Data protection
Diagnoses from medical invoices: insurer needs consent
Tobias Reinhardtapprox. 5 min read
A private health insurer analysed the medical invoices submitted by its customers for diagnoses and invited suitable policyholders to join preventive care programmes. The Federal Administrative Court has ruled: without consent, it may not use health data for this purpose, even if the programmes serve preventive care. What privately insured people can take away from the judgment.
AI-generated Diagnoses as an invitation list
Anyone with private health insurance submits their medical bills to the insurer and has the costs reimbursed. Those bills state diagnoses. One private health insurer used them for a second purpose: it analysed the submitted bills by diagnosis in order to find participants for its prevention programmes, such as coaching for diabetes, asthma or back problems. Anyone whose diagnoses fitted a programme received an invitation.
The insurer obtained consent, meaning the voluntary and express agreement of the insured, only from new customers and when existing customers changed their contracts. For all other insured persons, the analysis ran without consent. The Federal Administrative Court declared this practice unlawful in its judgment of 6 March 2026 (case no. 6 C 7.24).
Regulator and courts at odds
The State Data Protection Commissioner of Rhineland-Palatinate issued a reprimand to the insurer in February 2022. At the same time, it ordered the insurer, subject to a deadline, to carry out such analyses only on the basis of valid consent. The insurer brought proceedings and initially won twice: the Mainz Administrative Court set the order aside, and the Koblenz Higher Administrative Court dismissed the regulator's appeal.
The Federal Administrative Court overturned both judgments and dismissed the claim. The reprimand and the order therefore stand, and the insurer bears the costs of all three instances.
Health data: two hurdles
Diagnoses are health data, that is, information about a person's physical or mental health, and the General Data Protection Regulation (GDPR) protects them particularly strictly. Anyone wishing to process them must clear two hurdles. First, one of the exceptions that the law provides specifically for health data must apply. One of these covers preventive health care purposes. Second, as with any data processing, a general legal basis is required, such as consent or a legitimate interest.
The insurer cleared the first hurdle. The court found that the prevention programmes of a private health insurer serve preventive health care. The fact that the insurer also keeps an eye on cost efficiency and does not run the programmes itself but merely arranges them makes no difference. The court also considered the staff's duty of confidentiality sufficient, and up to this point things were going well for the insurer.
No legitimate interest
It failed at the second hurdle. For the insured persons who had not given consent, only legitimate interest remained. This refers to the possibility of using data without consent where one's own interests override those of the data subjects. The court saw two problems here. First, the insurer had not told its customers clearly enough which interests it was pursuing with the analysis. Anyone relying on a legitimate interest must also state it to the data subjects.
Second, the balancing exercise came out against the insurer. Health data enjoy a heightened level of protection, and the analysis affected a large number of insured persons. Above all, however, an insurer's prevention programmes are not part of the core area of medical care and not part of the relationship between doctor and patient. Anyone submitting a bill for reimbursement therefore cannot reasonably expect the insurer to derive from it, without consent, an invitation to back coaching.
The court left open whether the insurer had additionally breached the principle of purpose limitation. Purpose limitation means that data may only be used for the purpose for which they were collected. Given the outcome of the balancing exercise, this no longer mattered.
What this means for insured persons
For privately insured people, the judgment has one simple consequence. The insurer may use the diagnoses from submitted bills for billing purposes. If it wants to analyse them beyond that in order to offer prevention programmes, it needs consent. The court did not object to the programmes themselves; it even confirmed that they serve preventive health care. But good intentions are no substitute for consent, and that applies all the more to health data.
Anyone who has received such an invitation without ever having given consent can ask the insurer on what basis the analysis was carried out. Every data subject has the right to information about which data the insurer processes and for what purpose. If the answer is unsatisfactory, a complaint to the data protection authority is possible.
Anyone who gave consent as a new customer or when changing their contract should know what that signature means: the insurer may then analyse the diagnoses and send out invitations. Consent is voluntary and can be withdrawn at any time with effect for the future. It is also worth looking at the insurer's privacy notice. It must set out what health data are used for and which interests the insurer relies on.
Conclusion
Diagnoses on submitted bills are health data and remain so even if the insurer has something useful in mind for them. The Federal Administrative Court has made it clear that legitimate interest is not enough for analysis for prevention programmes: the insurer needs its customers' consent.
Privately insured people therefore decide for themselves whether their diagnoses turn into invitations. Anyone who never agreed and still receives one has good reason to ask.
