Healthcare Compliance in Germany

Germany is open to digital health businesses, but access to the national health data infrastructure (the Telematikinfrastruktur, or TI) is tightly gated. Telehealth, electronic prescriptions, the electronic patient record (ePA) and prescription apps all run on identity rules set in the Social Code Book V (SGB V) and specified by gematik, with the Federal Office for Information Security (BSI) and the Federal Data Protection Commissioner (BfDI) consulted on every security level.

The principal authorities are the Federal Ministry of Health, gematik, the BSI and the data protection authorities, with the doctors' chambers and the National Association of Statutory Health Insurance Physicians (KBV) setting the rules for medical practice. The biggest obstacle for a new entrant is assurance level: most patient-facing processes require identification at level "high", which consumer methods such as selfie checks or smartphone biometrics do not reach on their own.

1. Who regulates this sector

Telehealth platforms and app makers answer to their state's data protection authority; the BfDI covers statutory insurers.

2. Licensing and authorisation

There is no single telehealth licence. Authorisation is layered on the activity:

Doctors

Remote treatment is a matter of professional law. Under § 7(4) of the MBO-Ä, as adopted by the 130th German Medical Assembly on 13 May 2026, exclusive remote advice or treatment is permitted in individual cases where medically justifiable, with due care in findings, treatment and documentation, and the patient informed of its particular features. Each state chamber adopts the rule into its own code.

Video consultation services

For publicly insured patients, practices must use a video service certified against Anlage 31b of the BMV-Ä (agreed under § 365 SGB V) and notify their regional KV. Certification covers IT security and data protection (an art. 42 GDPR certificate), each issued by a body accredited under ISO/IEC 17065. Under Anlage 31c § 8(3), binding on contract doctors through § 95(3) SGB V, a doctor may not hold statutory video consultations while outside Germany.

Access to the TI

Using the TI without admission or confirmation under § 326 SGB V is an administrative offence (§ 397(2a) SGB V). Systems that transmit e-prescriptions or their access tokens outside the TI are prohibited by § 360(16) SGB V, with narrow exceptions, including apps that send tokens straight to a pharmacy at the BSI state of the art, after an application to gematik.

Digital health apps

To be reimbursed, a DiGA must be listed by the BfArM under § 139e SGB V. The BfArM states that, until accredited certification bodies exist, the data protection requirements of § 4 and Annex 1 of the DiGA Ordinance (DiGAV) continue to apply.

Advertising is regulated separately: § 9 of the Heilmittelwerbegesetz (HWG, Therapeutic Products Advertising Act) bans advertising remote treatment unless generally recognised professional standards do not require personal contact for that treatment.

3. Identity framework (AML rules do not apply)

The list of obliged entities in § 2(1) of the Geldwäschegesetz (GwG, Money Laundering Act) does not include doctors, hospitals, pharmacies, telehealth platforms or health apps. A healthcare business falls under the GwG only through another listed activity, such as trading in goods (§ 2(1) No. 16 GwG). There is therefore no customer due diligence, beneficial ownership or suspicious activity reporting duty attached to treating patients.

Identity is governed by a different framework, built around access to sensitive health data rather than financial crime:

• SGB V, Telematik provisions. § 291 (health insurance card, eGK, and the digital health identity), § 336 (the patient's own access to TI applications and the identification that must precede it) and § 217f(4b) (a GKV-Spitzenverband directive on protecting insured persons' data in contacts with insurers, including secure identification, drawn up with the BfDI and the BSI).
• gematik specifications. gematik sets the security and interoperability requirements for digital identities on the basis of the BSI's technical guidelines, in agreement with the BSI and the BfDI (§ 291(8) SGB V), and confirms which identification procedures may be used.
• Collective agreements for doctors. Anlage 4b of the BMV-Ä sets how a doctor authenticates a patient treated exclusively remotely.
• Professional law. The MBO-Ä and the state codes set the duty of care for remote treatment.

The governing test is the assurance level: under § 291(8) SGB V the security level of a digital identity must at least match the protection need of the application it is used for.

4. Identity verification and onboarding

Patients: getting into the ePA and e-prescription apps

A patient may access their data with the eGK or the GesundheitsID only after one of the routes in § 336(4) SGB V: the card or its PIN was delivered personally by a secure procedure, handed over at an insurer's office, or the patient was later identified securely. Where the GesundheitsID or a card-less method is used, § 336(5) requires a one-time secure identification that guarantees a high security standard. The BMG states that the first login to an insurer's ePA app requires the ID card's online function with PIN or the eGK with PIN; the PIN itself is sent after identification with an ID card or passport at a branch or by PostIdent.

