Legal implications of the stratification of the insured clientele according to Section 25b SGB V – requirements for patient information and AI use

Since 2024, there has been a new benefit offered by health and long-term care insurance: These can conduct data-based evaluations to identify, among other things, rare diseases, cancers, vaccination indications, and as yet undetermined need for care (Section 25b (1) of the Social Code Book V). If one of these evaluations identifies a specific health threat, the specific risk of illness or need for care, or the existence of a vaccination indication, the insured person must be informed immediately (Section 25b (4) Sentence 1 of the Social Code Book V). This task of health and long-term care insurance raises two questions: What legal requirements must be met regarding the stratification of the insured clientele and the decision to (not) inform certain insured persons? And what legal requirements arise from this for the use of artificial intelligence (AI) in stratification?

>> The content and legal requirements of the social security provisions were determined by applying legal interpretation methods, particularly interpretation based on the wording1 and the telos2, as well as historical3 and constitutional4 interpretation. The constitutional requirements for stratification were determined using the same methodology. The legal databases Beck-Online and Juris were used to search for publications on the provisions under review. Finally, the legal requirements thus determined were summarized, interpreted, and conclusions were drawn from a social security and legal perspective.
Results
Health and long-term care insurance funds store a large amount of insured-related health data. To improve the use of this wealth of data, the legislature also took insured persons into account in the context of the Health Data Use Act and decided that health and long-term care insurance funds can evaluate this data (as expressly provided in Section 25b Paragraph 1 Sentence 1 of the German Social Code Book V).

1. Social law requirements for stratification
Health and long-term care insurance funds are public corporations (Section 4 (1) of the Social Code Book V/Section 46 (2) of the Social Code Book XI) and, as such, public authorities. As such, they are comprehensively bound by law (Article 20 (3) of the Basic Law [GG]).
Within the scope of data analysis pursuant to Section 25b Paragraph 1 Sentence 1 of the Social Code (SGB V), they are granted discretion5, i.e., they can decide whether or not to conduct such data analysis. Legal grounds for a so-called reduction of discretion to zero6, i.e., an obligation to analyze data on the grounds that all other official decisions would be unlawful, are not apparent. The legislature has deliberately left the "whether" of analyzing data to the discretion of the health and nursing care insurance funds.
However, if a health or long-term care insurance fund carries out a data analysis and identifies a specific health threat, the specific risk of illness or need for care, or the existence of a vaccination indication, it must inform the affected insured person immediately (Section 25b (4) Sentence 1 of the Social Code Book V). While discretionary decision-making existed with regard to the data analysis, this does not exist with regard to the information provided to the insured person. The health and long-term care insurance funds are obliged to provide this information. The law further explains how this information must be provided, thus specifying the discretionary decision, i.e. the "how" of the information7. According to Section 25b (5) of the Social Code Book V, the data basis of the information provided subsequently must also be disclosed.
However, information does not have to be provided about every result, but only when the threshold for a "concrete" risk of illness or care is exceeded, or a vaccination indication is identified. The law itself already specifies how high the probability of damage to the insured person must be in order to exceed the threshold for the obligation to provide information, thus enabling reinsurance in medicine and health care science. Section 25b, Paragraph 4, Sentence 1 of the Social Code Book V requires a "concrete health threat" or the "concrete risk of illness or need for care" or the "existence of a vaccination indication." The terms "concrete danger" and "concrete risk" were not further explained by the legislature.
However, the term “concrete danger” is known in various areas of law: A danger is a sufficient probability of damage to a protected legal interest (in police law, for example, public safety or order, here health, since the law refers to a “concrete health threat”).
The question now is what constitutes a concrete danger. It would be logical to think that a concrete danger is more probable than an abstract danger. The Federal Administrative Court makes a different distinction and holds that abstract and concrete danger do not differ according to the degree of probability of a damaging event.8 Rather, it holds that the "mere probability" of damage occurring belongs to both abstract and concrete danger; "both concepts of danger impose the same requirements of probability with regard to the expected occurrence of damage."9 The difference, according to the Federal Administrative Court, lies "only in the perspective: with a concrete danger, "concrete," that is, related to the individual case, while with an abstract danger, "abstract-general," that is, related to the typical case."10 A concrete danger therefore exists
"if in the specific case under consideration, the occurrence of damage must be expected with sufficient probability at some point, admittedly in the foreseeable future; an abstract danger exists if a general-abstract consideration of certain types of behavior or conditions leads to the conclusion that damage is likely to occur in the individual case with sufficient probability."11

