Help for using the ePA app

Setting up a patient file with the smartphone

1. Download the app
   To set up a self-fillable ePA, users of a mobile device must first download the app “Meine BKK W&F ePA” from the stores of Google and Apple.
2. Registration
   – Click on “Let’s go” to create your user account: You will need your insurance number, the last 6 digits of the identification number (on the back of your health card) and your zip code
   – Accept data protection information and consent to the user account
   – Verify your e-mail address: You will receive an email with an activation link that you must confirm
   – Set app code: Assign a freely selectable 6-digit app code and confirm it. Your device is now activated.
3. Identification
   You have the following options for secure identification by creating a digital identity (“health ID”):
   – Health card (NFC-eGK + PIN)
   – ID card (online ID = eID + PIN via Nect)
   – POSTIDENT (at a post office):
   – Activation code (handed out at our branches, we identify you on the basis of your ID card and health card)
4. Register
   You can choose between these registration methods:
   1. with app code: maximum convenience and high security. If you use the app code, you will be asked to confirm your identity every 6 months (device binding)
   2. with health card (NFC-eGK + PIN): maximum security. To log in, you need the corresponding PIN
   3. with electronic ID card (online ID card): maximum security. To log in, you also need the corresponding PIN here
5. Only when using the app code: Create device binding
   To use the app code, a device binding must also be created; all of the above-mentioned identification methods are available to you for this purpose. The device binding is required the first time you use the app code to confirm your identity and must be updated every 6 months.
6. Set up ePA
   After clicking on “Set up patient file”, accept the consent and terms of use. Then decide on a registration procedure in the patient file:
   – Activation without a health card (convenience access):
   Simply use the slider to accept access without your health card. Note: The variant with a health card offers greater access protection.
   – Activation with health card:
   Enter your PIN and access number and hold your eGK to the back of your NFC-enabled smartphone. You will then receive an e-mail with an activation link. The device is activated.

Authorizations

You can control the authorizations in your ePA to determine who can access data in your ePA. Authorizations are limited in time and apply to categories of documents. Patient documents are documents that you have uploaded to your ePA yourself. Doctor documents are documents that doctors, medical professionals and other authorized persons have uploaded to your ePA. The authorization list shows all authorized persons who currently have access to documents in your ePA. The list shows which category of documents can be accessed in each case. You also have the option of saving your authorizations in list form as a PDF on your device.

Management of authorizations for practices and other service providers?

You can grant, change or withdraw authorizations at any time. You simply grant the authorization in the practice: you insert your electronic health card (eHC) into the reader. The practice can then access your ePA for a period of up to 90 days.

Substitute regulation

You can use the deputy regulation to authorize third parties to manage the EPA on your behalf. You can also be appointed as a representative for an EPA yourself – e.g. for your children or older family members.

You can add and delete a maximum of 5 representatives yourself. Substitutes have the same rights as the ePA user in document and authorization management.

Requirements for the representative:

• E-mail account
• Smartphone or tablet
• Registration with your statutory health insurance provider for your own ePA

A representative does not have to have their own ePA, but registration is mandatory.

Document types

In the document list, you can see all the documents that are currently stored in your ePA. You can search and filter the documents by title, author and other criteria. You can call up further details on documents and display or download them to your device. As you yourself determine which data is available in your ePA, you can also delete documents at any time. Please note that this may result in gaps in your medical history.

Upload documents

You can also add new documents to your ePA in the document list. To do this, select an existing document on your device. The app suggests metadata when you add the document. You can change this data and adapt it so that you can easily find the document again later. The app encrypts the document before uploading it to your ePA, ensuring that only you or authorized persons have access to it.

File formats

Please use the following file formats:

• PDF
• JPG
• TIFF
• TXT
• RTF
• JPG
• PNG
• FHIR+XML (MIOs)

Document size (e.g. images)

The maximum size for each document is 25 MB.

Maximum storage space

The ePA has no memory limit.

Download, print or delete documents

You can download your documents from your electronic patient file at any time and print them out or forward them by e-mail. Make sure that the downloaded documents are saved in a secure folder.

• Go to the document overview in your ePA.
• Select the document or application you wish to delete.
• Save the document on your cell phone or print it out.

You can delete your uploaded files, entire applications such as the vaccination record or the complete electronic patient file yourself at any time. However, you cannot delete individual medical examinations/documentation in the applications yourself. However, you can authorize your doctor to do so.

