Engineering a DiGA with a cloud-based solution requires special care during planning. This is because the Digital Health Applications Ordinance (DiGAV) formulates high requirements for the security and data protection of health and personal data.<\/p>\n
For this purpose, questionnaires are provided in Annex 1 and Annex 2 of the DiGAV, which manufacturers must complete. The aim should be to be able to answer every question with “applicable”. If this is not the case, precise reasons must be given. The effort required for realization and implementation in order to ultimately meet the requirements should not be underestimated. The questionnaires comprise a total of 124 questions:<\/p>\n
- \n
- Appendix 1 consists of 77 questions on data protection and data security with an additional 9 questions that apply to a DiGA with very high protection requirements.<\/li>\n
- Appendix 2 consists of 38 questions on quality and interoperability.<\/li>\n<\/ul>\n<\/div>
DiGA – very high protection requirements?<\/h2><\/h2><\/div>
Whether a DiGA has a very high protection requirement must be determined with a protection requirement assessment. Reference is made to BSI Standard 200-2 in the DiGAV. It describes a detailed determination of protection requirements as well as sample criteria for orientation. One of these example criteria is, quote:<\/p>\n
“The protection of personal data must be guaranteed. Otherwise, there may be a risk to life and limb or to the personal freedom of the person concerned” Source: BSI Standard 200-2<\/a><\/i><\/p>\n
If there is a very high need for protection, the additional 9 questions from DiGAV Annex 1 must be taken into account. Manufacturers must plan for the resulting requirements at an early stage. The following points are particularly interesting for a cloud-based solution:<\/p>\n
- \n
- Penetration test, including all backend components<\/li>\n
- Two-factor authentication for at least the initial authentication process<\/li>\n
- Encryption of personal data on systems that are not at the personal disposal of the user<\/li>\n<\/ul>\n
However, the type of encryption is not specified.<\/p>\n<\/div>
![\"BAYOOMED](\"https:\/\/www.bayoomed.com\/wp-content\/uploads\/sites\/4\/2024\/06\/BAYOOMED-DiGA-Compliant-Cloud-Schutzbedarf.jpg\")
<\/span><\/div>DiGA – Personal data<\/h2><\/h2><\/div>
The GDPR (Regulation (EU) 2016\/679) applies first and foremost to the handling of personal data. National laws, such as those on information security, sustainability, “lived” data protection and the de facto possibility of asserting claims against manufacturers, must also be observed. The DiGAV also requires a granular presentation of all locations where personal data is processed, including external systems and providers. GDPR and national laws must be observed for all locations.<\/p>\n
If personal data is processed in the cloud as part of a DiGA, cloud providers must be checked with regard to the GDPR. There is an information paper from the BfArM entitled:<\/p>\n