The elec­tronic medical record: what you need to know

Who is the provider and operator of the electronic medical record?

The electronic medical record for TK insurees is operated by IBM Deutschland GmbH on behalf of TK. We, the TK, provide the record.

What is the legal basis for providing the electronic medical record?

TK allows its insurees to record, store and manage medically relevant information on their: 

• health
• medical conditions
• lifestyle habits

on a secure digital platform. This platform is the electronic medical record and can be accessed at any time. The legal basis for providing this service is Section 342 SGB V [German Social Code Book V].

How are the data in my electronic medical record protected?

The electronic medical record is a cloud-based document storage system (central file system) in a secure medical network, the telematics infrastructure (TI). All the documents are encrypted and decrypted in a file system in a trusted execution environment (TEE). This ensures end-to-end encryption from the insuree's device and the practice to the TEE. Neither we as the TK nor our technical service provider (IBM) can access the contents of the file.

Who is responsible for data processing in the electronic medical record?

As the provider of the record, we, the TK, are responsible for data processing. If other companies are involved in the operation of this record, they do so on our behalf.

Where are the electronic medical record data stored?

The servers on which the electronic medical record data are stored are located in Europe. They are subject to the European data protection regulations.

Are all data within the electronic medical record encrypted?

Yes, all the content is encrypted. No one other than you and those you have authorised can read what is stored there. For example, you can grant authorisation to a doctor's practice by inserting your eHealth card into their reader.

How long are institutions authorised to view my electronic medical record?

If your eHealth card is read at a doctor's practice or hospital, they have access to the record for the next 90 days. Pharmacies, the public health service and occupational health professionals are authorised to access your electronic medical record for 3 days. If you do not want this, please inform the staff there. They will then not be allowed to access your file.

With TK-Safe in the TK-App, you can extend or shorten these authorisations.

How is it ensured that my data in the electronic medical record stays within the EU?

We selected IBM Deutschland GmbH as part of a Europe-wide tender process. IBM is contractually obliged to save the data on servers located in Europe. The servers of parent companies outside the EU, EEA and EFTA may not be accessed.

What are the storage and deletion periods for the electronic medical record?

None. The data on your personal record belong to you and can be stored for the rest of your life. In contrast, there are clear storage and deletion periods for the processing of social data. This depends on the specific purpose. Amongst other things, this includes billing for the utilised services. Depending on the type of service, the deletion periods can be between 4 to 10 years.

Can I object to the use of the electronic medical record at a later date?

Yes. The electronic medical record is voluntary and you can have it deleted at any time. Information on how to do this can be found below.

What happens to the data in my electronic medical record if I change my health insurance provider? 

The electronic medical record is valid for life. As such, you can take it with you if you change health insurers. All content is transferred automatically.

What is a "Forschungsdatenspende" [research data donation]?

With a research data donation, insurees can have their data in their record pseudonymised and made available for research purposes. This service is voluntary and you can object to it at any time. Simply get in touch with us. You can only reject the donation of research data if an ePA has been created for you. The research data donation service will be available as of 15 July 2025.

How do I grant a practice access to my electronic medical record?

You have different options for granting and withdrawing your authorisation:

1. Authorise or object to a practice in TK-Safe
2. Authorise a practice for 90 days with your eHealth card in the practice's card reader
3. Authorise or object to a practice with the help of the "Ombudsstelle" [Ombudman's office] (see below)

How can I manage my authorisations in TK-Safe?

With TK-Safe you can manage your authorisations individually. Search for, add, delete or object to practices in TK-Safe via the buttons "Netzwerk" [network] > "Gesundheitspartner" [health partners].

Does the doctor's practice just have read-only rights in the electronic medical record?

There is no read-only authorisation in the electronic medical record. If a doctor has access to the record, they can download the documents. In addition, new documents can always be saved in the record.

Why can doctors delete my documents?

To allow you to manage your electronic medical record without TK-Safe, medical professionals can delete individual documents at your explicit request. This requires a trusting relationship between you and your doctors.

Can institutions download documents from my electronic medical record?

Yes. Your doctor, a hospital and others can download a document from your electronic medical record. This document is then also stored in the practice's or hospital's system. Do they need it for diagnostics or for recommending therapies? Then the doctor also saves the document as confirmation in the practice's administration system. If you subsequently delete the document in your electronic medical record, a copy of your data will remain with the doctor or in the hospital.

How do I share the documents in my electronic medical record with the doctor's practice?

Do you wish to give your doctor, pharmacy or clinic documents? Then they need to be granted access to your electronic medical record. You automatically grant access when your eHealth card is read out by the practice's reader.

Which documents must the doctor's practice store in my electronic medical record?

There are a range of data that doctors and psychotherapists must enter in the electronic medical record in future. The prerequisite for this is that the data were created during your current treatment and are available electronically. 

Doctors have to enter the following data in an unstructured form, for example as a PDF:

• Data on laboratory findings
• Reports from diagnostic imaging, e.g., MRI images
• Reports on findings from invasive and surgical as well as non-invasive and conservative measures
• Electronic doctors' letters

As of mid-2025 the entry of further data in structured form will become necessary:

• Data to support the medication process
• Data from the electronic medication plan
• Data for drug safety testing
• Data on declarations of organ and tissue donation
• Data on instructions and the storage location of advance directives and patient powers of attorney

Can I view the data and documents in my electronic medical record?

Yes, with TK-Safe in the TK-App you can view all the data stored in your electronic medical record. You can also save additional documents or delete existing ones. With the usage history in the settings of your TK-Safe profile, you can also see what has been done by whom and when in your record.

Can I also use the electronic medical record without a computer or smartphone?

The electronic medical record works without you having to take any action. Authorised practices, pharmacies and clinics can exchange documents with each other. You grant authorisation automatically when your eHealth card is read.

What is the "Ombudsstelle" [Ombudsman's office]?

The Ombudman's office allows our insurees to address us in confidence in matters relating to the electronic medical record. You can make use of the following services via the Ombudsman's office:

1. The management of access authorisations
2. The acceptance of objections and revocations
3. The importing of documents into the electronic medical record
4. The creation of log data

Can I upload documents to my electronic medical record without using the app?

Please call us to arrange for your analogue documents to be stored in your electronic medical record.

Can I represent other people in the electronic medical record or have myself represented?

You can authorise up to 5 people you trust to represent you in the electronic medical record. This means that adult children, for example, can manage their parents' records. However, there does not have to be a family relationship.

I already use the electronic medical record, what do I have to do now?

You can continue to use your medical record. To ensure that your data are retained, you must log in once in 2025.

How can I access my electronic medical record using my PC, Mac or Linux?

The desktop client for accessing the electronic medical record will be available from mid 2025. You will provide further details on accessing your record via the desktop client as soon as this is available.