• National eID. Since 1 November 2023 insurers must offer the electronic proof of identity of the German ID card, the EU citizen eID card or the electronic residence permit as a secure identification route (§ 291(3) SGB V).
• Document chip reading. With the patient's consent, insurers may read and use ID document data, including from a foreign ID or passport that satisfies the German identification obligation (§ 291(7) and (8) SGB V).
• Pharmacies. The identification needed for an access procedure may also be carried out in a pharmacy (§ 336(1) and (2) SGB V).
• Video identification. Only procedures gematik has confirmed: on 1 December 2025 gematik confirmed "Nect ePass" (biometrics plus electronic reading of the ID card or passport) at its "gematik-ehealth-loa-high" level for setting up the GesundheitsID, restricted to the stand-alone app.

Doctors treating patients remotely

For video consultations with publicly insured patients, Anlage 4b of the BMV-Ä (last amended 4 September 2024, in force 1 October 2024) requires the doctor to check identity against the eGK shown by video, record the insurance data and have the patient confirm cover orally. An electronic substitute certificate from the insurer may be used instead, and the check is not needed for a patient already checked in the current or previous quarter. The agreement labels this a transitional rule. gematik plans to extend its Proof of Patient Presence (PoPP) service to telemedicine from the end of 2026, including smartphone use of the eGK and the GesundheitsID as remote proof of insurance.

Health professionals

The eHBA, which doctors use to sign e-prescriptions and access the TI, is issued only after identification with an official photo ID. The Bundesärztekammer states that all approved trust service providers offer identification by PostIdent and by the ID card's online function, making fully online application possible.

5. Digital channels: what's different

Bottom line: in person, a patient is identified by handing over the eGK; online, every route into health data must first pass a one-time identification at level "high", and only procedures gematik has specified or confirmed qualify.

Smartphone biometrics sit below "high"

§ 336(2) SGB V lets a patient, after full information, consent to an authentication method at "another appropriate security level"; gematik's specifications allow this through device biometrics for later logins. The BfDI's 34th activity report (6 May 2026) records BSI findings that smartphone biometrics reach at best "substantial" and mostly only "normal", so insurers must keep a "high" access route available and let patients switch back.

Prescriptions after a video consultation

The KBV states that sick notes can be issued by video for up to three days for unknown patients and seven days for known patients, and that medicines may be prescribed to unknown patients only exceptionally, with no narcotics. A government bill [Bill, not enacted] to amend the Medical Cannabis Act would allow cannabis flowers to be prescribed only after personal contact in the practice or on a home visit.

The EU digital identity wallet

The GeDIG bill [Bill, not enacted] would require insurers to offer the European Digital Identity Wallet as a secure identification route from 1 January 2027 where technically possible, accept it as proof of insurance from 1 December 2028 and for authentication by 1 December 2030 at the latest. The Digital Identities Act (DIdG), which implements the wallet nationally, passed the Bundestag on 15 October 2026 and needs Bundesrat consent [Bill, not enacted].

6. Data protection and biometrics

Health data and biometric data used to identify a person are special categories under article 9 of the General Data Protection Regulation (GDPR). § 22(1) No. 1(b) of the Bundesdatenschutzgesetz (BDSG, Federal Data Protection Act) permits processing for diagnosis, care or treatment by staff bound by professional secrecy, with appropriate safeguards under § 22(2). Doctors' secrecy is backed by criminal law (§ 203 StGB); § 203(3) allows disclosure to service providers who assist in the professional activity only as far as necessary, which is the basis for outsourcing identity checks.

For biometric identification outside a statutory basis, the Datenschutzkonferenz position paper on biometric analysis (version 1.0, 3 April 2019, adopted against the votes of Bavaria and Baden-Württemberg) treats the processing as prohibited in principle unless an article 9(2) exception applies, typically explicit consent that refers expressly to the biometric data. Insurers reading ID document data for the GesundheitsID rely on the patient's consent under § 291(8) SGB V.

Video consultations carry their own rules under Anlage 31b BMV-Ä (version of 5 August 2026): the doctor obtains consent meeting article 9(2)(a) GDPR, the provider may neither view nor store consultation content, connection metadata must be deleted within three months, and personal data may be processed only in Germany, the EU, an equivalent state or a country with an adequacy decision. Recording requires consent.

Retention differs by record: treatment records are kept for ten years (§ 630f(3) BGB); e-prescription and dispensing data must be deleted 100 days after dispensing (§ 360(11) SGB V); and every ePA access is logged with a time stamp that the patient can view, according to the BMG.

7. Sector-specific obligations

Electronic patient record (opt-out)

Insurers must create an ePA for every insured person who does not object, and since 1 October 2025 all providers must use it. Patients may object to the ePA, to individual providers' access and to individual documents; patients aged 15 or over may exercise objection rights themselves. Practices get access for 90 days by default and pharmacies for three days after the eGK is inserted, according to the BMG.