If you want to delete documents or applications, proceed as follows:

• Open the ePA.
• Call up the document list in the general overview.
• Select the document or application you wish to delete.
• Delete this using the 3 dots at the top right.
• Show consents
• You can view and download the documents you accepted when setting up your ePA at any time.
• You can of course also revoke your consent. Please note that your ePA and all the data and authorizations it contains will be deleted. You will then no longer be able to access your EPA.
• Configure notifications
• When you open your ePA, the app shows you whether documents have been added or deleted since you last logged in. You can configure the time period or generally switch notifications on or off.

Blocking an electronic patient file that has already been created independently is possible around the clock at https://iam-bms.de/auth/realms/105734543/account is possible.

Important: Use of the ePA app is free and voluntary for insured persons. Whether it’s a doctor’s letter, migraine diary or medication plan: In the current form of the ePA, users decide for themselves who – i.e. which practice, which pharmacy or which hospital – may access which health data and for how long. Health insurance companies have no access. This means that data sovereignty always lies with the insured person. The principle of voluntary access and data sovereignty for insured persons also applies to the future ePA for all, which is due to be introduced in 2025. They can then actively use the ePA themselves via the app, but do not have to. If you do not want an ePA for all, you can object to its use.

You can cancel your electronic patient record at any time without giving reasons. If you use the app, you can do this conveniently directly in the app.

Anyone using the ePA without a mobile device can cancel by telephone, send us an e-mail or letter or contact one of our customer service employees. There is a statutory notice period of 28 days. You can cancel your contract at any time within this period. If you do not do so, all stored data will be deleted and the ePA will be closed. You can of course copy your data to your smartphone until the end of the period.

People with statutory health insurance can only have one active ePA. If you do not cancel your ePA when you change health insurance provider, you will receive an error message from your new health insurance provider.

As soon as you cancel your old ePA, you can also create a new ePA. Select the data transfer option and your data will be transferred to the new EPA. The old EPA will then be deleted automatically.

Your data is transferred automatically. Three steps are necessary for this:

1. Cancellation of the electronic patient file in the app of your previous health insurance company
2. Registration in the electronic patient file of your new health insurance company
3. Receive automatic confirmation from the new health insurance company that the electronic patient file is ready for data transfer

Important:

• The transfer of data is only possible for app users. If the ePA is used without the app, you will unfortunately not be able to take your data with you.
• Your data will be deleted if you do not activate the data transfer within 14 days (revocation period).
• Your assigned authorizations are automatically transferred to your new electronic patient file when you change health insurers.

Forgotten password

If you have forgotten your password or have blocked your access by entering it incorrectly several times (5 attempts), you can easily assign yourself a new password online in your patient file. To do this, go through the following steps:

1. Click on “Forgot password”.
2. Enter your insurance number on the next page.
3. You will receive a confirmation code by e-mail, which you enter on the next page.
4. Enter a new password and confirm the process.
5. Enter the new password and you will be taken back to the start page in the app.
6. Set a new password? Now you can use your patient file again.

Appcode assigned/forgotten

If you log in on a new or second device, you must connect it to your user account.

To do this, assign a freely selectable 6-digit app code and confirm this by entering it again – the app code is therefore assigned by the user themselves.

If you have forgotten the app code, we can reset it, but you will then need to identify yourself again.

Device management

When accessing your EPC, the file system ensures that only devices that are already registered in the file system can access it. In device management, you will find all devices from which you have already accessed your ePA. You can block or allow access to individual devices here, or remove devices completely. If you access your ePA with new devices, you must authorize access via a confirmation link that is sent to the e-mail address you have provided.

Log in again with KV number and password

The login token remains stored for 180 days unless a new app version appears or the cell phone is restarted.

Protocols

An EPA has a detailed log that users can call up at any time, but can also export. This log shows all access – by users themselves, but also by authorized persons – to the ePA. You can therefore see when documents are uploaded, retrieved or searched for from your ePA or when you have granted or withdrawn authorizations. You can search and filter the log. The log entries are deleted from the file system after three years.

It is also possible to view individual log entries in the detailed view. The type, time and result (successful or failed) of the access, name of the user, identifier of the object, etc. can be viewed here.

Possible actions

The log list can be exported and printed out at any time.