EHR Backend Development

Germany began rolling out the "ePA für alle" (an electronic patient record for everyone) on January 15, 2025. Statutory health insurers are required to create an electronic patient record for every insured person who does not opt out. Technically, an ePA record system manages the insured people's records and provides them to the respective client applications.

gematik, Germany's national agency for digital medicine, defines in its specifications how such a record system must be built. This includes components for user authentication, an access gateway, authorization and key management, and document management. Record systems go through a gematik approval process.

IBM Deutschland is the manufacturer of an approved ePA record system. This is the environment in which DuoByte works on C++ backend components.

gematik specifications are binding. Backend components have to implement them precisely, because the record system is approved by gematik and must work with the clients it provides records to.

The ePA holds sensitive health data. Every change to the backend therefore has to meet the strict data protection and security requirements of the German healthcare system.

At the same time, the system serves an ePA for 73 million insured people. That puts real weight on the stability and resource efficiency of the backend components, and new work goes into an existing team's codebase rather than a greenfield project.

Within IBM's ePA team, DuoByte implements development tasks for backend components in C++. The basis is gematik's specifications and Germany's standards for health data.

Code reviews are a second focus: DuoByte reviews other developers' pull requests before changes enter the codebase. The review covers correctness against the specification as well as robustness, performance and security of the code.

This work draws on more than ten years of experience with performance-critical systems, from embedded through security to cloud.

The backend components are written in C++ and built with CMake, with Boost extending the standard library. The project uses REST and SOAP interfaces, data is stored in PostgreSQL, and Python is used alongside.

Docker, DevContainers and Kubernetes form the project's container infrastructure. Jenkins handles builds and continuous integration, and SonarQube runs static analysis for quality and security issues.

Changes go through pull requests and code reviews. Performance optimization and IT security are constant priorities: C++ allows systems-level programming that gives precise control over memory and compute resources.

The work is ongoing: DuoByte continues to develop C++ backend components of the ePA at IBM and to review pull requests within the team.

For healthcare clients, this means they talk directly to developers who know gematik specifications, the security requirements for health data and the realities of a large, regulated software project from daily practice.