Electronic prescriptions

Since 1 January 2022 contract doctors must prescribe prescription-only medicines electronically through the TI (§ 360(2) SGB V), since extended to DiGA, narcotics and home nursing, with remedies, medical aids and sociotherapy following in 2027. Patients choose between a paper token and electronic delivery (§ 360(9)).

Digital identity for insured persons

Insurers must provide a GesundheitsID on request (§ 291(8) SGB V) and let authorised third parties, such as providers of TI-connected applications, use it to authenticate insured persons with their consent. From 1 January 2027 the GesundheitsID serves in the same way as the eGK for authentication and as proof of insurance.

8. Risk indicators and red flags

Identity and access abuse in digital health

• Video-ident weaknesses: gematik suspended video identification for TI identities in 2022 after a security vulnerability was disclosed.
• Injected video: deepfakes or replayed streams fed directly into a remote proofing system, the threat the BSI addresses in its 2026 draft evaluation guidance.
• Card sharing: an eGK shown to a camera by someone other than its holder; the card is personal and not transferable (§ 291(4) SGB V).
• Downgraded access: accounts moved from "high" to biometric login without the patient's informed consent.
• Prescription mills: online prescribing without any personal medical contact, cited by the BMG for medical cannabis.
• Single-purpose appointments: video slots offered only to obtain a sick note, which the KBV states is not permitted.
• Token routing outside the TI: services collecting e-prescription tokens and steering them to selected pharmacies, prohibited by § 360(16) SGB V.

9. Enforcement and penalties

Unauthorised disclosure of patient secrets is a criminal offence under § 203 StGB. On 9 August 2022 gematik declared video identification impermissible for issuing TI identification means and ordered insurers to suspend it immediately, leaving in-person and eID routes untouched. On 9 December 2021 the Bundesgerichtshof (I ZR 146/20) held that advertising "diagnosis, therapy recommendation and sick note by app" through doctors based abroad breached § 9 HWG, because "generally recognised professional standards" are measured against German medical standards, not the treating doctor's own professional law.

10. Recent changes and what to watch

• 26 March 2027 and 2029: European Health Data Space Regulation (EU) 2025/327 applies from 26 March 2027 [Adopted, phased application]; patients' access rights apply to the first priority data categories from 26 March 2029.
• 1 January 2027: GesundheitsID usable as proof of insurance (§ 291(8) SGB V) [Adopted, effective 1 Jan 2027]; the KBV billing code for authenticating unknown video patients (GOP 01444) runs until 31 December 2026.
• 14 October 2026: Bundestag health committee hearing on the GeDIG (BT-Drs. 21/8279) [Bill, not enacted]. Adds the EU wallet to health identification, simplifies eGK and GesundheitsID use and prepares the ePA for the European Health Data Space.
• 30 September 2026: BSI consultation on evaluation guidance for injection attack detection in video-based remote identity proofing closed [Draft guidance]. Expect certification testing for remote proofing to tighten.
• 1 July 2026: Apothekenversorgung-Weiterentwicklungsgesetz promulgated (BGBl. 2026 I Nr. 195) [Partly in force]; most provisions apply from 2 July 2026, others from 1 October 2026, 1 January 2027 or a date still to be announced. Pharmacists now store data on pharmaceutical services and certain dispensed medicines in the ePA unless the patient objects (§ 346(2) SGB V).
• 18 December 2025: first Bundestag reading of the Medical Cannabis Act amendment [Bill, not enacted]; in-person contact before prescribing cannabis flowers and an end to mail-order supply.
• 1 December 2025: gematik confirmed the Nect ePass video procedure for GesundheitsID set-up [In force], the first video route back into TI identity since the 2022 ban.

11. What this means for identity verification

• Design to level "high" first. Any flow that leads to ePA, e-prescription or GesundheitsID access needs a one-time identification at level high; eID and eGK with PIN are the statutory default.
• NFC is the core remote method. Reading the chip of the German ID card, eID card, residence permit or a foreign passport is expressly permitted with consent; image-only document checks are not a listed route.
• Video identification needs gematik confirmation. Only a confirmed procedure can be used for TI identities, and the current confirmation excludes integration into third-party apps.
• Biometrics are a convenience layer. Face or fingerprint login after onboarding requires informed consent to a lower level and a way back to "high".
• Outside the TI, risk-based. Private telehealth and app services not using the TI set their own level, but must justify biometric processing under article 9 GDPR and respect § 9 HWG and MBO-Ä § 7(4).
• Plan for 2027. The GesundheitsID as proof of insurance and the national EUDI wallet launch on 2 January 2027 (BMDS) will change how patients present identity at the practice and online.