The case law follows this to this day and holds that even the “remote possibility of damage occurring is sufficient to assume a concrete danger.”12
As we have seen, the legislator of the Social Code (SGB V) has not bothered to define the term "concrete health hazard." The administrative law term "concrete danger" at least implies that a specific person must be threatened with a specific harm in the "foreseeable future," and that there must be a "sufficient probability" of harm occurring.
Health services research and medicine can build on this. If the thresholds of specific risk or vaccination indication are not met from the perspective of medicine and health services research, then providing information to insured persons is neither required nor permitted.
This is all the more true since the cost-effectiveness requirement of Section 12 of the Social Code Book V and Section 29 of the Social Code Book XI also applies within the framework of Section 25b Paragraph 4 of the Social Code Book V.13 Accordingly, all services must be sufficient, appropriate, and economical in the narrow sense; they may not exceed what is necessary. Insured persons cannot claim unnecessary or uneconomical services, and health or nursing care insurance funds may not approve them.14
This means that if there is insufficient medical evidence, then refraining from informing the insured person is not only possible but even required.
In this respect, the law follows medicine and health care research. For example, informing an elderly man about the presence of prostate cancer may be medically nonsensical if and because another disease is highly likely to lead to death beforehand. If the treatment is therefore not necessary within the meaning of the principle of cost-effectiveness, patient information is also unnecessary and can be omitted. Consequently, health insurance board members are liable with their private assets if they should have known that the health insurance company was providing an uneconomical service (Section 12 (3) of the Social Code Book V).
According to Section 25b, Paragraph 4, Sentence 1 of the German Social Code (SGB V), an obligation to provide information also exists when there is a concrete risk of illness or the need for care. The legislature has not further defined this term. The term "concrete risk" is also unknown to legal databases. The explanatory memorandum to the law itself does not indicate whether the legislature truly intended to distinguish between danger and risk.
A risk is less than a hazard; it is a process that is even more improbable than the reasonable probability of the occurrence of an illness or the need for care. A risk is what a society is willing to accept when it permits potentially dangerous activities; only when the threshold of "hazard" is exceeded does the law intervene. However, the legislature now wants warnings to be issued as soon as a concrete risk exists.
With regard to the concept of "concrete" risk as opposed to "abstract" risk, reference should be made to the definition presented by the Federal Administrative Court. Since the risk must be concrete and not the illness, it is irrelevant whether a specific illness may develop. At the same time, the risk must exist for the specific insured person in the specific individual case – a distinction that hardly makes sense.
At the same time, the legislator distinguishes not only between “risk” and “danger”, but also in the second element of the offense: the danger (specifically: endangerment) must exist for “health”, while the risk must exist with regard to the occurrence of “illness” or “need for care”.
Although the wording suggests otherwise, there seems to be no reason to distinguish between the two in light of the telos, i.e., the meaning and purpose of the regulation pursued by the legislature. Ultimately, the constituent elements of the specific risk of illness or need for care must be understood to mean that health and long-term care insurance funds must inform an insured person if they identify a possibility (not probability) of illness or need for care in the foreseeable future that arises from the individual (life) circumstances of that insured person.

