Austria: ELGA and AI access

Who may process ELGA data?

ELGA, the Austrian electronic health record (Elektronische Gesundheitsakte), makes reports, discharge letters and medication data available to treating facilities. The Health Telematics Act 2012 (GTelG) ties every processing operation to three conditions (§ 14 (1)): the patient is clearly identified, the facility is identified, and it is authorised to access the data.

Only the following may process the data (§ 14 (2) no. 1):

• the treating or caring healthcare providers,
• facilities to which the person was referred for treatment,
• people who support these facilities and have been instructed to do so in the specific case.

The sole purpose is healthcare under Art. 9 (2) (h) GDPR. Excluded are the administration of systems and services, occupational medicine and the assessment of fitness for work. Anything not provided for by EU law or by statute is prohibited (§ 14 (3)).

May an AI access ELGA?

The GTelG has no separate access for AI. An AI is a tool of the authorised facility. In our assessment, this means:

Use	Classification
A doctor has a report from ELGA summarised for the current case	Within treatment, if she may access it herself
A nurse has the medication prepared for the handover, on instruction	Possible, as an instructed person (§ 14 (2) no. 1 lit. c)
An AI retrieves ELGA data of all patients in the background to look for anomalies	Not covered by the purpose of treatment
ELGA data flows into the training of a model	Not provided for, therefore prohibited

Every processing operation within ELGA is logged, including the time, the type of operation, the facility and the name of the natural person who processed the data (§ 22 (2)). An access must therefore always be attributable to a person. The logs are kept for three years, and patients can view them in the ELGA portal.

Which interfaces give software access to ELGA?

ELGA GmbH publishes its interfaces in the ELGA Developer Portal. As of October 2026:

Interface	Purpose	Status
ELGA authorisation system	Permissions, contact confirmations, patient, document and consent management, e-vaccination record	In production
ELGA reference client	Connection based on IHE, reading and writing documents in CDA format	In production
Central patient index	Clear identification of patients	In production
e-Health terminology server	Code systems and value sets	In production
ELGA Service Facade (FHIR)	Access via FHIR R4 and R5, with a token from the ELGA Authorization Server and role-based permissions	In development
e-Medication (FHIR)	Reading the medication plan and dispensations	In development
e-Diagnosis and parent-child record (FHIR)	Diagnoses; birth notification and parent-child record for hospitals	In development

For reports and discharge letters, the route today is the connection based on IHE, via the systems of the healthcare providers. The FHIR access points are in development; they require a token that the eHealth application requests for a specific role. An AI in a hospital therefore does not reach ELGA on its own, but via the hospital’s system that is already connected and enforces the access rights under § 14 and § 18 GTelG.

What rights do patients have?

• Opt-out: They can object to ELGA in full or in part (§ 15 (2)). Existing references are then deleted or made inaccessible.
• Show and hide: They can hide individual reports from facilities or delete them, and shorten access periods (§ 16 (1)).
• No disadvantage: Anyone who objects must not be disadvantaged in their care (§ 16 (3)).

For your AI, this means: if a report is missing from ELGA, this may be a deliberate decision by the person. A summary from ELGA is therefore never guaranteed to be complete.

What applies to data already in the hospital?

If a facility has retrieved a report as part of treatment and added it to its records, hospital law, documentation duties and the GDPR apply to this copy. Even then, the purpose remains tied to treatment. For an analysis for research or quality purposes, you need a separate legal basis.

How does this work with basebox?

basebox is not connected to ELGA. Connections to clinical systems are only created once the vendor or the hospital provides access, for example via FHIR or an existing interface; we then build the connector in agreement with the hospital and the vendor.

What basebox brings fits the rules of the GTelG:

• Acting on behalf of a person: An agent always acts on behalf of a person and reaches only what has been shared with them and what they may do themselves in the target system. There is no shared service account.
• Logs: The audit log records who did what and when; entries cannot be changed.
• No training: Your data does not train any model.

In Austria, basebox offers the cloud and the server. The server can be set up on your premises if you wish, even without an internet connection. The interface and support are available in German and English.

Not legal advice: The classification of AI uses in the table is our assessment, not an interpretation by authorities or courts. Clarify specific projects with your data protection officer and ELGA GmbH. The GTelG 2012 is amended frequently; the version in force in the RIS is authoritative. Research as of 11 October 2026, interfaces as of 22 October 2026.