Electronic Patient Record 2026: Setting Up the ePA App

The electronic patient record is a personal, digital drawer for your health documents: findings, doctors' letters, discharge letters from hospital, the dental bonus record and the list of redeemed e-prescriptions. The idea behind it is simple: anyone who changes practice today, goes into hospital or seeks a second opinion carries paper back and forth - or documents are simply missing. In the ePA they sit in one place, and you decide who may see them. Since January 2025 health insurers have created the record automatically unless you object; the nationwide rollout began at the end of April 2025 (Bundesministerium für Gesundheit).

The gematik figures for the first year show that the system has arrived in everyday care: around 73 million (gematik) records created, more than 100 million (gematik) documents stored and up to 93,000 (gematik) practices accessing their patients' records every week - in early October 2025 it was about 84,000 (gematik). The medication list is retrieved more than 21 million (gematik) times per week. Since 1 October 2025, use has been mandatory for practices and pharmacies (Bundesministerium für Gesundheit). What matters for you: that obligation applies to the practices - for you as an insured person the ePA remains voluntary.

This is exactly why setting it up pays off, even if you are sceptical about digitalisation in healthcare: the record exists anyway, and practices are filling it. Anyone who does not set up the app still has an ePA - but cannot see what is in it and cannot steer access in any detail. So the app is less an additional digital project than the key to a drawer that already belongs to you.

This is where most people dropped out in recent years - and for good reason. Because the record holds highly sensitive health data, your insurer has to be certain that it really is you operating the app. For a long time this ran via a PIN letter for the health card, which took weeks and often ended up unused in a drawer, or via a trip to a post office. For the first registration, the Federal Health Ministry names the electronic ID card with PIN or the health card with PIN (Bundesministerium für Gesundheit).

Since December 2025 the situation has been more relaxed: gematik has for the first time listed an identification procedure with confirmed technical security suitability in which you identify yourself with an electronic ID card or passport directly through the smartphone app (gematik). The procedure reads the NFC chip of your identity document and compares it with a capture from the phone camera. The practical effect: no PIN letter, no appointment at a branch, no waiting time. Whether your insurer already offers this procedure is shown in the app or can be checked by phone.

One note from practice: the online ID PIN of your identity card is not the same as the PIN of your health card - nor the one for your bank card. Anyone who has not yet used the ID card online often only has the five-digit transport PIN from the letter of the ID authority and has to change it once into a six-digit PIN of their own. That sounds fiddly, but it is exactly the point at which many people give up. We go through it with you during the home visit so that in the end you hold your own credentials - sorted much as we recommend when setting up a password manager.

Once the app is running, the part that turns the ePA into your record begins. By default, a practice in which you insert your health card receives access for 90 days (Bundesministerium für Gesundheit) - a span that covers a typical course of treatment. Pharmacies get three days (Bundesministerium für Gesundheit) after the card has been read. Both are only default settings: through the app you can shorten or extend the duration or exclude individual providers entirely. The Verbraucherzentrale describes the range as running from a single day to permanent access (Verbraucherzentrale).

A second, often overlooked point is the access log. In the app you see which provider viewed or uploaded something and when. That is the real gain in control: you do not have to trust anyone, you can simply look. Since 1 July 2026 this can be combined with push notifications - more on that shortly. Anyone who enjoys keeping digital access tidy will find the right setting for it in our privacy course at home.

For many families this is the most important function of all. You can name a representative - relatives, trusted people or legal representatives - who may help manage your record through their own app (Bundesministerium für Gesundheit). Your daughter then sees the discharge letter after a hospital stay, your son can set access rights, and you still keep control, because the representation can be withdrawn at any time.

In practice we often set this up as a pair: an older person and an adult child, both with their phone on the table. It takes a quarter of an hour and takes a lot of pressure out of the topic, because in an emergency someone can look along. If the relatives live further away, it also works with a delay - we prepare everything and the confirmation follows later. What that costs is stated transparently in our price overview.

Where millions of people are uncertain, fraudsters are quick to arrive. The Verbraucherzentrale warns about forged emails in the name of well-known health insurers that supposedly inform you about the ePA or offer a way to object, while luring you onto rebuilt websites (Verbraucherzentrale). A current example from the phishing radar works with a hard deadline: if the health card is not exchanged by 15 July 2026 (Verbraucherzentrale), it will supposedly be unusable from 1 August 2026 (Verbraucherzentrale). One of the sender addresses used had been registered abroad only days earlier (Verbraucherzentrale) - and had nothing to do with the insurer it named.

All of this can be managed alone. Many people still fail - not for lack of intelligence, but because of a chain of small hurdles: the insurer's app is called something other than expected, the PIN belongs to something else, NFC is off, the ID card lies on the screen instead of on the back. Each single hurdle is tiny, but together they are enough to make someone put the phone aside in frustration. That is why we come to your kitchen table and do it together: find and install the app, handle identification with your ID document, switch NFC on and practise the holding, set the access rights the way you want them, hide documents if you wish and set up representation for relatives.

As a rule this is done in a single appointment. We work on your own device, with your own credentials - you hand nothing over and keep all PINs yourself in the end. If you would like to go deeper, the privacy course at home fits, in which we calmly go through access rights, data economy and spotting false messages. Anyone who would like to feel more confident with their phone in general is right in the smartphone course - depending on the device as an Android course or an iPhone course at home.

We drive out into the Hildesheim and Leine valley region, for example for tech help in Hildesheim - one personal contact, no call centre, and we explain without jargon. There is no ePA that is the perfect solution for every case; what there is, is a record that you understand and steer yourself. If you are working on your technology anyway, two related topics from this week are worth a look: the switch from copper to fibre at home and the question of how to choose a smart door lock safely. And if you are unsure where to begin, send us a short message - we will sort it out together.