2. Constitutional law requirements for stratification
In addition to the requirements of ordinary law, i.e. SGB V, on health and long-term care insurance funds, constitutional law must also be taken into account and examined to determine which fundamental rights may be affected and whether and, if so, in what form this also results in requirements for health and long-term care insurance funds with regard to stratification, the use of artificial intelligence and the decision on the information provided to insured persons.
The data analysis and the information provided to the insured person affect several fundamental rights of the insured person:
a) General principle of equality in Article 3, paragraph 1 of the Basic Law
The general principle of equality in Article 3, Paragraph 1 of the Basic Law requires an authority to treat essentially similar situations equally and essentially different situations unequally. It is therefore not only a prohibition of unequal treatment, but also a requirement of it.15
This first requires the formation of comparison groups16 that hardly differ in factual terms. Only when the facts within a comparison group are treated unequally does the application of the general principle of equality even begin. In concrete terms, this means that the general principle of equality can only be violated in the context examined here if, for example, in the case of two insured persons with an identical "risk" or an identical "danger" identified through stratification, one of the two insured persons is informed of the "risk" or "danger" while the other is not.
It follows that, in order to comply with the general principle of equality under Article 3, Paragraph 1 of the Basic Law, health and nursing care insurance funds are not required to provide information about all risks identified during data analysis. As already shown above, the question of when information should be provided, and how high and specific the risks are, is determined by health services research and medicine. If, from a medical-scientific perspective, a risk is largely negligible, then it is not necessary to inform insured persons with an existing but negligible risk.
However, the general principle of equality requires that the risk information requirements be applied equally to all insured persons. Therefore, if several insured persons are exposed to an existing but negligible risk, some of them may not be informed and others not. Conversely, information about a specific risk must generally be provided to all insured persons for whom such a risk has been identified.
Ultimately, however, equal treatment of substantially different situations or unequal treatment of substantially similar situations can be justified, so that even in this case, a violation of fundamental rights does not occur. Case law and legal scholarship have developed several models for this, ranging from a mere review of the arbitrariness of the administrative decision to a strict proportionality test.17
Within the framework of the strict proportionality test, unequal treatment of essentially similar circumstances or equal treatment of essentially dissimilar circumstances is only justified if the unequal treatment or equal treatment pursues a legitimate purpose, is suitable, necessary (in the sense of the absence of less (un)equal but equally effective administrative action), and appropriate in the narrow sense of a prohibition of excessiveness. Whether the stricter standard of proportionality test should be applied or whether the authority is granted greater discretion is now determined by whether the official measure is linked to personality traits, whether fundamental rights of freedom are affected, and to what extent the person affected has the opportunity to influence the implementation of the differentiation criteria through their behavior.18 In this context, the state has greater discretion when granting (voluntary) benefits than when interfering with the legal positions of citizens (for example, in police law).
In this case, there is much to be said for applying the stricter standards of proportionality testing to any decisions made by health and long-term care insurance funds in the context of stratification on the one hand, and information to insured persons on the other. This is because once a health and long-term care insurance fund has decided to analyze data, it is obligated to provide information. Furthermore, these are personality traits—namely, illnesses, personal dispositions, etc.—and individuals are not in a position to adjust their behavior toward the health or long-term care insurance fund in such a way that they could influence whether or not they are informed.
Whether the general principle of equality is potentially violated by missing or adjusted information if the health or nursing care insurance fund treats essentially similar facts (results of data evaluations/insured persons, decisions to provide information or not) unequally, is therefore determined by
• whether the decision of the health or nursing care insurance fund pursues a legitimate purpose (this may well be administrative simplification or cost savings);
• whether the health or nursing care insurance fund is taking a step towards achieving this goal by not providing the respective insured person information;
• whether there are simpler means for the health and nursing care insurance funds to achieve this goal than not providing information (for example, digital information for insured persons in the case of the aim of administrative simplification) and
• whether the simplifications sought by the health and nursing care insurance fund are proportionate to the disadvantages for the insured person.

Given that the insured person faces concrete health risks, the hurdles for the latter decision are particularly high. To continue with the example, what administrative simplification can outweigh a concrete health risk to an insured person?
Only if all these requirements are met cumulatively would the decision of the health or nursing care insurance fund not to provide information, even though information has been provided in comparable circumstances, be justified and thus legal under the general principle of equality in Article 3(1) of the Basic Law.

b) Fundamental right to life and physical integrity – Article 2, paragraph 2, sentence 1 of the Basic Law
Fundamental rights are, first and foremost, rights of defense against state intervention.19 However, fundamental rights can – exceptionally – also have a benefit-related character. Almost 90 percent of the population are insured under statutory health insurance, most of them as compulsory members. Their financial means are generally insufficient to also take out full private health insurance. This may, under certain circumstances, result in the incorrect or inadequate provision of benefits by statutory health insurance affecting the benefit-related content of the fundamental right to life and physical integrity, sometimes together with the welfare state principle of Article 20, Paragraph 1 of the Basic Law.
It is at least recognized that the state has a duty to create a sustainable health and health insurance system.20
However, specific benefits are generally not derived from the Basic Law21; a well-known exception is the so-called Nikolaus decision of the Federal Constitutional Court, according to which there is a direct entitlement to benefits in the case of life-threatening or value-based illnesses.22 Furthermore, ordinary law – in this case Section 25b Paragraphs 1 and 4 of the Social Code Book V – specifies the rights of the insured and the obligations of health and long-term care insurance and thus the content of the fundamental right.
The health and nursing care insurance funds do not interfere with the fundamental right to life and physical integrity as set out in Article 2, Paragraph 2, Sentence 1 of the Basic Law by failing to provide or providing incorrect information.
Even if one were to assume that the simple legal specification of the information obligations of the health and nursing care funds would at the same time lead to a fundamental right obligation of the same extent - which is by no means obvious - the above statements apply: If the threshold of a concrete health risk (or a "simple" vaccination indication) is not reached from a medical-scientific point of view, the health and nursing care funds are not obliged to provide information; there is neither a simple legal nor even a constitutional right to do so.

