Health ministry · Data governance
Health data: who may use them, for what, and with whose consent?
Germany holds some of the richest health data in Europe and has used them sparingly. A national law of 2024, a research data centre opened in 2025 and a European regulation that applies from 26 March 2027 are changing that — the year in the background marks that European deadline.
01 / Context
Primary use and secondary use
Health data have two lives. In primary use they serve the treatment of the person they describe: a medication list read by a pharmacist, a discharge letter sent to a GP. In secondary use they are reused, usually in pseudonymised or anonymised form, for research, quality assurance, public-health planning and the development of new products. The digital health page covers primary use; this page covers secondary use and its governance.
Secondary use is where the promise and the anxiety are greatest. Large datasets from routine care can show whether a medicine works as well outside clinical trials, where regional gaps in care exist, or how a condition develops over decades. The same data are among the most sensitive that exist. Germany’s constitutional tradition of informational self-determination, its sixteen Länder data-protection authorities and a long-standing scepticism towards central databases have made the country cautious.
Three instruments now define the field: the national Health Data Use Act (GDNG), the Research Data Centre Health at the Federal Institute for Drugs and Medical Devices (BfArM), and the EU’s European Health Data Space (EHDS). A fourth, the Medical Registers Act, is before the Bundestag.
Carsten Linnemann, minister since 29 July 2026, inherited all four. In the Health Committee on 23 September 2026 he named the Medical Registers Act among the bills he wants passed and described its purpose as making register data usable for research (hib 733/2026). He has not, so far, set out a broader data strategy of his own.
How data travel from care to research
A simplified model of the German route under the GDNG. Identifying details are separated from content before data reach researchers, and only results leave the secure environment.
From routine care to research results
SourceSimplified from the Federal Ministry of Health (opening of the research data centre, 9 Oct 2025), the GDNG and Regulation (EU) 2025/327. Not every data source is connected yet: ePA data were expected from October 2026; cancer-register data are planned.
Four instruments, four statuses
All four were decided or drafted before Linnemann took office. None of them is his initiative; his choices concern their pace and implementation.
- Inherited
- Under review
- Proposed
- In implementation
- In force
Health Data Use Act (GDNG)
The GDNG made the purpose of a research project, rather than the type of institution applying, the test for access to data at the research data centre — so that companies can apply if the purpose serves public-interest research, while market research is excluded. It created a data access and coordination body at the BfArM, allowed pseudonymised ePA data to flow to research unless the patient objects, introduced a penalised duty of research secrecy against re-identification, and designated a lead data-protection authority for research projects spanning several Länder. Inherited from the Lauterbach period.
Research Data Centre Health (FDZ)
Opened on 9 October 2025 by Nina Warken. Holds pseudonymised billing data of all statutory insured people for 2009–2023: diagnoses, treatments, prescriptions and hospital stays. Research bodies, university hospitals, authorities, insurers, companies and patient organisations may apply. Analyses take place in controlled environments; only results reviewed by staff leave; approved projects are listed in a public register. ePA data were expected from October 2026.
Medical Registers Act
Draft of 27 October 2025; adopted by the cabinet on 11 March 2026; first readings in the Bundesrat (8 May) and Bundestag (21 May); hearing on 10 June 2026. Second and third readings are pending. It would create a Centre for Medical Registers at the BfArM, a public directory of registers, a voluntary qualification procedure with data-protection and security requirements, and legal grounds for linking data across registers and other sources. Linnemann listed it among his bills on 23 September 2026.
European Health Data Space — Regulation (EU) 2025/327
Published in the Official Journal on 5 March 2025 and in force since 26 March 2025. It applies in general from 26 March 2027, with key obligations phased in later — including the cross-border exchange of priority data categories and the secondary-use framework, whose main provisions follow in 2029 and 2031. Each member state must designate health data access bodies. The pending GeDIG bill implements parts of the EHDS in German law (see digital health).
GeDIG data provisions
The bill debated on 8 October 2026 would let the research data centre contact individual providers about patterns in treatment without identifying patients, allow insurers to test data-processing projects in “real laboratories”, and establish a central coordination point at the BfArM for data access.
Registers explained
Why registers need their own law
Germany has many medical registers but few common rules for them. The Medical Registers Act tries to change that without centralising the registers themselves.
What is a medical register?
