FAQ: Interesting facts about DiGA development for providers

In Germany, digital health applications (DiGA) are an important part of modern medicine. In addition to mobile apps, these also include web-based applications, software for medical devices, telemedicine platforms, VR applications and wearable sensors. It is important that they support, improve or enable healthcare through the use of digital technologies.

Since the launch of Germany's DiGA application portal, a total of 203 applications have been submitted to the Federal Institute for Drugs and Medical Devices (BfArM) for review. Of these 203 applications, 159 applications were submitted for provisional inclusion for testing, while 44 applications are aimed at permanent inclusion (as of June 2024). But what do providers need to consider if the medical device is to be approved as a DiGA? What is particularly important for international providers? Answers to these and other questions can be found in this FAQ.

Who is entitled to a DiGA and how does the prescription work?

Around 73 million people with statutory health insurance in Germany are entitled to DiGAs, which can be prescribed by doctors and psychotherapists and are reimbursed by health insurance companies.

What are the requirements for a DiGA as a medical device?

The DiGA supports the detection, monitoring, treatment or alleviation of diseases or disabilities. It must be a medical device designated within specific risk classes and with a main function based on digital technologies.

Applications covered are first found within risk class I medical devices include products such as dressing materials, care and hygiene products or aids which are generally non-invasive and do not require complex technical systems. Secondly, medical devices in risk class IIa are partially invasive or come into contact with the body for a longer period of time. These include surgical instruments, short-term implants, diagnostic devices and therapeutic devices.

Why the fast-track procedure for inclusion in the DiGA directory and how does it work?

The fast-track procedure enables the Federal Institute for Drugs and Medical Devices (BfArM) to quickly assess and include DiGA in the directory of reimbursable digital health applications. The processing time is three months after receipt of the complete application.

How does the process of DiGA inclusion in the directory work?

The process of adding a DiGA to the directory of reimbursable digital health applications involves several steps.

What are the differences between permanent and provisional inclusion in the DiGA directory?

There are two options for inclusion in the directory:

• Permanent inclusion: If a comparative study is already available that demonstrates positive care effects.
• Provisional inclusion: If no study is available yet, but the DiGA fulfills all other requirements. Proof of positive care effects can be provided within a trial period of up to twelve months.

How are positive effects on care demonstrated?

The provider of the DiGA must demonstrate positive effects on care, either through medical benefits or through patient-relevant structural and procedural improvements. The studies to prove these effects must be carried out in Germany.

What data protection requirements must a DiGA meet?

A DiGA must comply with the data protection requirements in accordance with the General Data Protection Regulation (GDPR) and national regulations. This includes permissible purposes of data processing and ensuring data security. The purposes include detecting and treating diseases, monitoring health status, improving structural and procedural processes or documentation and traceability.

What data security requirements must a DiGA fulfill?

Data security requirements are a key aspect in the development and operation of a DiGA. Comprehensive measures must be taken to ensure the integrity, confidentiality and availability of the processed data. These include, for example, encryption, access controls, data backup, training and awareness-raising.

How is the interoperability of DiGAs ensured?

DiGAs must be interoperable, i.e. they should use specific data formats and structures that enable information to be exchanged correctly and comprehensibly. They should also use defined, generally recognized technical standards. These are rules and protocols that ensure that different software programs and systems can communicate with each other.

It is also important that DiGAs are developed in such a way that they can be seamlessly integrated into existing systems and databases in the healthcare sector.

Is data processing outside the EU permitted for DiGA?

In principle, the GDPR permits the processing of personal data within the European Union (EU). Processing outside the EU in a so-called third country is permitted if a comparable level of protection exists there. This is confirmed by an adequacy decision in accordance with Article 45 GDPR. For DiGA, processing of personal data outside the EU is only permitted in countries that offer such a level of protection.

What conditions must US service providers meet in order to be approved for DiGA data processing?

US service providers can be used for the storage and processing of personal data provided that they have signed up to the EU-US data protection framework and are obliged to comply with detailed data protection obligations. Without this obligation, the processing of personal data by US service providers is not permitted.