c) Fundamental right to data transparency – Article 19 (4) of the Basic Law
It has already become clear from the above that the health or nursing care insurance fund must be able to justify how it carries out the stratification and how it made its decisions.
Legally, this is also required by the fundamental right to data transparency (Article 19 (4) of the Basic Law).
It is now recognized, according to established case law and the prevailing view in legal research, that Article 19, paragraph 4 of the Basic Law (GG) implies that a person subject to a norm is, in principle, entitled to fully review state measures in legal and factual terms.23
The transparency requirement was initially developed by the Federal Constitutional Court in the context of state surveillance measures. The principle of proportionality then sets requirements for transparency, individual legal protection, and supervisory control of data processing.24 Transparency in data processing is intended to contribute to the development of trust and legal certainty and to ensure that the handling of data remains integrated into a democratic discourse. At the same time, it enables citizens to behave accordingly.
Furthermore, it constitutes the prerequisite for effective legal protection for those affected. By providing them with information about the data processing concerning them, it enables them to have the legality of the corresponding measures reviewed – if necessary, in court – and to assert any rights they may have.25 For data processing with an impact on fundamental rights – as in this case – the data used must be preserved at least to the extent that the data subject retains the right to judicial review of the measure.
It is rightly assumed that a request for legal protection can only be examined comprehensively and independently in legal and factual terms by the courts if the facts are clearly evident.26 This is a preliminary effect of the guarantee of legal protection.27 A court must be able to review executive acts – such as decisions by health and nursing care insurance funds – entirely independently.28
These legal rights of the insured, derived from the Basic Law, have a direct impact on the administrative decision-making processes in the health and nursing care insurance funds and on the use of artificial intelligence.
Artificial intelligence can only be used if its methodology, the sources it uses, the calculations, and weightings are transparent and understandable. Currently known AI models offer the ability to review and highlight results, and jump to specific results from imported sources. However, the solution and research methods used remain partially unknown; these are sometimes known only to the AI developers and are not disclosed to users. Negative results also remain unknown, as does the reason why the AI does not report them (for example, why no vaccination recommendation is given or why no warning is issued about a specific disease).
This means that all positive and negative results of the use of artificial intelligence must ultimately be humanly reviewed against comprehensible, documented criteria. For legal reasons, the use of AI that is not individually verified for each result can only be considered if the AI's solution has been documented and verified—especially with regard to the decision not to inform certain insured persons—and this can be reproduced.