A register systematically collects data on people with a particular condition, treatment or implant over time — for example to see how long an artificial joint lasts or how a rare disease progresses. Unlike a clinical trial, it observes routine care. Registers are run by Länder authorities, medical societies, university hospitals or federal bodies.
Which registers already have a legal basis?
Some do. Clinical cancer registries in the Länder have a statutory basis since the cancer early-detection and registry law of 2013, and data are pooled nationally at the Robert Koch Institute. Federal laws created a transplant register (2016) and an implant register (2019). Many other registers — including those run by medical societies for quality assurance — rely on patient consent and differing interpretations of data-protection law across the Länder.
What would the new law change?
The cabinet draft of March 2026 would set up a Centre for Medical Registers at the BfArM, publish a directory of registers, and offer a voluntary qualification procedure with requirements for data protection, data security and scientific quality. Qualified registers would gain clearer legal grounds for processing data and for linking their data with other registers and sources — which researchers describe as essential for many questions of quality and safety. Inherited · in the Bundestag
What are the concerns?
The recurring questions in the debate on register linkage are how far linkage should go without explicit consent, how re-identification risks are controlled when several datasets about the same person are combined, and how much administrative effort a qualification procedure imposes on smaller registers. The Bundestag held a hearing with experts on 10 June 2026; the second and third readings are pending. The individual submissions are listed in the Bundestag and lobby-register records.
What has Linnemann said?
In the Health Committee on 23 September 2026 he listed the Medical Registers Act among the bills he is pursuing and described its purpose as making data usable for research (hib 733/2026). He has not commented publicly on the specific points of controversy.
What a patient can decide
Rights under the GDNG, the ePA rules and the GDPR, simplified. Specific rights depend on the data source.
Object
People can object to the transfer of their ePA data for research. They can also object to the ePA as a whole. Billing data held by insurers are transferred by law in pseudonymised form; there is no individual objection route for this dataset.
Know
Approved projects at the research data centre are published in a register, stating who uses the data and for what purpose. The GDPR gives rights of information and access to personal data.
Be protected
Researchers who attempt to re-identify individuals commit an offence under the GDNG’s research-secrecy rules. Data are analysed in secure environments and only aggregated results are released.
Open questionThe EHDS gives citizens a right to opt out of secondary use, with limited exceptions. How the German objection routes for different data sources will be aligned with the European opt-out by 2029 is not yet settled in law.
Usefulness versus protection
The central argument in German health-data policy, presented without a verdict.
The case for wider use
- Routine-care data can show effects that small clinical trials miss, including rare side-effects and real-world benefit.
- Registers for implants, cancer or rare diseases support quality and safety only if they can be linked and analysed.
- Germany risks depending on research done with other countries’ data if access remains slow.
- Prevention and planning — for example the regional distribution of care — need population-wide evidence.
The case for caution
- Pseudonymised data can sometimes be re-identified, especially when sources are linked.
- Purpose-based access opens data to commercial applicants; critics want stricter public-interest tests.
- Objection rights mean little if people do not know they exist or cannot use the apps.
- Centralisation creates attractive targets for cyber-attacks.
Both sides agree on one thing: trust is a precondition. If people object in large numbers, the datasets lose the completeness that makes them valuable.
06 / Interoperability
Common language before common use
Data that cannot be compared cannot be used. German care still runs on many software systems that describe the same facts in different ways. National bodies specify standard content (for example, structured medication data in the ePA), and the EHDS will require a European exchange format for priority data categories. University hospitals have built common data structures through the federally funded Medical Informatics Initiative.
The open question for the ministry is enforcement: how quickly vendors must adopt standards, who pays for conversion in small practices, and whether the GeDIG’s stronger role for gematik extends to data standards as well as infrastructure. Linnemann has not addressed these details publicly; the ministry’s line is the inherited one.
Sources & further reading
- Federal Ministry of Health — Health Data Use Act (GDNG)
- Federal Ministry of Health — Research Data Centre Health opened (9 Oct 2025)
- Pharmazeutische Zeitung — 53 applications for data use (20 Feb 2026)
- AOK — Legislative tracker: Medizinregistergesetz
- EUR-Lex — Regulation (EU) 2025/327 on the European Health Data Space
- Federal Ministry of Health — Cabinet adopts GeDIG (15 Jul 2026)
- German Bundestag — First reading of the GeDIG (8 Oct 2026)
- German Bundestag — hib 733/2026, Linnemann in the Health Committee (23 Sep 2026)