Germany’s national e-health agency Gematik has approved an extended identification procedure based on Nect’s automated video identification technology, clearing the way for its use in creating a HealthID for access to electronic patient records and other core health services. The procedure, branded Nect Ident with ePass, gives health-insured individuals a biometric alternative to classic eID-based flows that rely on an electronic identity card or health card and PIN codes obtained in person.
Under the model described by Nect and Gematik, users authenticate themselves via a dedicated Nect mobile app. The process combines a video capture of the identity document, NFC reading of the embedded chip, and a short video selfie in which the user pronounces randomly selected words. Nect CEO Benny Bennet Jürgens describes the approach as automated video identification with NFC supplement, arguing that it offers a higher level of assurance than traditional video identification by pairing biometric checks with cryptographic verification of document data in line with eIDAS security and anti-tamper requirements.
The approval follows earlier Gematik clearance in August 2025 that allowed the same procedure to be used for ordering PINs for the electronic health card. The latest decision goes further by allowing Nect Ident with ePass to be used directly for the creation of a HealthID that unlocks services such as electronic prescriptions and the electronic patient record. Gematik has previously prohibited classical video-ident methods for healthcare due to security concerns, including susceptibility to replay and injection attacks, which has left regulators under pressure to find remote alternatives that can meet high assurance thresholds.
In an interview with Heise, Jürgens asserted that Gematik conducted its own Level of Assurance assessment under its internal criteria, with guidance from the Federal Office for Information Security (BSI), even though a formal BSI technical guideline certification is not yet in place. The procedure also includes a requirement for manual review of a portion of successful and rejected identifications, and higher rates of human review for less common document types, in order to strengthen fraud detection and quality control.
Critics from the digital rights and security research community, including experts associated with the Chaos Computer Club, have raised concerns that any system relying heavily on video and images will remain vulnerable to deepfake techniques and coercion scenarios, particularly in domestic abuse situations where victims may not control their own devices or documents. Supporters argue that for people who are mobility impaired or live far from insurer branches, a remote procedure that still ties back to chip-based document verification represents a practical improvement over the status quo. For CISOs in healthcare and digital identity, the decision illustrates how regulators may balance eIDAS-inspired assurance models with national constraints while exploring wallet-based approaches under the coming European Digital Identity framework.
Sources: Heise online
—
By Cass Kennedy