3. Detection and consequences of legal violations
In German law, a violation of law alone is not sufficient to defend oneself against it. Rather, the norm violated by the authority must serve not only the public interest, but also the interest of the individual (so-called protective norm theory, see Section 42 of the Administrative Court Code (VwGO). Lawyers must therefore examine whether the norm is also intended to serve the interests of the individual insured person. This is clearly the case with Section 25b Paragraph 4 of the Social Code (SGB V). The legislature has placed the health interests of the individual insured person at the protective purpose and center of the norm.
If a notification is issued pursuant to Section 25b Paragraph 4 of the Social Code Book V, the insured person or their representative has the right to know the data basis pursuant to Section 25b Paragraph 5 of the Social Code Book V. This may enable the verification of false-positive notifications.
In addition, all health and nursing care insurance funds are subject to the respective freedom of information laws of the states or (for funds under federal supervision) to the Federal Freedom of Information Act (IFG), which in any case provides an abstract right to information about the requirements and the method of data evaluation. Thus, according to Section 1 Paragraph 1 of the Federal Freedom of Information Act, everyone has the right to access official information. According to Section 2 No. 1 of the Federal Freedom of Information Act, official information is all records serving official purposes, regardless of the type of storage. This also includes the plans and measures for the implementation of the
Section 25b paragraph 1 SGB V, i.e. stratification.
Insured persons can also request information from their respective health and long-term care insurance fund about the purposes for which their data is processed (Article 15 (1) (a) of the General Data Protection Regulation [GDPR]). These purposes also include processing activities such as the data analysis permitted under Section 25b (1) of the Social Code (SGB V)29, as well as whether the health or long-term care insurance fund uses AI applications. For "automated decision-making"30, Article 15 (1) (h) GDPR in conjunction with Article 22 GDPR expressly provides for a right to information, which also includes "meaningful information about the logic involved, as well as the scope and intended effects of such processing for the data subject."
Both the abstract claims for information under the Freedom of Information Acts and the specific information about the data processing of the respective insured person can be enforced in court (before the administrative or social courts).
In practice, it is conceivable that insured persons learn from third parties - other insured persons, self-help groups, etc. - that they and their data have been treated differently, for example that they have not received certain information from the health and long-term care insurance fund according to Section 25b Paragraph 4 of the Social Code Book V (false negative), which may indicate unequal treatment or errors in the evaluation process (whether AI-based or not).
As explained, Section 25b Paragraph 4 of the Social Code (SGB V) protects third parties, meaning that individual insured persons can invoke the norm and demand its application. If insured persons were unlawfully not informed, they can assert this so-called primary claim – i.e., information from the health or long-term care insurance fund. This is aimed at simple administrative action, the release of information, or justification as to why informing the insured person was not necessary. Here, too, it becomes clear that the health and long-term care insurance fund must always know how it arrived at its respective decision. Here, too, the following applies: If the health or long-term care insurance fund cannot provide medically and scientifically justified procedures and decisions, it will lose. These claims can be enforced in court before the social security courts.
If the insured person receives information from their health or nursing care insurance provider too late in accordance with Section 25b Paragraph 4 of the Social Code (SGB V) and suffers causal health damage as a result, the insured person can claim damages through official liability (Section 839 of the German Civil Code [BGB], Article 34 of the Basic Law). Possible causes include health damage caused by delayed treatment or omitted vaccinations resulting in the realization of the health risk against which the vaccination was intended to protect.
However, it would likely be extremely difficult for the insured person to prove the causal link between the failure or delay in providing information by the health or nursing care insurance provider and the respective health damage, as it seems hard to imagine that there were no more obvious indications of these health risks than the data available to the respective health or nursing care insurance provider. If they succeed, however, compensable damages include loss of earnings, additional expenses due to illness, claims for pain and suffering, etc. These can be asserted in court before the regional courts.
Discussion and conclusion
Health and long-term care insurance funds can conduct data-based evaluations. An obligation to provide information initially arises when a specific health risk to the insured person is identified. This presupposes that there is a sufficient probability of health damage. At the same time, the legislature has required, in a barely comprehensible form, that health and long-term care insurance funds must provide information when there is a specific risk of illness or need for care. It remains unclear whether different requirements really need to be placed on the probability of damage occurring for the insured person here than in the first scenario. If one wants to differentiate, one can assume that health and long-term care insurance funds must provide information when they identify a possibility (not probability) of illness or need for care in the foreseeable future that arises from the individual (life) circumstances of an insured person.
Whether these thresholds are met is ultimately determined by medical science and health services research. If the danger or risk is not sufficiently significant from a medical perspective, there is no legal reason to inform insured persons.
In addition, information must be provided if a vaccination indication for a STIKO vaccination is identified. It is clear that the legal wording and differentiation are neither congruent nor consistent.
By law, health and long-term care insurance funds must be able to provide a comprehensible explanation of how they arrived at their findings and why they made the information decisions they made. These legal requirements arise from the general principle of equality under Article 3, Paragraph 1 of the Basic Law (GG), but also from the fundamental right to data transparency. These requirements also arise from the burden of proof provisions of the respective procedural law, because health and long-term care insurance funds would lose both the primary claim (request for information) and the secondary claim (claim for damages) in court if they could not justify their decisions.
These legal requirements limit the use of artificial intelligence to the extent that it cannot make its procedures and results, especially its decisions not to classify certain situations as a "concrete danger" to an insured person, transparent and comprehensible. Only when artificial intelligence meets these requirements can it be used for stratifications according to Section 25b Paragraph 1 of the Social Code Book V and for decisions regarding insured person information according to Section 25b Paragraph 4 of the Social Code Book V.