the page works. It explains; it neither promotes the ePA nor advises against it. Using it is voluntary for the insured (Section 341(1) SGB V), and the page may say exactly that. Short sentences, technical terms explained on first use, a summary in plain language and an accessible build help people who sit with reading glasses at their daughter's tablet.
At the core is a question block with the questions people actually ask. It can be marked up as structured data, which also makes it readable for search engines as questions and answers. Your own service supplies the questions: for a few weeks, note what relatives ask about the ePA on the phone and use their wording. It is usually closer to what people later type into a search than any technical term.
No health data in the contact form
What the page should not do
An explainer page builds trust as long as it sticks to what the service is responsible for. These limits keep it clean:
- No access to the record: the care service's website does not open any ePA and does not ask for an insurance number. Access runs through the health insurer's app.
- No legal advice: the page reflects the legal rules and refers individual cases to the health insurer and the ombudsperson office.
- No security promises: assurances about security do not belong on the page. What can be described factually is that every access is logged (Section 339(3) SGB V).
- No deadline without a citation: dates and deadlines appear only with the section number, and the page carries a visible review date.
- No campaigning for or against the ePA: the decision rests with the insured person.
The rules keep developing. The law provides for more content, such as the patient summary and lab results as structured information objects once the conditions are in place (Section 342(2a) no. 2 SGB V), and allows further information objects to be added by statutory order (Section 342(2b) SGB V). An explainer page therefore needs a review date and someone who updates it after legal changes. If you do not want to do this yourself, include it in your website maintenance. How to adapt guide pages during reforms is covered in the article on the draft care reform.
Step by step to the ePA page
- Clarify where you stand: the care manager and IT record whether the service is connected to the TI, which staff hold an electronic health professional card and from when the ePA is used day to day.
- Collect questions: for a few weeks, note what relatives ask about the ePA in the first consultation and on the phone.
- Align answers with the law: check every answer against the wording of Sections 335, 339, 341, 342, 344, 349, 352 and 353 SGB V and add the citation.
- Build the page: open with where the service stands, then seeing, adding, duration, objection and representation, and finish with the question block and a contact route without health data.
- Link it: make the page reachable from the admission process, from the service pages for home care or residential care and from the privacy policy.
- Maintain it: a review date sits visibly on the page. It is checked after every legal change and after changes in your own service.
For a care service, the ePA page is not a legal requirement but a building block for trust. It shows relatives that the service knows the rules, says openly where it stands and leaves the decision with the family. We write and build explainer pages like this as part of your care website, hosted in Germany and with privacy building blocks for care websites. Get in touch if relatives are already asking you about the ePA.
Related Articles
After hospital discharge: the advice page for relatives
Hospital discharge: how care services build an advice page with the seven-day rule, a checklist for discharge day and a short call-back route for families.
WhatsApp in Care? Safer Through Your Website
WhatsApp is a data protection risk for communicating with relatives in care. How a GDPR-compliant channel on your own website safely replaces the messenger.
Whistleblower protection in home care: the online channel
Internal reporting office from 50 employees: how a care website carries the reporting route with its own page, a confidential form, deadlines and privacy notes.