Interview on e-patient files: Health data election tool against discrimination

The electronic patient record (EPR) will soon be available automatically for all those who do not object. The data from the electronic patient record is an important prerequisite for research projects of the Federal Ministry of Health, at least 300 of which are to be implemented by 2026. Among other things, the data from the electronic patient file is planned for this purpose. The Medical Research Act was passed this week to implement a pharmaceutical strategy aimed at bringing pharmaceutical investments back to Germany. There are particular concerns about the independence of the Federal Ethics Commission listed in the law, which is to be based at the Federal Institute for Drugs and Medical Devices (BfArM).

According to Federal Health Minister Karl Lauterbach, health data is very important in order to make Germany a "heavyweight in research" again. From mid-2025, the data should therefore flow to the Health Research Data Center, which is also located at the BfArM. Critics fear that this will compromise medical confidentiality, particularly in the case of rare diseases. Lauterbach explained that the ePA was specially designed so that all diagnoses that confirm HIV positivity can be hidden. However, this is not possible for medication information, which must be contradicted completely. It is important that doctors see the entire medication list. Insured persons can also prohibit individual doctors from accessing the ePA, as they would not be aware of this.

Take care of data

As a further precaution, doctors are encouraged to ask whether stigmatizing illnesses should be visible in the ePA. Recently, there has been criticism from the German AIDS Service Organization, among others, as patients have to take action to hide confidential information in their EPR. For example, an HIV infection could appear in the findings, in the medication overview and in the billing data. We spoke to Manuel Hofmann from Deutsche Aidshilfe about why these measures are not enough.

heise online: Deutsche Aidshilfe has taken a critical stance on the ePA. Why is that?

Manuel Hofmann: We are committed to ensuring that people can decide on their own health data and thus protect themselves from discrimination. As Deutsche Aidshilfe, we represent various particularly vulnerable patient groups. Discrimination in the healthcare sector is a reality that many people are confronted with every day.

There is no doubt that the healthcare system needs a well-designed digital infrastructure. Digitalization then has the potential to improve care and simplify processes. But when technology is poorly designed, it fuels discrimination. We are therefore committed to taking the risk of discrimination seriously in all technical developments and minimizing it on this basis.

The planned "ePA for all" does not currently meet this requirement. One example: Discrimination against people with HIV occurs frequently in dental practices. If someone does not want their HIV infection to become known in the dental practice, they must first individually conceal all relevant documents. Then they would also have to hide the medication list and health insurance billing data, as these areas of the electronic health record also contain sensitive information. This is not obvious to patients at first.

There is therefore a lack of convenient functions for maximum, manageable self-determination, for example the option of a simple instruction such as "I don't want my dentist to know about my HIV infection". Many other patients would also benefit from this, as health data is always sensitive, illnesses can be shameful and the list of diagnoses that can lead to stigmatization is long.

What role does the "opt-out" issue play in your view?

The switch to opt-out is intended to accelerate digitalization in the healthcare sector. However, when it comes to care and the transfer of research data, it shows that the interests of self-determined and active individuals were not at the center of the considerations during development. An ePA that can be used in key areas without their active involvement contradicts the self-determination approach in healthcare.

It is important to us that people can make well-informed decisions about whether and how they want to use the EPR and whether they want to make their data available for research purposes. The opt-out is regulated by a number of rights of objection. Our digitale handout on the "ePA for all" lists nine different ones: from objecting to the creation of the ePA, to deleting and hiding individual documents, to sharing research data.

Good information helps to provide patients with decision-making support and empower them in their work with the electronic health record. However, self-determination in the handling of health data must be simple and intuitive.

In your opinion, the topic of self-determination is not given enough consideration in the electronic health record. What needs to change in this respect?

First of all, the previously available "confidentiality levels" must also be transferred to the ePA for everyone. Currently, only the visibility levels "for all" or "hidden" are provided. However, patients cannot selectively make health information visible, for example only to their GP practice because they trust it, but not to the orthopaedic practice that they only visit once after a sports injury. It's all or nothing.

Even large social networks such as Facebook or Instagram have for years allowed you to share content either with everyone, selected people or "just for yourself" - and they are neither at the forefront of data protection, nor are they perceived as particularly complicated to use.

Patients would be helped if they could specify that new documents are automatically sorted as "only visible to themselves" or "only visible to selected doctors" in the standard system. This would then also have to include the medication lists and billing data mentioned above.

In the future, a kind of "Wahl-O-Mat for health data" would make sense. Guided by a few, comprehensible questions, patients could determine how their health data should be handled in each case: in everyday care, in emergencies and in research. Once defined, the technical implementation could take place in the background and would no longer be the tedious task of the patient.

What do you think the EPR should do? What would you like to see?

Many patients would definitely like to have all their important health data in one digital place. They are fed up with lugging x-rays around pedestrian zones and running from doctor to doctor with paper files - I can relate to this from my own experience.

However, there is currently a mismatch between the promises that are already associated with the "ePA for all" and the real benefits that can be expected for patients. We have to remain realistic: Social problems cannot be solved purely by technology. At the same time, there is undoubtedly potential in the ePA.

With a view to further development, I would therefore like to see a more constructive mode of cooperation. For example, by allowing more voices from digital civil society and patient organizations to have a say. Justified suggestions for improvement from the patient perspective must not be brushed aside as supposed hesitation. After all, they would make the ePA better in the long term and thus also increase social acceptance.

(mack)